Submitted URL: https://homepage.univie.ac.at/marita.haas/chase.com/
Effective URL: http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Submission: On July 26 via manual from US

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 10 HTTP transactions.
The main IP is 130.234.10.207, located in Jyväskylä, Finland and belongs to FUNETAS, FI. The main domain is users.jyu.fi.
This is the first time this domain was scanned on urlscan.io!

Verdict: Malicious (Score: 100/100) Show Details

  • urlscan - Score: 100
    phishing
    Phishing against Generic (Online) Chase (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 2001:62a:4:70... 1853 (ACONET AC...)
1 9 130.234.10.207 1741 (FUNETAS)
1 54.148.84.95 16509 (AMAZON-02)
10 3
Domain
Subdomains
Transfer
9 jyu.fi
1 MB
1 sitepoint.com
6 KB
1 univie.ac.at
728 B
0 csscheckbox.com Failed
.csscheckbox.com Failed
0 B
10 4
Domain Requested by
9 users.jyu.fi 1 redirects users.jyu.fi
1 www.sitepoint.com users.jyu.fi
1 homepage.univie.ac.at 1 redirects
0 csscheckbox.com Failed users.jyu.fi
10 4

This site contains links to these domains. Also see Links.

Domain
Subject / Issuer Validity Valid
sitepoint.com
SSL.com Premium EV CA
2018-08-07 -
2019-09-23
a year

1970-01-01 -
1970-01-01
a few seconds

Screenshot


Detected technologies

Web
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i


Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
/~piaupaal/chase.com
Redirect Chain
  • https://homepage.univie.ac.at/marita.haas/chase.com/
  • http://users.jyu.fi/~piaupaal/chase.com/?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?...
  • http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66...
5 KB
5 KB
Document
General
Full URL
http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Protocol
HTTP/1.1
Server
130.234.10.207 Jyväskylä, Finland, ASN1741 (FUNETAS, FI),
Reverse DNS
karahka2.cc.jyu.fi
Software
Apache / PHP/5.4.16
Resource Hash
b9d22c82ceefb72aecb41e2eafa0c8bf091bb2d3eb18cfc64c51dfed34e0f8d0

Request headers

Host
users.jyu.fi
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Fri, 26 Jul 2019 01:26:11 GMT
Server
Apache
X-Powered-By
PHP/5.4.16
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html

Redirect headers

Date
Fri, 26 Jul 2019 01:26:11 GMT
Server
Apache
X-Powered-By
PHP/5.4.16
location
login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword
17 KB
6 KB
Script
General
Full URL
https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js
Requested by
Host: users.jyu.fi
URL: http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-148-84-95.us-west-2.compute.amazonaws.com
Software
Apache/2.2.22 (Debian) /
Resource Hash
7742fb83d98648f94727a40d5c3381b3245805e62b6f998002d933715ac84b6a
Security Headers
Name Value
X-Frame-Options sameorigin

Request headers

Referer
http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Fri, 26 Jul 2019 01:10:49 GMT
Content-Encoding
gzip
X-Cache-Lookup
HIT from ip-172-31-22-12.us-west-2.compute.internal:3128
Last-Modified
Fri, 15 Oct 2010 00:03:45 GMT
Server
Apache/2.2.22 (Debian)
Age
934
X-Frame-Options
sameorigin
ETag
"680936-4208-4929c8f629a40"
Vary
Accept-Encoding
X-Cache
HIT from ip-172-31-22-12.us-west-2.compute.internal
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
5767
c1.png
/~piaupaal/chase.com/images
160 KB
160 KB
Image
General
Full URL
http://users.jyu.fi/~piaupaal/chase.com/images/c1.png
Requested by
Host: users.jyu.fi
URL: http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Protocol
HTTP/1.1
Security
, ,
Server
130.234.10.207 Jyväskylä, Finland, ASN1741 (FUNETAS, FI),
Reverse DNS
karahka2.cc.jyu.fi
Software
Apache /
Resource Hash
87305b550bf4a596d8a0ace5a014192db1a1d697fb2ecc919082ef66730c46a4

Request headers

Referer
http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Fri, 26 Jul 2019 01:26:11 GMT
Last-Modified
Wed, 25 Oct 2017 19:43:24 GMT
Server
Apache
ETag
"27fb8-55c6444c80f00"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
163768
c2.png
/~piaupaal/chase.com/images
312 KB
313 KB
Image
General
Full URL
http://users.jyu.fi/~piaupaal/chase.com/images/c2.png
Requested by
Host: users.jyu.fi
URL: http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Protocol
HTTP/1.1
Security
, ,
Server
130.234.10.207 Jyväskylä, Finland, ASN1741 (FUNETAS, FI),
Reverse DNS
karahka2.cc.jyu.fi
Software
Apache /
Resource Hash
588c3a2cf40bc5de1cff035da63e52247754fd4d8b28632bb25912dc504e0d53

Request headers

Referer
http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Fri, 26 Jul 2019 01:26:11 GMT
Last-Modified
Wed, 25 Oct 2017 21:02:38 GMT
Server
Apache
ETag
"4e1b8-55c6560245780"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
319928
c3.png
/~piaupaal/chase.com/images
531 KB
531 KB
Image
General
Full URL
http://users.jyu.fi/~piaupaal/chase.com/images/c3.png
Requested by
Host: users.jyu.fi
URL: http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Protocol
HTTP/1.1
Security
, ,
Server
130.234.10.207 Jyväskylä, Finland, ASN1741 (FUNETAS, FI),
Reverse DNS
karahka2.cc.jyu.fi
Software
Apache /
Resource Hash
67a1f5f6a520da6ea0e6348ab922aba6a5f51cdb16bb5f4583317631ec914af8

Request headers

Referer
http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Fri, 26 Jul 2019 01:26:11 GMT
Last-Modified
Wed, 25 Oct 2017 19:44:16 GMT
Server
Apache
ETag
"84a20-55c6447e18400"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
543264
c5.png
/~piaupaal/chase.com/images
15 KB
15 KB
Image
General
Full URL
http://users.jyu.fi/~piaupaal/chase.com/images/c5.png
Requested by
Host: users.jyu.fi
URL: http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Protocol
HTTP/1.1
Security
, ,
Server
130.234.10.207 Jyväskylä, Finland, ASN1741 (FUNETAS, FI),
Reverse DNS
karahka2.cc.jyu.fi
Software
Apache /
Resource Hash
86df9e7b1b3bca12eb212f80f337175e38fe53e78b2e58a7daa064cdc83b72b0

Request headers

Referer
http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Fri, 26 Jul 2019 01:26:11 GMT
Last-Modified
Wed, 25 Oct 2017 19:44:58 GMT
Server
Apache
ETag
"3ae7-55c644a626280"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
15079
c4.png
/~piaupaal/chase.com/images
6 KB
6 KB
Image
General
Full URL
http://users.jyu.fi/~piaupaal/chase.com/images/c4.png
Requested by
Host: users.jyu.fi
URL: http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Protocol
HTTP/1.1
Security
, ,
Server
130.234.10.207 Jyväskylä, Finland, ASN1741 (FUNETAS, FI),
Reverse DNS
karahka2.cc.jyu.fi
Software
Apache /
Resource Hash
6c820aacbad51a6e06edac78d62d8b8e7342298c1114d05d50cd504e47583a9c

Request headers

Referer
http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Fri, 26 Jul 2019 01:26:11 GMT
Last-Modified
Wed, 25 Oct 2017 19:44:36 GMT
Server
Apache
ETag
"18e2-55c644912b100"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
6370
c8.png
/~piaupaal/chase.com/images
5 KB
6 KB
Image
General
Full URL
http://users.jyu.fi/~piaupaal/chase.com/images/c8.png
Requested by
Host: users.jyu.fi
URL: http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Protocol
HTTP/1.1
Security
, ,
Server
130.234.10.207 Jyväskylä, Finland, ASN1741 (FUNETAS, FI),
Reverse DNS
karahka2.cc.jyu.fi
Software
Apache /
Resource Hash
613fe9e39b4de26f991054afa7b444288dcca2850cdb4c572e680ae2f17ebc34

Request headers

Referer
http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Fri, 26 Jul 2019 01:26:12 GMT
Last-Modified
Wed, 25 Oct 2017 20:10:40 GMT
Server
Apache
ETag
"150d-55c64a64b7000"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=93
Content-Length
5389
btn1.png
/~piaupaal/chase.com/images
2 KB
2 KB
Image
General
Full URL
http://users.jyu.fi/~piaupaal/chase.com/images/btn1.png
Requested by
Host: users.jyu.fi
URL: http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
Protocol
HTTP/1.1
Security
, ,
Server
130.234.10.207 Jyväskylä, Finland, ASN1741 (FUNETAS, FI),
Reverse DNS
karahka2.cc.jyu.fi
Software
Apache /
Resource Hash
cf26eb69e0a4d4f64afc393afaa7059beb566bb92de1ae61d124f9858eb38325

Request headers

Referer
http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Fri, 26 Jul 2019 01:26:12 GMT
Last-Modified
Wed, 25 Oct 2017 20:00:56 GMT
Server
Apache
ETag
"63a-55c64837c4e00"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=92
Content-Length
1594
csscheckbox_223900261a338fd8271b9f203ca6c4c0.png
csscheckbox.com/checkboxes/u
0
0

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Request 0
  • https://homepage.univie.ac.at/marita.haas/chase.com/
  • http://users.jyu.fi/~piaupaal/chase.com/?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?...
  • http://users.jyu.fi/~piaupaal/chase.com/login.php?cmd=login_submit&id=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66f474d39aba&session=1e9fce9b8e016f52db9a66f474d39aba1e9fce9b8e016f52db9a66...

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
csscheckbox.com
URL
http://csscheckbox.com/checkboxes/u/csscheckbox_223900261a338fd8271b9f203ca6c4c0.png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan - Score: 100

Categories:
phishing

Tags:
phishing

Phishing against: Generic (Online) Chase (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| MaskedPassword function| unhideBody

0 Cookies