diaclub.org.ua - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 134.249.132.143, located in Zaporizhzhia, Ukraine and belongs to KSNET-AS, UA. The main domain is diaclub.org.ua.
TLS certificate: Issued by R3 on September 16th 2021. Valid for: 3 months.

This is the only time diaclub.org.ua was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address		AS Autonomous System
5	134.249.132.143 134.249.132.143		15895 (KSNET-AS) (KSNET-AS)
5	1

5 134.249.132.143 (Zaporizhzhia, Ukraine)

ASN15895 (KSNET-AS, UA)
PTR: 134-249-132-143.broadband.kyivstar.net

diaclub.org.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	diaclub.org.ua diaclub.org.ua	1 MB
5	1

	Domain	Requested by
5	diaclub.org.ua	diaclub.org.ua
5	1

This site contains no links.

Subject Issuer	Validity	Valid
diaclub.org.ua R3	`2021-09-16` - `2021-12-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/login.php?cmd=login_submit&id=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960&session=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960
Frame ID: 34DCE321159585FE1F33D7C0E694146E
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Chase Bank - Credit Card, Mortgage, Auto, Banking Services

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1435 kB
Transfer

1435 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/	2 KB 1 KB	166ms 53ms	Document text/html	134.249.132.143 KSNET-AS
General Check archive.org Show headers Download Go to Full URL https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/login.php?cmd=login_submit&id=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960&session=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 134.249.132.143 Zaporizhzhia, Ukraine, ASN15895 (KSNET-AS, UA), Reverse DNS 134-249-132-143.broadband.kyivstar.net Software nginx / Resource Hash `5a11f0c65c1ced18ac0b4575fb9a39751d459929c5021033b30bb25a6c624d7e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server nginx Date Wed, 17 Nov 2021 06:13:39 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Content-Encoding gzip
GET H/1.1	200 OK	head.png diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/images/	196 KB 197 KB	89ms 89ms	Image image/png	134.249.132.143 KSNET-AS
General Check archive.org Show headers Download Go to Show image Full URL https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/images/head.png Requested by Host: diaclub.org.ua URL: https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/login.php?cmd=login_submit&id=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960&session=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 134.249.132.143 Zaporizhzhia, Ukraine, ASN15895 (KSNET-AS, UA), Reverse DNS 134-249-132-143.broadband.kyivstar.net Software nginx / Resource Hash `41215fdf120c651ee4bfdb2eb45e4b5a55b4d1e2037760b74098a0b93bc40917` Request headers Accept-Language de-DE,de;q=0.9 Referer https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/login.php?cmd=login_submit&id=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960&session=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Wed, 17 Nov 2021 06:13:39 GMT Last-Modified Tue, 16 Nov 2021 14:07:23 GMT Server nginx ETag "6193bb1b-311a8" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 201128 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	main.png diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/images/	1 MB 1 MB	184ms 98ms	Image image/png	134.249.132.143 KSNET-AS
General Check archive.org Show headers Download Go to Show image Full URL https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/images/main.png Requested by Host: diaclub.org.ua URL: https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/login.php?cmd=login_submit&id=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960&session=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 134.249.132.143 Zaporizhzhia, Ukraine, ASN15895 (KSNET-AS, UA), Reverse DNS 134-249-132-143.broadband.kyivstar.net Software nginx / Resource Hash `857dc45172d6f248ed5cf0a42ed1ceacf311f18ca21855b6350518d5181b941e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/login.php?cmd=login_submit&id=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960&session=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Wed, 17 Nov 2021 06:13:39 GMT Last-Modified Tue, 16 Nov 2021 14:07:23 GMT Server nginx ETag "6193bb1b-1300ad" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 1245357 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	sign.png diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/images/	4 KB 4 KB	161ms 74ms	Image image/png	134.249.132.143 KSNET-AS
General Check archive.org Show headers Download Go to Show image Full URL https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/images/sign.png Requested by Host: diaclub.org.ua URL: https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/login.php?cmd=login_submit&id=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960&session=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 134.249.132.143 Zaporizhzhia, Ukraine, ASN15895 (KSNET-AS, UA), Reverse DNS 134-249-132-143.broadband.kyivstar.net Software nginx / Resource Hash `aae5b17dafa51e393883d7121ed8a1857e260438becd6b9986ef982ee78ace3c` Request headers Accept-Language de-DE,de;q=0.9 Referer https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/login.php?cmd=login_submit&id=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960&session=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Wed, 17 Nov 2021 06:13:39 GMT Last-Modified Tue, 16 Nov 2021 14:07:23 GMT Server nginx ETag "6193bb1b-f9c" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 3996 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	footer.png diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/images/	16 KB 16 KB	196ms 103ms	Image image/png	134.249.132.143 KSNET-AS
General Check archive.org Show headers Download Go to Show image Full URL https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/images/footer.png Requested by Host: diaclub.org.ua URL: https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/login.php?cmd=login_submit&id=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960&session=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 134.249.132.143 Zaporizhzhia, Ukraine, ASN15895 (KSNET-AS, UA), Reverse DNS 134-249-132-143.broadband.kyivstar.net Software nginx / Resource Hash `9ba83a649324a38b8840f4193ba8f3010f587de68dd67ff8e267eaab26731980` Request headers Accept-Language de-DE,de;q=0.9 Referer https://diaclub.org.ua/wp-includes/widgets/chase.com.axp/online/login.php?cmd=login_submit&id=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960&session=4e553848694c5b1636a5f1b308d1b9604e553848694c5b1636a5f1b308d1b960 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Wed, 17 Nov 2021 06:13:39 GMT Last-Modified Tue, 16 Nov 2021 14:07:23 GMT Server nginx ETag "6193bb1b-3f85" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 16261 Expires Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			diaclub.org.ua/wp-includes/widgets/chase.com.axp/online	1970-01-19 22:46:56	Name: mycounter Value: Checked

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

diaclub.org.ua
134.249.132.143
41215fdf120c651ee4bfdb2eb45e4b5a55b4d1e2037760b74098a0b93bc40917
5a11f0c65c1ced18ac0b4575fb9a39751d459929c5021033b30bb25a6c624d7e
857dc45172d6f248ed5cf0a42ed1ceacf311f18ca21855b6350518d5181b941e
9ba83a649324a38b8840f4193ba8f3010f587de68dd67ff8e267eaab26731980
aae5b17dafa51e393883d7121ed8a1857e260438becd6b9986ef982ee78ace3c

diaclub.org.ua Open in urlscan Pro 134.249.132.143 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

1435 kBTransfer

1435 kBSize

1 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

diaclub.org.ua Open in urlscan Pro
134.249.132.143 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1435 kB
Transfer

1435 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!