urlscan.io logo urlscan.io
SecurityTrails logo

customers.su Open in urlscan Pro
190.115.31.22  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://humancheck.su/cbo?iwpjqzukj?iiudqixrb
Effective URL: https://customers.su/clients/65b97265ed2f4/?verification
Submission: On January 30 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 190.115.31.22, located in Belize and belongs to IQWEB, AE. The main domain is customers.su.
TLS certificate: Issued by R3 on January 26th 2024. Valid for: 3 months.
This is the only time customers.su was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

IP Address AS Autonomous System
3 3 186.2.163.165 59692 (IQWEB)
1 13 190.115.31.22 59692 (IQWEB)
12 1
Apex Domain
Subdomains		 Transfer
13 customers.su
customers.su
670 KB
3 humancheck.su
humancheck.su
561 B
12 2
Domain Requested by
13 customers.su 1 redirects customers.su
3 humancheck.su 3 redirects
12 2

This site contains no links.

Subject Issuer Validity Valid
customers.su
R3		 2024-01-26 -
2024-04-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://customers.su/clients/65b97265ed2f4/?verification
Frame ID: 029E5D78DD77C6FEA4648AD799048072
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Secured

Page URL History Show full URLs

  1. http://humancheck.su/cbo?iwpjqzukj?iiudqixrb HTTP 301
    https://humancheck.su/cbo?iwpjqzukj?iiudqixrb HTTP 301
    https://humancheck.su/cbo/?iwpjqzukj?iiudqixrb HTTP 302
    https://customers.su/?pwd=read HTTP 302
    https://customers.su/clients/65b97265ed2f4/?verification Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

670 kB
Transfer

669 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://humancheck.su/cbo?iwpjqzukj?iiudqixrb HTTP 301
    https://humancheck.su/cbo?iwpjqzukj?iiudqixrb HTTP 301
    https://humancheck.su/cbo/?iwpjqzukj?iiudqixrb HTTP 302
    https://customers.su/?pwd=read HTTP 302
    https://customers.su/clients/65b97265ed2f4/?verification Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
customers.su/clients/65b97265ed2f4/
Redirect Chain
  • http://humancheck.su/cbo?iwpjqzukj?iiudqixrb
  • https://humancheck.su/cbo?iwpjqzukj?iiudqixrb
  • https://humancheck.su/cbo/?iwpjqzukj?iiudqixrb
  • https://customers.su/?pwd=read
  • https://customers.su/clients/65b97265ed2f4/?verification
24 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://customers.su/clients/65b97265ed2f4/?verification
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
5945cc2a8676f9080fb634f78a6f5a2a93321bab9dbe693dd6146f54e3616caa
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
no-cache, no-store, must-revalidate
content-security-policy
upgrade-insecure-requests;
content-type
text/html; charset=UTF-8
date
Tue, 30 Jan 2024 22:04:22 GMT
expires
0
pragma
no-cache
server
ddos-guard

Redirect headers

cache-control
no-cache, no-store, must-revalidate
content-length
0
content-security-policy
upgrade-insecure-requests;
content-type
text/html; charset=UTF-8
date
Tue, 30 Jan 2024 22:04:21 GMT
expires
0
location
clients/65b97265ed2f4/?verification#_
pragma
no-cache
server
ddos-guard
base.css
customers.su/ui/css/ 		29 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://customers.su/ui/css/base.css
Requested by
Host: customers.su
URL: https://customers.su/clients/65b97265ed2f4/?verification
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
5877d37730cc123e650c22dc1b1fbe8c28a932ca22b9a3d1c2bf421d5482ddfd
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

accept-language
en-US,en;q=0.9
Referer
https://customers.su/clients/65b97265ed2f4/?verification
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Mon, 29 Jan 2024 21:51:42 GMT
last-modified
Thu, 21 Dec 2023 21:36:50 GMT
server
ddos-guard
age
87160
content-type
text/css
ddg-cache-status
HIT
accept-ranges
bytes
content-length
29992
fonts.css
customers.su/ui/css/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://customers.su/ui/css/fonts.css
Requested by
Host: customers.su
URL: https://customers.su/clients/65b97265ed2f4/?verification
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
eea71a343c9142c3ce363189deac523b66318a3c2be39add1e922fb3a9186b4c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

accept-language
en-US,en;q=0.9
Referer
https://customers.su/clients/65b97265ed2f4/?verification
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Mon, 29 Jan 2024 21:51:42 GMT
last-modified
Sat, 16 Dec 2023 00:41:00 GMT
server
ddos-guard
age
87161
content-type
text/css
ddg-cache-status
HIT
accept-ranges
bytes
content-length
2225
forget.css
customers.su/ui/css/ 		23 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://customers.su/ui/css/forget.css
Requested by
Host: customers.su
URL: https://customers.su/clients/65b97265ed2f4/?verification
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
4260832a0138b5765264ca97102673f3d3263b92015f8eb3b2b7c7d100d969e7
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

accept-language
en-US,en;q=0.9
Referer
https://customers.su/clients/65b97265ed2f4/?verification
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Mon, 29 Jan 2024 21:51:42 GMT
last-modified
Thu, 21 Dec 2023 21:34:02 GMT
server
ddos-guard
age
87161
content-type
text/css
ddg-cache-status
HIT
accept-ranges
bytes
content-length
23625
jquery-3.6.0.min.js
customers.su/ui/js/libs/ 		105 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://customers.su/ui/js/libs/jquery-3.6.0.min.js
Requested by
Host: customers.su
URL: https://customers.su/clients/65b97265ed2f4/?verification
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
59d80a8b0bfbfdbb12a8d3083108973ed05d576821d5615bebbc0289f93c0cf6
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

accept-language
en-US,en;q=0.9
Referer
https://customers.su/clients/65b97265ed2f4/?verification
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Mon, 29 Jan 2024 21:51:42 GMT
last-modified
Sat, 16 Dec 2023 02:47:10 GMT
server
ddos-guard
age
87161
content-type
text/javascript
ddg-cache-status
HIT
accept-ranges
bytes
content-length
107659
jquery.inputmask.min.js
customers.su/ui/js/libs/ 		119 KB
119 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://customers.su/ui/js/libs/jquery.inputmask.min.js
Requested by
Host: customers.su
URL: https://customers.su/clients/65b97265ed2f4/?verification
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
b1c065909eeff23e3114b738f050aaed1059feb59f9c0bdacc18b52245014ea9
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

accept-language
en-US,en;q=0.9
Referer
https://customers.su/clients/65b97265ed2f4/?verification
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Mon, 29 Jan 2024 21:51:42 GMT
last-modified
Sat, 16 Dec 2023 02:47:30 GMT
server
ddos-guard
age
87161
content-type
text/javascript
ddg-cache-status
HIT
accept-ranges
bytes
content-length
121837
sorry.js
customers.su/ui/js/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://customers.su/ui/js/sorry.js
Requested by
Host: customers.su
URL: https://customers.su/clients/65b97265ed2f4/?verification
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
bcb82a8a26c4e2be9045d8ba249cb65ae4fdaa2e99cc141c7fa0b644a136b9ec
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

accept-language
en-US,en;q=0.9
Referer
https://customers.su/clients/65b97265ed2f4/?verification
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Mon, 29 Jan 2024 21:51:42 GMT
last-modified
Sun, 07 Jan 2024 16:04:06 GMT
server
ddos-guard
age
87161
content-type
text/javascript
ddg-cache-status
HIT
accept-ranges
bytes
content-length
1642
ww.svg
customers.su/ui/pics/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://customers.su/ui/pics/ww.svg
Requested by
Host: customers.su
URL: https://customers.su/ui/css/base.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

accept-language
en-US,en;q=0.9
Referer
https://customers.su/ui/css/base.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Mon, 29 Jan 2024 21:51:44 GMT
last-modified
Fri, 15 Dec 2023 23:59:22 GMT
server
ddos-guard
age
87160
content-type
image/svg+xml
ddg-cache-status
HIT
accept-ranges
bytes
content-length
1409
bgdesk.jpeg
customers.su/ui/pics/ 		245 KB
245 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://customers.su/ui/pics/bgdesk.jpeg
Requested by
Host: customers.su
URL: https://customers.su/ui/css/base.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
38e6598d39689b79c8b1d3ee5f56288db872835c66b19abe44056a13e34c8c64
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

accept-language
en-US,en;q=0.9
Referer
https://customers.su/ui/css/base.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Mon, 29 Jan 2024 21:51:44 GMT
last-modified
Fri, 15 Dec 2023 14:01:46 GMT
server
ddos-guard
age
87160
content-type
image/jpeg
ddg-cache-status
HIT
accept-ranges
bytes
content-length
250869
opensans-regular.woff
customers.su/ui/fonts/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://customers.su/ui/fonts/opensans-regular.woff
Requested by
Host: customers.su
URL: https://customers.su/ui/css/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
b8422277fc69c8e6ab51112dbf25048e40425cc497490fee251b56d7ef0ca179
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

Referer
https://customers.su/ui/css/fonts.css
Origin
https://customers.su
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Tue, 30 Jan 2024 16:11:09 GMT
last-modified
Fri, 15 Dec 2023 14:27:50 GMT
server
ddos-guard
age
21195
content-type
font/woff
ddg-cache-status
HIT
accept-ranges
bytes
content-length
24876
opensans-semibold.woff
customers.su/ui/fonts/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://customers.su/ui/fonts/opensans-semibold.woff
Requested by
Host: customers.su
URL: https://customers.su/ui/css/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
d2113460c69de50edc6206a20deec3c2bc2733929f53817f1faca74ab34c33e3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

Referer
https://customers.su/ui/css/fonts.css
Origin
https://customers.su
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Tue, 30 Jan 2024 16:11:09 GMT
last-modified
Fri, 15 Dec 2023 14:38:30 GMT
server
ddos-guard
age
21195
content-type
font/woff
ddg-cache-status
HIT
accept-ranges
bytes
content-length
25108
dcefont.woff
customers.su/ui/fonts/ 		69 KB
69 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://customers.su/ui/fonts/dcefont.woff
Requested by
Host: customers.su
URL: https://customers.su/ui/css/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.31.22 , Belize, ASN59692 (IQWEB, AE),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
6ea71f4189e78297e3d1834c586a10dd39826ed8361cb1268b847cef45e03cb1
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

Referer
https://customers.su/ui/css/fonts.css
Origin
https://customers.su
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
date
Mon, 29 Jan 2024 21:51:43 GMT
last-modified
Fri, 15 Dec 2023 14:27:50 GMT
server
ddos-guard
age
87160
content-type
font/woff
ddg-cache-status
HIT
accept-ranges
bytes
content-length
70296

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| Inputmask function| default

4 Cookies

Domain/Path Name / Value
.humancheck.su/ Name: __ddg1_
Value: 0OEWwYcgljW3cOM54rbx
.customers.su/ Name: __ddg1_
Value: ROcdeYnhi6XTHun03h9q
customers.su/ Name: PHPSESSID
Value: ccb2ebf1d892f50b665a130751cfdbb1
customers.su/ Name: ruser
Value: 65b97265ed2f4__here

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;