secure8b.kx935.net Open in urlscan Pro
65.175.100.30 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://secure8b.kx935.net/
Effective URL:
https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true
Submission: On November 04 via manual (November 4th 2019, 6:40:55 pm UTC) from US

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 65.175.100.30, located in St Louis, United States and belongs to CYBERCON - CYBERCON, INC., US. The main domain is secure8b.kx935.net.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 3rd 2019. Valid for: 3 months.

This is the only time secure8b.kx935.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address	AS Autonomous System
6 19	65.175.100.30 65.175.100.30	7393 (CYBERCON) (CYBERCON - CYBERCON)
2	2.18.234.225 2.18.234.225	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
15	2

19 65.175.100.30 (St Louis, United States) 6 redirects

ASN7393 (CYBERCON - CYBERCON, INC., US)
PTR: server.kx935.com

secure8b.kx935.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.225 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-225.deploy.static.akamaitechnologies.com

static.chasecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	kx935.net 6 redirects secure8b.kx935.net	4 MB
2	chasecdn.com static.chasecdn.com	229 KB
15	2

	Domain	Requested by
19	secure8b.kx935.net	6 redirects secure8b.kx935.net
2	static.chasecdn.com	secure8b.kx935.net
15	2

This site contains no links.

Subject Issuer	Validity	Valid
secure8b.kx935.net Let's Encrypt Authority X3	`2019-11-03` - `2020-02-01`	3 months	crt.sh
static.chasecdn.com Entrust Certification Authority - L1M	`2019-03-13` - `2020-03-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true
Frame ID: 6A5542A6551D8F65745ADD3E55A8C712
Requests: 4 HTTP requests in this frame

Frame: https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource
Frame ID: D0F0AE4CB1D2814F12883C83C73356EF
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://secure8b.kx935.net/ HTTP 301
http://secure8b.kx935.net/web/auth/dashboard HTTP 301
https://secure8b.kx935.net/web/auth/dashboard HTTP 301
https://secure8b.kx935.net/web/auth/dashboard/ HTTP 302
https://secure8b.kx935.net/web/auth/dashboard/login.php?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&sec... HTTP 302
https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&secures... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

4223 kB
Transfer

4220 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://secure8b.kx935.net/ HTTP 301
http://secure8b.kx935.net/web/auth/dashboard HTTP 301
https://secure8b.kx935.net/web/auth/dashboard HTTP 301
https://secure8b.kx935.net/web/auth/dashboard/ HTTP 302
https://secure8b.kx935.net/web/auth/dashboard/login.php?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true HTTP 302
https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource.php HTTP 302
https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login Show response secure8b.kx935.net/web/auth/dashboard/ Redirect Chain https://secure8b.kx935.net/ http://secure8b.kx935.net/web/auth/dashboard https://secure8b.kx935.net/web/auth/dashboard https://secure8b.kx935.net/web/auth/dashboard/ https://secure8b.kx935.net/web/auth/dashboard/login.php?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true	5 KB 6 KB	400ms 168ms	Document text/html	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash `320e3898cb7bfb2ef2a52312cc0104be026c4c4a3fd616f1033345d107606b25` Request headers Host secure8b.kx935.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Accept-Encoding gzip, deflate, br Cookie PHPSESSID=jm8vbvtms004uv6k5a3do6go81 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers Date Mon, 04 Nov 2019 18:40:29 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Connection close Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Mon, 04 Nov 2019 18:40:29 GMT Server Apache Location https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Content-Length 302 Connection close Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	blue-ui.css secure8b.kx935.net/web/auth/dashboard/login_files/	380 KB 380 KB	407ms 167ms	Stylesheet text/css	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/blue-ui.css Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash `f5ae3616ad24484b8acf2571e59cbc3a8c176229156610b09d401aa84bb1df58` Request headers Sec-Fetch-Mode no-cors Referer https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:29 GMT Last-Modified Thu, 05 Sep 2019 14:24:36 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 388938 Content-Type text/css
GET H/1.1	200 OK	dashboard.css secure8b.kx935.net/web/auth/dashboard/login_files/	3 MB 3 MB	414ms 169ms	Stylesheet text/css	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/dashboard.css Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash `906200e3f0feccde1dfa17a2d1b6dcb10fa23a2593b197f5bdc2c94b0b20999f` Request headers Sec-Fetch-Mode no-cors Referer https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:29 GMT Last-Modified Thu, 05 Sep 2019 14:24:36 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 3099661 Content-Type text/css
GET H/1.1	200 OK	saved_resource Show response secure8b.kx935.net/web/auth/dashboard/login_files/ Frame D0F0 Redirect Chain https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource.php https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource	16 KB 16 KB	400ms 169ms	Document text/html	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash `546b0633934cc2bd000c22a1b7412a8d10f3437c44df279882d33707c0a50a8c` Request headers Host secure8b.kx935.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Sec-Fetch-Mode nested-navigate Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site same-origin Referer https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Accept-Encoding gzip, deflate, br Cookie PHPSESSID=jm8vbvtms004uv6k5a3do6go81 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Response headers Date Mon, 04 Nov 2019 18:40:30 GMT Server Apache Connection close Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Mon, 04 Nov 2019 18:40:29 GMT Server Apache Location https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource Content-Length 256 Connection close Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	logon.css secure8b.kx935.net/web/auth/dashboard/login_files/ Frame D0F0	107 KB 108 KB	404ms 171ms	Stylesheet text/css	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/logon.css Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash `65b843b70eb6be1696ede7e831feca9afbe7bdff7a303ee4792185cd343bbe95` Request headers Sec-Fetch-Mode no-cors Referer https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:30 GMT Last-Modified Thu, 05 Sep 2019 14:24:36 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 110007 Content-Type text/css
GET H/1.1	200 OK	blue-ui.css secure8b.kx935.net/web/auth/dashboard/login_files/ Frame D0F0	380 KB 380 KB	404ms 165ms	Stylesheet text/css	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/blue-ui.css Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash `f5ae3616ad24484b8acf2571e59cbc3a8c176229156610b09d401aa84bb1df58` Request headers Sec-Fetch-Mode no-cors Referer https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:30 GMT Last-Modified Thu, 05 Sep 2019 14:24:36 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 388938 Content-Type text/css
GET H2	200	default.jpeg static.chasecdn.com/content/geo-images/images/background.mobile.day.3.jpeg/ Frame D0F0	40 KB 40 KB	153ms 45ms	Image image/jpeg	2.18.234.225 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://static.chasecdn.com/content/geo-images/images/background.mobile.day.3.jpeg/default.jpeg Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.234.225 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-234-225.deploy.static.akamaitechnologies.com Software / Resource Hash `737605730c1ccc17fa7060da7f0e057c09b2c86bb0638c1496c3541e6238931a` Request headers Sec-Fetch-Mode no-cors Referer https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers date Mon, 04 Nov 2019 18:40:38 GMT last-modified Thu, 24 Oct 2019 15:19:55 GMT status 200 content-type image/jpeg access-control-allow-origin * cache-control max-age=2592000,s-maxage=2592000 accept-ranges bytes content-length 40462
GET H/1.1	200 OK	opensans-regular.woff secure8b.kx935.net/web/auth/dashboard/fonts/	24 KB 24 KB	431ms 189ms	Font font/woff	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/fonts/opensans-regular.woff Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash `b8422277fc69c8e6ab51112dbf25048e40425cc497490fee251b56d7ef0ca179` Request headers Sec-Fetch-Mode cors Referer https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Origin https://secure8b.kx935.net User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:31 GMT Last-Modified Thu, 05 Sep 2019 14:26:32 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 24876 Content-Type font/woff
GET H/1.1	404 Not Found	opensans-semibold.woff secure8b.kx935.net/web/auth/dashboard/login_files/fonts/ Frame D0F0	0 0	412ms 174ms	Font text/html	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/fonts/opensans-semibold.woff Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash Request headers Sec-Fetch-Mode cors Referer https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource Origin https://secure8b.kx935.net User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:31 GMT Server Apache Connection close Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	wordmark-white.svg secure8b.kx935.net/web/auth/dashboard/login_files/ Frame D0F0	1 KB 2 KB	433ms 183ms	Image image/svg+xml	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Show image Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/wordmark-white.svg Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash `d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0` Request headers Sec-Fetch-Mode no-cors Referer https://secure8b.kx935.net/web/auth/dashboard/login_files/logon.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:31 GMT Last-Modified Thu, 05 Sep 2019 14:24:36 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 1409 Content-Type image/svg+xml
GET H/1.1	404 Not Found	opensans-regular.woff secure8b.kx935.net/web/auth/dashboard/login_files/fonts/ Frame D0F0	0 0	407ms 165ms	Font text/html	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/fonts/opensans-regular.woff Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash Request headers Sec-Fetch-Mode cors Referer https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource Origin https://secure8b.kx935.net User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:31 GMT Server Apache Connection close Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	dcefont.woff secure8b.kx935.net/web/auth/dashboard/login_files/ Frame D0F0	51 KB 51 KB	425ms 185ms	Font font/woff	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/dcefont.woff Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash `002a5f21378ae680359252b4fb352a3de46ed0f33fec75e311b43eca7c9feddd` Request headers Sec-Fetch-Mode cors Referer https://secure8b.kx935.net/web/auth/dashboard/login_files/blue-ui.css Origin https://secure8b.kx935.net User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:31 GMT Last-Modified Thu, 05 Sep 2019 14:24:36 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 52400 Content-Type font/woff
GET H2	200	default.jpeg static.chasecdn.com/content/geo-images/images/background.desktop.day.3.jpeg/ Frame D0F0	189 KB 189 KB	206ms 206ms	Image image/jpeg	2.18.234.225 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://static.chasecdn.com/content/geo-images/images/background.desktop.day.3.jpeg/default.jpeg Requested by Host: secure8b.kx935.net URL: https://secure8b.kx935.net/web/auth/dashboard/login?&sessionid=f2018187ae9d1f5c2837a113c2537ffa&securessl=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.234.225 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-234-225.deploy.static.akamaitechnologies.com Software / Resource Hash `8ac51f0ff3bd44baf4716e2121637c7d4ccfcfed43a779350ed57e6829721b58` Request headers Sec-Fetch-Mode no-cors Referer https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers date Mon, 04 Nov 2019 18:40:39 GMT last-modified Sat, 02 Nov 2019 16:34:49 GMT status 200 content-type image/jpeg access-control-allow-origin * cache-control max-age=2592000,s-maxage=2592000 accept-ranges bytes content-length 193124
GET H/1.1	404 Not Found	opensans-regular.ttf secure8b.kx935.net/web/auth/dashboard/login_files/fonts/ Frame D0F0	0 0	390ms 158ms	Font text/html	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/fonts/opensans-regular.ttf Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash Request headers Sec-Fetch-Mode cors Referer https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource Origin https://secure8b.kx935.net User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:31 GMT Server Apache Connection close Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	opensans-semibold.ttf secure8b.kx935.net/web/auth/dashboard/login_files/fonts/ Frame D0F0	0 0	414ms 173ms	Font text/html	65.175.100.30 CYBERCON
General Check archive.org Show headers Download Go to Full URL https://secure8b.kx935.net/web/auth/dashboard/login_files/fonts/opensans-semibold.ttf Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 65.175.100.30 St Louis, United States, ASN7393 (CYBERCON - CYBERCON, INC., US), Reverse DNS server.kx935.com Software Apache / Resource Hash Request headers Sec-Fetch-Mode cors Referer https://secure8b.kx935.net/web/auth/dashboard/login_files/saved_resource Origin https://secure8b.kx935.net User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Mon, 04 Nov 2019 18:40:32 GMT Server Apache Connection close Content-Length 315 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			secure8b.kx935.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: jm8vbvtms004uv6k5a3do6go81

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

secure8b.kx935.net
static.chasecdn.com
2.18.234.225
65.175.100.30
002a5f21378ae680359252b4fb352a3de46ed0f33fec75e311b43eca7c9feddd
320e3898cb7bfb2ef2a52312cc0104be026c4c4a3fd616f1033345d107606b25
546b0633934cc2bd000c22a1b7412a8d10f3437c44df279882d33707c0a50a8c
65b843b70eb6be1696ede7e831feca9afbe7bdff7a303ee4792185cd343bbe95
737605730c1ccc17fa7060da7f0e057c09b2c86bb0638c1496c3541e6238931a
8ac51f0ff3bd44baf4716e2121637c7d4ccfcfed43a779350ed57e6829721b58
906200e3f0feccde1dfa17a2d1b6dcb10fa23a2593b197f5bdc2c94b0b20999f
b8422277fc69c8e6ab51112dbf25048e40425cc497490fee251b56d7ef0ca179
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
f5ae3616ad24484b8acf2571e59cbc3a8c176229156610b09d401aa84bb1df58

secure8b.kx935.net Open in urlscan Pro 65.175.100.30 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

4223 kBTransfer

4220 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

secure8b.kx935.net Open in urlscan Pro
65.175.100.30 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

4223 kB
Transfer

4220 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!