portal.chales-schwab.workers.dev

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3036::ac43:cb1b, located in United States and belongs to CLOUDFLARENET, US. The main domain is portal.chales-schwab.workers.dev.
TLS certificate: Issued by E1 on February 5th 2022. Valid for: 3 months.

This is the only time portal.chales-schwab.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Charles Schwab (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3036::ac43:cb1b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2620:100:6022... 2620:100:6022:15::a27d:420f	19679 (DROPBOX) (DROPBOX)
4	2

1 2606:4700:3036::ac43:cb1b (United States)

ASN13335 (CLOUDFLARENET, US)

portal.chales-schwab.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:100:6022:15::a27d:420f (United States)

ASN19679 (DROPBOX, US)

dl.dropboxusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	dropboxusercontent.com dl.dropboxusercontent.com — Cisco Umbrella Rank: 12351	16 KB
1	workers.dev portal.chales-schwab.workers.dev	3 KB
4	2

	Domain	Requested by
3	dl.dropboxusercontent.com	portal.chales-schwab.workers.dev
1	portal.chales-schwab.workers.dev
4	2

This site contains links to these domains. Also see Links.

Domain
www.schwab.com
www.sipc.org

Subject Issuer	Validity	Valid
*.chales-schwab.workers.dev E1	`2022-02-05` - `2022-05-06`	3 months	crt.sh
dl.dropbox.com DigiCert TLS RSA SHA256 2020 CA1	`2022-02-08` - `2023-03-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://portal.chales-schwab.workers.dev/
Frame ID: 0C439E109F4BD3747C3E4A43B4825041
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Client Data ValidationClient Data Validation

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

19 kB
Transfer

48 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.schwab.com/

Search URL Search Domain Scan URL

URL: https://www.sipc.org/
Title: member SIPC

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
portal.chales-schwab.workers.dev/ 12 KB
3 KB 58ms
35ms Document
text/html 2606:4700:3036::ac43:cb1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://portal.chales-schwab.workers.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:cb1b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98ed57e2bb7521256eb609f00b3e49bc3932e5bbb64c8ae5eaf0c90a07ad9ded

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Fri, 18 Feb 2022 13:11:44 GMT
content-type: text/html;charset=UTF-8
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=toEm%2Fz9eqrNAnTQDueu6KBkIClLCOO32K%2Br66o7s%2FkFRnrnjnwsk5Te8i0CRx6lJf6rW4%2FGQI1S5vG7b1vhUR9TH7wDGkI8t2i%2BEnFaNKqJnIFd37ACqZmoAwuAw8oUC%2BLlKuZFElmatVTLFeoxIdADIiH6z7wcJuiPOcNrwvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 6df780c458b092c9-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 css
dl.dropboxusercontent.com/s/f5g9t1qzyq2p732/ 0
0 498ms
466ms Stylesheet
text/plain 2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL: https://dl.dropboxusercontent.com/s/f5g9t1qzyq2p732/css?dl=0
Requested by: Host: portal.chales-schwab.workers.dev
URL: https://portal.chales-schwab.workers.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://portal.chales-schwab.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H2 200 ClweStyles.css
dl.dropboxusercontent.com/s/6vuedtnui1ptrud/ 28 KB
8 KB 465ms
434ms Stylesheet
text/css 2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/6vuedtnui1ptrud/ClweStyles.css?dl=0

Requested by

Host: portal.chales-schwab.workers.dev
URL: https://portal.chales-schwab.workers.dev/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

55f3745e4593767ecc2bf0fdaacb5106759ce2ebed1e86a434c1a71a4facf98f

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://portal.chales-schwab.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
content-encoding: gzip
x-content-type-options: nosniff
accept-encoding: identity,gzip
x-dropbox-request-id: b1911c4f8e754951baf6f9c76c7e1ca7
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="ClweStyles.css"; filename*=UTF-8''ClweStyles.css
strict-transport-security: max-age=31536000; includeSubDomains; preload
pragma: public
server: envoy
date: Fri, 18 Feb 2022 13:11:44 GMT
x-server-response-time: 254
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

GET
H2 200 schwab-logo.jpg
dl.dropboxusercontent.com/s/1od8fqi5yg40yo4/ 8 KB
8 KB 496ms
465ms Image
image/jpeg 2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/1od8fqi5yg40yo4/schwab-logo.jpg?dl=0

Requested by

Host: portal.chales-schwab.workers.dev
URL: https://portal.chales-schwab.workers.dev/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

7e7af8349b1d174e4bf60e7dce7def90dee997128001df80e0e0accd83ffa4ca

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://portal.chales-schwab.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-content-type-options: nosniff
accept-encoding: identity,gzip
x-dropbox-request-id: 3faf69ad7be444a9b7bf551d32972cb0
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="schwab-logo.jpg"; filename*=UTF-8''schwab-logo.jpg
content-length: 7910
etag: 1638957511517029n
pragma: public
server: envoy
date: Fri, 18 Feb 2022 13:11:44 GMT
x-server-response-time: 186
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Charles Schwab (Financial)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dropboxusercontent.com/	1969-12-31 23:59:59	Name: uc_session Value: 6qupE2nC9ZX2u0Qk8zv4sd1JeKyU4bVXjLwMD4sjB6alc8TfKDRxIWKF1DMM7SJP

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dl.dropboxusercontent.com
portal.chales-schwab.workers.dev
2606:4700:3036::ac43:cb1b
2620:100:6022:15::a27d:420f
55f3745e4593767ecc2bf0fdaacb5106759ce2ebed1e86a434c1a71a4facf98f
7e7af8349b1d174e4bf60e7dce7def90dee997128001df80e0e0accd83ffa4ca
98ed57e2bb7521256eb609f00b3e49bc3932e5bbb64c8ae5eaf0c90a07ad9ded
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

portal.chales-schwab.workers.dev Open in urlscan Pro 2606:4700:3036::ac43:cb1b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

4 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

19 kBTransfer

48 kBSize

1 Cookies

2 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

portal.chales-schwab.workers.dev Open in urlscan Pro
2606:4700:3036::ac43:cb1b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

19 kB
Transfer

48 kB
Size

1
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!