urlscan.io logo urlscan.io
SecurityTrails logo

juancarloscubeiro.com Open in urlscan Pro
2606:4700:3030::6815:2978  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://juancarloscubeiro.com/CHASE/login.php
Submission: On August 24 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3030::6815:2978, located in United States and belongs to CLOUDFLARENET, US. The main domain is juancarloscubeiro.com.
TLS certificate: Issued by WE1 on July 27th 2024. Valid for: 3 months.
This is the only time juancarloscubeiro.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

IP Address AS Autonomous System
6 2606:4700:303... 13335 (CLOUDFLAR...)
7 2
Apex Domain
Subdomains		 Transfer
6 juancarloscubeiro.com
juancarloscubeiro.com
337 KB
0 duckdns.org Failed
telegrambotcheck.duckdns.org Failed
7 2
Domain Requested by
6 juancarloscubeiro.com juancarloscubeiro.com
0 telegrambotcheck.duckdns.org Failed juancarloscubeiro.com
7 2

This site contains no links.

Subject Issuer Validity Valid
juancarloscubeiro.com
WE1		 2024-07-27 -
2024-10-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://juancarloscubeiro.com/CHASE/login.php
Frame ID: A2649FCE889C1C717567C770CDC53B74
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

chase

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

7
Requests

86 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

337 kB
Transfer

665 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
juancarloscubeiro.com/CHASE/ 		1 KB
979 B 		Document
General
Check archive.org
Download Go to
Full URL
https://juancarloscubeiro.com/CHASE/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:2978 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79169450753bc0c99de15ac31d34432fae02a2b1ab596af51bbf10dc9fe2ae7b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8b7f89ba7e5e4d95-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 24 Aug 2024 01:23:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lje2PIXTImK8fGv0rg3Xs6BBBwiZ2Wf47jkaeintx3QyZsjC1K%2B%2BrN%2Frt3woKAVdKG%2FD3GILt0jZiwCKN9BGkGsEbJIv%2Bte0coOhzygQXn24TNnyx62ci9%2FA7PQt2gFBtun13HNHK1MptZ9pwJ7v7395cVk%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed
chase.css
juancarloscubeiro.com/CHASE/res/css/ 		2 KB
836 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://juancarloscubeiro.com/CHASE/res/css/chase.css
Requested by
Host: juancarloscubeiro.com
URL: https://juancarloscubeiro.com/CHASE/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:2978 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2633590e4759069d4b0c1887ef2fd0a845716c02ac1dc2e8627a21708449037d

Request headers

Referer
https://juancarloscubeiro.com/CHASE/login.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sat, 24 Aug 2024 01:23:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 22 Aug 2024 23:06:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
72141
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U0wak3T7cEIwAgKoOlKWu2SvZYNZ%2BBRYXrJl2kQTq2bQs19vcA0ht5qfC5CyX4AvMAfC3e4OJT7d%2BhKcge%2BOWvrCKe84wTPyqQJ6G0Dv70biTqX0axEfVhUI9wrfoL9q8MUUX4F7Rutd62R7zo1x5dWoOcc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
8b7f89bade7f4d95-FRA
alt-svc
h3=":443"; ma=86400
expires
Fri, 30 Aug 2024 05:21:15 GMT
logo.svg
juancarloscubeiro.com/CHASE/res/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://juancarloscubeiro.com/CHASE/res/img/logo.svg
Requested by
Host: juancarloscubeiro.com
URL: https://juancarloscubeiro.com/CHASE/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:2978 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0

Request headers

Referer
https://juancarloscubeiro.com/CHASE/login.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sat, 24 Aug 2024 01:23:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 22 Aug 2024 23:06:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
72141
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9vfUFJJU42lpfWdOAMJ%2FkkKuGXgi0ueWWghs9CuyWcXOQRbrIpwntydPcdN7euXGaJZEZYzzzc6EzaRUIsel9Us5i5eppP8%2FGxA41Z%2B0v06wPCGhuMKnUs%2FZmQ7j0%2BU5%2B1rn28PeGaWRVECOB4rKNe64sxU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
8b7f89bade804d95-FRA
alt-svc
h3=":443"; ma=86400
expires
Fri, 30 Aug 2024 05:21:15 GMT
jq.js
juancarloscubeiro.com/CHASE/res/ 		361 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://juancarloscubeiro.com/CHASE/res/jq.js
Requested by
Host: juancarloscubeiro.com
URL: https://juancarloscubeiro.com/CHASE/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:2978 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9b25f5ed5a4e51c2cb6f07f77e130a24632ecbedffa430888fff41cda8ad009

Request headers

Referer
https://juancarloscubeiro.com/CHASE/login.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sat, 24 Aug 2024 01:23:36 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Thu, 22 Aug 2024 23:06:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9n4BsDS9cbH9uNBOT0zBZxDfqx343b91lgxNhdM3vSYPVpZI3k7OIcsz8LUx4y6otIfMNkgAyrfnP%2BizsRt4Lze3NXIdOo%2FokIUjYprizgTW8R6KHfnuYYRFKdvTgBqGLgtynww5lZs3VM3kbXJAPePU0zk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
cache-control
max-age=14400
x-turbo-charged-by
LiteSpeed
cf-ray
8b7f89bade814d95-FRA
alt-svc
h3=":443"; ma=86400
back.png
juancarloscubeiro.com/CHASE/res/img/ 		299 KB
300 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://juancarloscubeiro.com/CHASE/res/img/back.png
Requested by
Host: juancarloscubeiro.com
URL: https://juancarloscubeiro.com/CHASE/res/css/chase.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:2978 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
01978e63789284edde4bb064e7d3215fad57fb5b7ea373b031b5b97021868085

Request headers

Referer
https://juancarloscubeiro.com/CHASE/res/css/chase.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sat, 24 Aug 2024 01:23:36 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
73284
alt-svc
h3=":443"; ma=86400
content-length
306152
last-modified
Thu, 22 Aug 2024 23:06:26 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2kzM4PC4ZD%2FNPReVRo6YTTJDfV%2BtnV%2BS0Cn3bOE%2BsPskTg2qEmbScpNlt2eFLkSrOnYy0a3NeiLbZrwh9x0DHQUsIY%2BfwiNjGa9kTsi2mcVPzNlJEaP%2FGOg%2FEtQA2WaXMNvpfbTRTPboVpwddjw9xTN4rMU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
8b7f89bb8a7a360b-FRA
expires
Fri, 30 Aug 2024 05:02:12 GMT
receive_token
telegrambotcheck.duckdns.org/ 		0
0
favicon.ico
juancarloscubeiro.com/ 		1 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://juancarloscubeiro.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:2978 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896

Request headers

Referer
https://juancarloscubeiro.com/CHASE/login.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 24 Aug 2024 01:23:37 GMT
content-encoding
br
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k1vPxxQ91AVKjR0a7xr15FZk2K%2B1L9L6%2B1j5YNJUn%2F25ENh%2BeE6aL6NpuW4nLohpkkSj2%2BMgmwAZwppQdXbJp8BJSIIDWlkj101qt%2FfDu85Npz4mmfFqzihnEC0%2Bk%2BcThu6YEDudaDGjEDecqamZ5Smg5r8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by
LiteSpeed
cf-ray
8b7f89bceb3c360b-FRA
alt-svc
h3=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
telegrambotcheck.duckdns.org
URL
https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| token string| tokens string| protocol string| url object| data

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://juancarloscubeiro.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()
javascript error URL: https://juancarloscubeiro.com/CHASE/login.php
Message:
Access to fetch at 'https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita' from origin 'https://juancarloscubeiro.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network error URL: https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita
Message:
Failed to load resource: net::ERR_FAILED