www.auth6780-15.cfd Open in urlscan Pro
217.148.142.15 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.auth6780-15.cfd/
Effective URL:
https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe
Submission: On February 24 via api (February 24th 2024, 10:38:22 am UTC) from US — Scanned from US

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 217.148.142.15, located in New York, United States and belongs to M247, RO. The main domain is www.auth6780-15.cfd.
TLS certificate: Issued by R3 on February 23rd 2024. Valid for: 3 months.

This is the only time www.auth6780-15.cfd was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 8	217.148.142.15 217.148.142.15	9009 (M247) (M247)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
8	3

8 217.148.142.15 (New York, United States) 1 redirects

ASN9009 (M247, RO)

www.auth6780-15.cfd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	auth6780-15.cfd 1 redirects www.auth6780-15.cfd	391 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 729	30 KB
8	2

	Domain	Requested by
8	www.auth6780-15.cfd	1 redirects www.auth6780-15.cfd code.jquery.com
1	code.jquery.com	www.auth6780-15.cfd
8	2

This site contains links to these domains. Also see Links.

Domain
secure07b.chase.com

Subject Issuer	Validity	Valid
chase-authentication.com R3	`2024-02-23` - `2024-05-23`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe
Frame ID: 7A276BCE60A5D31F9037853626D08E1E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in - chase.com

Page URL History Show full URLs

https://www.auth6780-15.cfd/ HTTP 302
https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

13 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

470 kB
Transfer

1278 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://secure07b.chase.com/web/auth/?fromOrigin=https://secure07b.chase.com
Title: Forgot username/password?

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.auth6780-15.cfd/ HTTP 302
https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request JfGZm9l0gR1e6QTe Show response www.auth6780-15.cfd/ch/ Redirect Chain https://www.auth6780-15.cfd/ https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe	25 KB 5 KB	459ms 459ms	Document text/html	217.148.142.15 M247
General Check archive.org Show headers Download Go to Full URL https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.148.142.15 New York, United States, ASN9009 (M247, RO), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash `b201b9d16777307ae00d294d207127f8cc5840fc93538693c18f0e074a5a6f93` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Length 4527 Content-Type text/html; charset=UTF-8 Date Sat, 24 Feb 2024 10:38:16 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache/2.4.29 (Ubuntu) Vary Accept-Encoding Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Sat, 24 Feb 2024 10:38:15 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache/2.4.29 (Ubuntu) location /ch/JfGZm9l0gR1e6QTe
GET H/1.1	200 OK	main.css www.auth6780-15.cfd/assets/ch/	978 KB 245 KB	45ms 43ms	Stylesheet text/css	217.148.142.15 M247
General Check archive.org Show headers Download Go to Full URL https://www.auth6780-15.cfd/assets/ch/main.css?v7 Requested by Host: www.auth6780-15.cfd URL: https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.148.142.15 New York, United States, ASN9009 (M247, RO), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash `94bc650af13ba5839a4e4d69a0b2580531c59948f548826c2ece473268dc0660` Request headers accept-language en-US,en;q=0.9 Referer https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Date Sat, 24 Feb 2024 10:38:17 GMT Content-Encoding gzip Last-Modified Sun, 21 Aug 2022 10:03:04 GMT Server Apache/2.4.29 (Ubuntu) ETag "f4792-5e6bd6fe46600-gzip" Vary Accept-Encoding Transfer-Encoding chunked Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	94ms 30ms	Script application/javascript	2a04:4e42:400::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: www.auth6780-15.cfd URL: https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers Referer https://www.auth6780-15.cfd/ Origin https://www.auth6780-15.cfd accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 10:38:17 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1228716 x-cache HIT, HIT content-length 30875 x-served-by cache-lga21931-LGA, cache-ewr18142-EWR last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1708771097.398673,VS0,VE0 etag W/"28feccc0-15d9d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 7, 53490
GET H/1.1	200 OK	actions.js Show response www.auth6780-15.cfd/assets/js/	778 B 668 B	917ms 33ms	Script application/javascript	217.148.142.15 M247
General Check archive.org Show headers Download Go to Full URL https://www.auth6780-15.cfd/assets/js/actions.js?v=1708771097 Requested by Host: www.auth6780-15.cfd URL: https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.148.142.15 New York, United States, ASN9009 (M247, RO), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash `411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60` Request headers accept-language en-US,en;q=0.9 Referer https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Date Sat, 24 Feb 2024 10:38:18 GMT Content-Encoding gzip Last-Modified Thu, 28 Apr 2022 00:39:38 GMT Server Apache/2.4.29 (Ubuntu) ETag "30a-5ddac2925a680-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 318
GET H/1.1	200 OK	load.gif www.auth6780-15.cfd/assets/ch/	54 KB 54 KB	918ms 33ms	Image image/gif	217.148.142.15 M247
General Check archive.org Show headers Download Go to Show image Full URL https://www.auth6780-15.cfd/assets/ch/load.gif Requested by Host: www.auth6780-15.cfd URL: https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.148.142.15 New York, United States, ASN9009 (M247, RO), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash `2adae40913e18c09f7ff18c7af433bff264cf1280b6753f2f75a6cf176d94860` Request headers accept-language en-US,en;q=0.9 Referer https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Date Sat, 24 Feb 2024 10:38:18 GMT Last-Modified Wed, 20 Jul 2022 17:56:58 GMT Server Apache/2.4.29 (Ubuntu) ETag "d75a-5e44053c4ce80" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 55130
GET H/1.1	200 OK	wordmark-white.png www.auth6780-15.cfd/assets/ch/	16 KB 16 KB	32ms 31ms	Image image/png	217.148.142.15 M247
General Check archive.org Show headers Download Go to Show image Full URL https://www.auth6780-15.cfd/assets/ch/wordmark-white.png Requested by Host: www.auth6780-15.cfd URL: https://www.auth6780-15.cfd/assets/ch/main.css?v7 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.148.142.15 New York, United States, ASN9009 (M247, RO), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash `687c70a834f9207bc4711e57cb7b3d4aac93e38190eac755baabc2fbb8af2979` Request headers accept-language en-US,en;q=0.9 Referer https://www.auth6780-15.cfd/assets/ch/main.css?v7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Date Sat, 24 Feb 2024 10:38:18 GMT Last-Modified Sun, 21 Aug 2022 16:53:18 GMT Server Apache/2.4.29 (Ubuntu) ETag "40b4-5e6c32b003b80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 16564
GET DATA	200 OK	truncated /	24 KB 24 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b8422277fc69c8e6ab51112dbf25048e40425cc497490fee251b56d7ef0ca179` Request headers Referer Origin https://www.auth6780-15.cfd accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	25 KB 25 KB		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d2113460c69de50edc6206a20deec3c2bc2733929f53817f1faca74ab34c33e3` Request headers Referer Origin https://www.auth6780-15.cfd accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type font/woff
GET H/1.1	200 OK	dcefont.woff www.auth6780-15.cfd/assets/ch/	69 KB 69 KB	32ms 32ms	Font application/font-woff	217.148.142.15 M247
General Check archive.org Show headers Download Go to Full URL https://www.auth6780-15.cfd/assets/ch/dcefont.woff Requested by Host: www.auth6780-15.cfd URL: https://www.auth6780-15.cfd/assets/ch/main.css?v7 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.148.142.15 New York, United States, ASN9009 (M247, RO), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash `6ea71f4189e78297e3d1834c586a10dd39826ed8361cb1268b847cef45e03cb1` Request headers Referer https://www.auth6780-15.cfd/assets/ch/main.css?v7 Origin https://www.auth6780-15.cfd accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Date Sat, 24 Feb 2024 10:38:18 GMT Last-Modified Fri, 08 Jul 2022 15:48:08 GMT Server Apache/2.4.29 (Ubuntu) ETag "11298-5e34d20edde00" Content-Type application/font-woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 70296
POST H/1.1	200 OK	action Show response www.auth6780-15.cfd/apis/lr/	25 B 338 B	1321ms 1321ms	XHR text/html	217.148.142.15 M247
General Check archive.org Show headers Download Go to Full URL https://www.auth6780-15.cfd/apis/lr/action Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.0.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.148.142.15 New York, United States, ASN9009 (M247, RO), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash `c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e` Request headers Accept / Referer https://www.auth6780-15.cfd/ch/JfGZm9l0gR1e6QTe X-Requested-With XMLHttpRequest accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Pragma no-cache Date Sat, 24 Feb 2024 10:38:19 GMT Server Apache/2.4.29 (Ubuntu) Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 25 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.auth6780-15.cfd/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6nisnptksat55r6idbhqtdsms2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
www.auth6780-15.cfd
217.148.142.15
2a04:4e42:400::649
2adae40913e18c09f7ff18c7af433bff264cf1280b6753f2f75a6cf176d94860
411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60
687c70a834f9207bc4711e57cb7b3d4aac93e38190eac755baabc2fbb8af2979
6ea71f4189e78297e3d1834c586a10dd39826ed8361cb1268b847cef45e03cb1
94bc650af13ba5839a4e4d69a0b2580531c59948f548826c2ece473268dc0660
b201b9d16777307ae00d294d207127f8cc5840fc93538693c18f0e074a5a6f93
b8422277fc69c8e6ab51112dbf25048e40425cc497490fee251b56d7ef0ca179
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
d2113460c69de50edc6206a20deec3c2bc2733929f53817f1faca74ab34c33e3
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.auth6780-15.cfd Open in urlscan Pro 217.148.142.15 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

13 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

470 kBTransfer

1278 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

www.auth6780-15.cfd Open in urlscan Pro
217.148.142.15 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

13 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

470 kB
Transfer

1278 kB
Size

1
Cookies

8 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!