urlscan.io logo urlscan.io
SecurityTrails logo

juancarloscubeiro.com Open in urlscan Pro
172.67.164.193  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://juancarloscubeiro.com/CHASE/login.php
Submission: On August 24 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 172.67.164.193, located in United States and belongs to CLOUDFLARENET, US. The main domain is juancarloscubeiro.com.
TLS certificate: Issued by WE1 on July 27th 2024. Valid for: 3 months.
This is the only time juancarloscubeiro.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

IP Address AS Autonomous System
5 172.67.164.193 13335 (CLOUDFLAR...)
6 2
Apex Domain
Subdomains		 Transfer
5 juancarloscubeiro.com
juancarloscubeiro.com
337 KB
0 duckdns.org Failed
telegrambotcheck.duckdns.org Failed
6 2
Domain Requested by
5 juancarloscubeiro.com juancarloscubeiro.com
0 telegrambotcheck.duckdns.org Failed juancarloscubeiro.com
6 2

This site contains no links.

Subject Issuer Validity Valid
juancarloscubeiro.com
WE1		 2024-07-27 -
2024-10-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://juancarloscubeiro.com/CHASE/login.php
Frame ID: 5147EBBF0E753ACD3F97015ECA574930
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

chase

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

6
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

337 kB
Transfer

664 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
juancarloscubeiro.com/CHASE/ 		1 KB
976 B 		Document
General
Check archive.org
Download Go to
Full URL
https://juancarloscubeiro.com/CHASE/login.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.164.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79169450753bc0c99de15ac31d34432fae02a2b1ab596af51bbf10dc9fe2ae7b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8b812c665b1339eb-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 24 Aug 2024 06:09:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jaAGy8Ir1bmtIpXRStBQ1nudynxbYvWqyFC29mP2cNvTx3OgZPtbL%2Bq18A6du8cu2%2BYx0wFpfNhGqLN1F%2B7ikgvVLZVD0pQdUYa7KKi5VETTMCqt27IQnSbFsCdkJbGrrbx%2Ft48qgMA%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed
chase.css
juancarloscubeiro.com/CHASE/res/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://juancarloscubeiro.com/CHASE/res/css/chase.css
Requested by
Host: juancarloscubeiro.com
URL: https://juancarloscubeiro.com/CHASE/login.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.164.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2633590e4759069d4b0c1887ef2fd0a845716c02ac1dc2e8627a21708449037d

Request headers

Referer
https://juancarloscubeiro.com/CHASE/login.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sat, 24 Aug 2024 06:09:25 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 22 Aug 2024 23:06:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
89362
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hlUbwI3QmCs1LlT2SOeLi3acq4NEIPcDigB5Ie7gS6ZAGZZPrIBppdDBQSJDUIGtL0mYXUDS6rlEt02QdWzxAFRfhFT5yDoDP1lAFVmlsmz9UdZ9ekcf9lZ33bwA2dTuNTKy58asYKc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
8b812c66db7939eb-FRA
alt-svc
h3=":443"; ma=86400
expires
Fri, 30 Aug 2024 05:20:03 GMT
logo.svg
juancarloscubeiro.com/CHASE/res/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://juancarloscubeiro.com/CHASE/res/img/logo.svg
Requested by
Host: juancarloscubeiro.com
URL: https://juancarloscubeiro.com/CHASE/login.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.164.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0

Request headers

Referer
https://juancarloscubeiro.com/CHASE/login.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sat, 24 Aug 2024 06:09:25 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 22 Aug 2024 23:06:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
89362
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=boS28ClZhayAuEeh4%2FcNn4e5GVMHXuT2%2FWdrQwjla%2FfMAB2hZCbOtBPon2KI5%2BAT7Ve1HW6j6Hx%2FgYbYG22vTKX6Rc4PYBB2IYvBghHzVaYEDPn4DzqVYAskCIbkDdiFQVlUIF6rJKs%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
8b812c66db7b39eb-FRA
alt-svc
h3=":443"; ma=86400
expires
Fri, 30 Aug 2024 05:20:03 GMT
jq.js
juancarloscubeiro.com/CHASE/res/ 		361 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://juancarloscubeiro.com/CHASE/res/jq.js
Requested by
Host: juancarloscubeiro.com
URL: https://juancarloscubeiro.com/CHASE/login.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.164.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9b25f5ed5a4e51c2cb6f07f77e130a24632ecbedffa430888fff41cda8ad009

Request headers

Referer
https://juancarloscubeiro.com/CHASE/login.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sat, 24 Aug 2024 06:09:25 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Thu, 22 Aug 2024 23:06:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OS1aKe%2BYRTgGI%2FT%2FFAcKN2qufcKwj3mFhyqYmhVYIk%2FCM1xNOMGOPnX9wsPQXFSR1gy%2BG3CkHOfmBI0qiA0%2BR8nViczDsNr4lKR%2Ff5HgI1uHaBe28aQueWB2eRe1ihbNfwJV4KCf2%2FU%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
cache-control
max-age=14400
x-turbo-charged-by
LiteSpeed
cf-ray
8b812c66db7d39eb-FRA
alt-svc
h3=":443"; ma=86400
back.png
juancarloscubeiro.com/CHASE/res/img/ 		299 KB
300 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://juancarloscubeiro.com/CHASE/res/img/back.png
Requested by
Host: juancarloscubeiro.com
URL: https://juancarloscubeiro.com/CHASE/res/css/chase.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.164.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
01978e63789284edde4bb064e7d3215fad57fb5b7ea373b031b5b97021868085

Request headers

Referer
https://juancarloscubeiro.com/CHASE/res/css/chase.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sat, 24 Aug 2024 06:09:25 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
89362
alt-svc
h3=":443"; ma=86400
content-length
306152
last-modified
Thu, 22 Aug 2024 23:06:26 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sVpyHklGt6jTsnHO%2F7Y2jUtJVPyqpgNfEKSCIIuCJgGsax2Mnrrp2%2FazQ5xpUzwEicHyyPiKgCDB7ZB5PPmxRAOQA6fAYdeVNIAFlLC%2FOlcPgmuRWvnPKiZctlUh%2BWct14CRXal%2BZZU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
8b812c676bfc39eb-FRA
expires
Fri, 30 Aug 2024 05:20:03 GMT
receive_token
telegrambotcheck.duckdns.org/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
telegrambotcheck.duckdns.org
URL
https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| token string| tokens string| protocol string| url object| data

0 Cookies

2 Console Messages

Source Level URL
Text
javascript error URL: https://juancarloscubeiro.com/CHASE/login.php
Message:
Access to fetch at 'https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita' from origin 'https://juancarloscubeiro.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network error URL: https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita
Message:
Failed to load resource: net::ERR_FAILED