Report - closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753

Report Overview

Submitted URL
closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
IP
72.167.135.168
ASN
#398101 GO-DADDY-COM-LLC
Submitted
2024-04-23 06:49:18
Access
public
Website Title
Sign in - chase.com
Final URL
closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Tags
chase financial phishing
urlquery detections
Phishing - Chase

Detections

urlquery
20
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
closestuilast.sa.com	unknown	unknown	No data	No data	6.0 kB	666 kB	72.167.135.168
ka-f.fontawesome.com	3598	2012-10-18	2019-12-17	2024-04-22	1.5 kB	168 kB	104.21.26.223
kit.fontawesome.com	1868	2012-10-18	2019-12-16	2024-04-22	412 B	30 kB	104.18.40.68

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	kit.fontawesome.com/6222530beb.js	12 kB	2024-01-10	2024-04-23
Pretty URL kit.fontawesome.com/6222530beb.js IP 104.18.40.68 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-01-10 06:11:24 Last Seen2024-04-23 10:40:51 Times Seen42 Hash fc11e03006a6979e7fa5ec483349ddd7 045db54979bce98a6580a90869ddf3e8137347de 0e918ed8c331d9d166df825bde3562deacb090ff4d4d239c54810fc3634b0972 Loading...

	closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753	0 B	2023-03-07	2024-05-03
Pretty URL closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753 IP 72.167.135.168 ASN #398101 GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-03 18:33:18 Times Seen37310589 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	closestuilast.sa.com/chase/Chase/js/jquery.js	96 kB	2023-03-07	2024-04-23
Pretty URL closestuilast.sa.com/chase/Chase/js/jquery.js IP 72.167.135.168 ASN #398101 GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:25:21 Last Seen2024-04-23 10:40:51 Times Seen220 Hash c2b18a7789c0f6b24d967e95d499af9c c2276b80ca147e13222e54a7eb88e13c45668f75 08abdcf2873a8643152b7c731d62affe5341935d2cd5568078ed6cab875ebed1 Loading...

	closestuilast.sa.com/chase/Chase/js/bootstrap.min.js	36 kB	2023-03-07	2024-05-02
Pretty URL closestuilast.sa.com/chase/Chase/js/bootstrap.min.js IP 72.167.135.168 ASN #398101 GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:08 Last Seen2024-05-02 21:24:33 Times Seen7826 Hash 8c237312864d2e4c4f03544cd4f9b195 253711c6d825de55a8360552573be950da180614 d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8 Loading...

HTTP Transactions (14)

URL IP Response Size

closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753

72.167.135.168

6.8 kB

URL
closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
IP
72.167.135.168:0
ASN
#398101 GO-DADDY-COM-LLC

File type
HTML document, ASCII text
Size
6.8 kB (6843 bytes)
Hash
efd5000629ed388e8bda5c85c8cb82c1
5d434eb3a60bd74c9a79f9cf62168b441ccaea6a
d72fc03f9a7f1d9f105070cdc665230e58c34898120eac8684cf613d29f7b9bd

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chase

HTTP Headers

GET /chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753 HTTP/1.1
Host: closestuilast.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:48:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=bc410533e8b79361c94c25d580233a39; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

closestuilast.sa.com/chase/Chase/css/shop-homepage.css

72.167.135.168

833 B

URL
closestuilast.sa.com/chase/Chase/css/shop-homepage.css
IP
72.167.135.168:0
ASN
#398101 GO-DADDY-COM-LLC

File type
ASCII text
Size
833 B (833 bytes)
Hash
0881cba021cc199c9a9bd7206e037d72
98ac1e31c0125c6867b815e6d289d37156eca54e
5dfcd82eae4e1292288a0778b7f82792657268e6d0dadfc64f4b32106d47106a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chase

HTTP Headers

GET /chase/Chase/css/shop-homepage.css HTTP/1.1
Host: closestuilast.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Cookie: PHPSESSID=bc410533e8b79361c94c25d580233a39
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:48:53 GMT
Server: Apache
Last-Modified: Wed, 08 Apr 2015 06:31:44 GMT
Accept-Ranges: bytes
Content-Length: 833
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

closestuilast.sa.com/chase/Chase/css/bootstrap.min.css

72.167.135.168

117 kB

URL
closestuilast.sa.com/chase/Chase/css/bootstrap.min.css
IP
72.167.135.168:0
ASN
#398101 GO-DADDY-COM-LLC

File type
ASCII text, with very long lines (65371)
Size
117 kB (117305 bytes)
Hash
9c4d68b023b560e9693f0fbe30215d4f
1a6498f9ef8b19e994038f6b09f05dc6deb58777
43aace313ae0f9356214b70f498cd0e668ec2189f66992e94279d3ac70ee42f0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chase

HTTP Headers

GET /chase/Chase/css/bootstrap.min.css HTTP/1.1
Host: closestuilast.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Cookie: PHPSESSID=bc410533e8b79361c94c25d580233a39
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:48:53 GMT
Server: Apache
Last-Modified: Fri, 19 Jun 2015 08:05:02 GMT
Accept-Ranges: bytes
Content-Length: 117305
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

closestuilast.sa.com/chase/Chase/css/styles.css

72.167.135.168

200 OK

31 kB

URL GET HTTP/1.1
closestuilast.sa.com/chase/Chase/css/styles.css
IP
72.167.135.168:443
ASN
#398101 GO-DADDY-COM-LLC

Requested by
https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Certificate
IssuerLet's Encrypt
Subjectclosestuilast.sa.com
FingerprintDB:57:FA:5E:78:93:1F:24:CD:5B:4A:99:FB:45:21:49:9A:57:16:E7
ValiditySun, 21 Apr 2024 18:04:36 GMT - Sat, 20 Jul 2024 18:04:35 GMT

File type
ASCII text, with CRLF line terminators
Size
31 kB (30575 bytes)
Hash
29129cce96c6190f95b499010c291e37
4905ce4418dcb210c0733f85926859f9ae87f1dd
5e88a56ae0f31c978dbaa6af531d902cb69caabdf6c2d5145568080641d64349

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chase

HTTP Headers

GET /chase/Chase/css/styles.css HTTP/1.1
Host: closestuilast.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Cookie: PHPSESSID=bc410533e8b79361c94c25d580233a39
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:48:54 GMT
Server: Apache
Last-Modified: Thu, 19 Mar 2020 21:16:20 GMT
Accept-Ranges: bytes
Content-Length: 30575
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

closestuilast.sa.com/chase/Chase/js/bootstrap.min.js

72.167.135.168

36 kB

URL
closestuilast.sa.com/chase/Chase/js/bootstrap.min.js
IP
72.167.135.168:0
ASN
#398101 GO-DADDY-COM-LLC

File type
JavaScript source, ASCII text, with very long lines (32025)
Size
36 kB (35951 bytes)
Hash
8c237312864d2e4c4f03544cd4f9b195
253711c6d825de55a8360552573be950da180614
d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chase

HTTP Headers

GET /chase/Chase/js/bootstrap.min.js HTTP/1.1
Host: closestuilast.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Cookie: PHPSESSID=bc410533e8b79361c94c25d580233a39
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:48:54 GMT
Server: Apache
Last-Modified: Wed, 08 Apr 2015 06:31:44 GMT
Accept-Ranges: bytes
Content-Length: 35951
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/javascript

closestuilast.sa.com/chase/Chase/img/cap.png

72.167.135.168

1.6 kB

URL
closestuilast.sa.com/chase/Chase/img/cap.png
IP
72.167.135.168:0
ASN
#398101 GO-DADDY-COM-LLC

File type
PNG image data, 174 x 26, 8-bit/color RGBA, non-interlaced
Size
1.6 kB (1629 bytes)
Hash
46c51041103753eee58d011f174f0ee3
e9fb16dfded11b7d344b478166e390daecbce836
6147b5d1cf66c9e0ddb5de4b00307fb68df6d0af29f16717ac9f8ddecd902bfa

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chase

HTTP Headers

GET /chase/Chase/img/cap.png HTTP/1.1
Host: closestuilast.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Cookie: PHPSESSID=bc410533e8b79361c94c25d580233a39
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:48:54 GMT
Server: Apache
Last-Modified: Sun, 26 Jan 2020 09:16:28 GMT
Accept-Ranges: bytes
Content-Length: 1629
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2

104.21.26.223

200 OK

78 kB

URL GET HTTP/2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2
IP
104.21.26.223:443
ASN
#13335 CLOUDFLARENET

Requested by
https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Certificate
IssuerGoogle Trust Services LLC
Subjectka-f.fontawesome.com
Fingerprint8D:43:33:42:48:C0:F5:34:71:EC:49:69:9C:62:01:4A:6F:41:11:98
ValidityTue, 05 Mar 2024 09:23:28 GMT - Mon, 03 Jun 2024 09:23:27 GMT

File type
Web Open Font Format (Version 2), TrueType, length 78168, version 331.-31196
Size
78 kB (78168 bytes)
Hash
a9fd1225fb2cd32320e2b931dca01089
44ec5c6a868b4ce62350d9f040ed8e18f7a1d128
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7

HTTP Headers

GET /releases/v5.15.4/webfonts/free-fa-solid-900.woff2 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://closestuilast.sa.com
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 23 Apr 2024 06:48:54 GMT
content-type: font/woff2
content-length: 78168
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:58:24 GMT
etag: "a9fd1225fb2cd32320e2b931dca01089"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
x-cache: Hit from cloudfront
via: 1.1 c9f2a4d2bcd548d1a3cbe1617a22f216.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: AL_a-ZGMveQ8HiY11ZkFk2kC61K7nM6Tgkb3OihWjmEvB2WAgfkT1A==
age: 21758
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FNkPWpwkTKWUMrlgKdlevbfDooDYa0HGho85XTYpyaqHcsQ14pvdJWmyRoliO9wiLv7dISZvdYSkAC11GCw4fNm5ZfrY3OLbGWWwySLy5xXjLth20fo7wziaw%2FM4nCs5C8Gh2sCR5g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 878be91c3dec1c0e-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

closestuilast.sa.com/chase/Chase/img/wordmark-white.svg

72.167.135.168

1.4 kB

URL
closestuilast.sa.com/chase/Chase/img/wordmark-white.svg
IP
72.167.135.168:0
ASN
#398101 GO-DADDY-COM-LLC

File type
SVG Scalable Vector Graphics image
Size
1.4 kB (1409 bytes)
Hash
b55b042f907bc7108f5dca2103a8476b
9fcdcc86bfe1f3c7d4f774775670fbd08fe7556c
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chase

HTTP Headers

GET /chase/Chase/img/wordmark-white.svg HTTP/1.1
Host: closestuilast.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/chase/Chase/css/styles.css
Cookie: PHPSESSID=bc410533e8b79361c94c25d580233a39
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:48:54 GMT
Server: Apache
Last-Modified: Mon, 11 Nov 2019 21:37:38 GMT
Accept-Ranges: bytes
Content-Length: 1409
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/svg+xml

closestuilast.sa.com/chase/Chase/js/jquery.js

72.167.135.168

96 kB

URL
closestuilast.sa.com/chase/Chase/js/jquery.js
IP
72.167.135.168:0
ASN
#398101 GO-DADDY-COM-LLC

File type
JavaScript source, ASCII text, with very long lines (32086)
Size
96 kB (95785 bytes)
Hash
c2b18a7789c0f6b24d967e95d499af9c
c2276b80ca147e13222e54a7eb88e13c45668f75
08abdcf2873a8643152b7c731d62affe5341935d2cd5568078ed6cab875ebed1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chase

HTTP Headers

GET /chase/Chase/js/jquery.js HTTP/1.1
Host: closestuilast.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Cookie: PHPSESSID=bc410533e8b79361c94c25d580233a39
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:48:54 GMT
Server: Apache
Last-Modified: Fri, 19 Jun 2015 08:05:00 GMT
Accept-Ranges: bytes
Content-Length: 95785
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/javascript

kit.fontawesome.com/6222530beb.js

104.18.40.68

29 kB

URL
kit.fontawesome.com/6222530beb.js
IP
104.18.40.68:0
ASN
#13335 CLOUDFLARENET

File type
gzip compressed data, from Unix
Size
29 kB (29230 bytes)
Hash
8c7fbec3b716ba0b8d760470ccb05003
15a47f0e7554f9429ba35181663e06b20b4598e7
67c0fb18352e4fd2909264173d6cebea823095246959023636abe03d2a724f61

HTTP Headers

GET /6222530beb.js HTTP/1.1
Host: kit.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 23 Apr 2024 06:48:53 GMT
content-type: text/javascript
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=60, public, stale-while-revalidate=30
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
x-request-id: F8jCMW2T0MnNdZ0GTJzh
cf-cache-status: REVALIDATED
server: cloudflare
cf-ray: 878be917cde356ca-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

closestuilast.sa.com/chase/Chase/img/background.desktop.day.3.jpeg

72.167.135.168

341 kB

URL
closestuilast.sa.com/chase/Chase/img/background.desktop.day.3.jpeg
IP
72.167.135.168:0
ASN
#398101 GO-DADDY-COM-LLC

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1920x1080, components 3
Size
341 kB (340561 bytes)
Hash
bccae5576719b1cc6074473c917b32b9
158f498b8a1fb9ce60b2bb9e84e3a8b461c96603
55e2f154ffd16e75cafd5d62cf51fff15fccbd83004b42f6e84ef5c401085b9d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chase

HTTP Headers

GET /chase/Chase/img/background.desktop.day.3.jpeg HTTP/1.1
Host: closestuilast.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/chase/Chase/css/styles.css
Cookie: PHPSESSID=bc410533e8b79361c94c25d580233a39
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:48:54 GMT
Server: Apache
Last-Modified: Sun, 14 Mar 2021 12:31:08 GMT
Accept-Ranges: bytes
Content-Length: 340561
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/jpeg

closestuilast.sa.com/chase/Chase/img/chasefavicon.ico

72.167.135.168

32 kB

URL
closestuilast.sa.com/chase/Chase/img/chasefavicon.ico
IP
72.167.135.168:0
ASN
#398101 GO-DADDY-COM-LLC

File type
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Size
32 kB (32038 bytes)
Hash
5744986eb3dc6f2da92157a651889902
5a558b58498fab2aeb742acdab51e0c2fbc78385
625816f80596303e9de8e68695973369faa462b416202825b03899c781464fb9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chase

HTTP Headers

GET /chase/Chase/img/chasefavicon.ico HTTP/1.1
Host: closestuilast.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Cookie: PHPSESSID=bc410533e8b79361c94c25d580233a39
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:48:54 GMT
Server: Apache
Last-Modified: Thu, 14 Sep 2017 23:13:10 GMT
Accept-Ranges: bytes
Content-Length: 32038
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/x-icon

ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=6222530beb

104.21.26.223

200 OK

60 kB

URL GET HTTP/2
ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=6222530beb
IP
104.21.26.223:443
ASN
#13335 CLOUDFLARENET

Requested by
https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Certificate
IssuerGoogle Trust Services LLC
Subjectka-f.fontawesome.com
Fingerprint8D:43:33:42:48:C0:F5:34:71:EC:49:69:9C:62:01:4A:6F:41:11:98
ValidityTue, 05 Mar 2024 09:23:28 GMT - Mon, 03 Jun 2024 09:23:27 GMT

File type
ASCII text, with very long lines (60130)
Size
60 kB (60312 bytes)
Hash
a12ec7ebe75a4d59a5dd6b79e2ba2e16
28f5dcc595ee6d4163481ef64170180502c8629b
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

HTTP Headers

GET /releases/v5.15.4/css/free.min.css?token=6222530beb HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://closestuilast.sa.com/
Origin: https://closestuilast.sa.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 23 Apr 2024 06:48:54 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
etag: W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 454b04b563cd5c3b9a4496e3ea346390.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN53-P2
x-amz-cf-id: 59o4HUGk2MS-Xs2crWcEIGjenHqI-nP8ZBojuAzIZoRkZPBT1Rxytg==
age: 21758
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NJvDzx1n9phdFR7miLFrW11JuWpyIaUWZM62EkFdP0mJKxsl8GSUh0VcaE3KH9mlVoJPC0scPGZpVJmehVDVPkLsprxGzDTUX4QgCEDeEeDbMoGhIe1%2BjnPVQX6Ye82Sx1tBBPgtlg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 878be91b9daa1c0e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=6222530beb

104.21.26.223

200 OK

27 kB

URL GET HTTP/2
ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=6222530beb
IP
104.21.26.223:443
ASN
#13335 CLOUDFLARENET

Requested by
https://closestuilast.sa.com/chase/Chase/bulk/over-1.php?locale=en-US&authID=3531dd2a1d8ca8c43acab25ef971c93c0a0fcc14&start=1713843759&end=512411753
Certificate
IssuerGoogle Trust Services LLC
Subjectka-f.fontawesome.com
Fingerprint8D:43:33:42:48:C0:F5:34:71:EC:49:69:9C:62:01:4A:6F:41:11:98
ValidityTue, 05 Mar 2024 09:23:28 GMT - Mon, 03 Jun 2024 09:23:27 GMT

File type
ASCII text, with very long lines (26500)
Size
27 kB (26682 bytes)
Hash
76f34b71fc9fb641507ff6a822cc07f5
73ed2f8f21cd40fb496e61306acbb5849d4dbff4
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8

HTTP Headers

GET /releases/v5.15.4/css/free-v4-shims.min.css?token=6222530beb HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://closestuilast.sa.com/
Origin: https://closestuilast.sa.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 23 Apr 2024 06:48:54 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
etag: W/"76f34b71fc9fb641507ff6a822cc07f5"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 75d52516d2e9126ccb2b4cf8db62c446.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN53-P2
x-amz-cf-id: 2568Qj8YqqiNwXvM2SquvF-tQWaBJkG9wKPQt-L1WxYlKAjtTgohLA==
age: 21758
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uhw1Hn9lTVsPeVnPQNoDjLa6VHRpOG2v2NMnl1N61JfjYUy7tIB0iPB0n8DC%2Br%2Bv83%2FBNmUBTHy0DtUdKcaAIklGaRL%2FYR%2F6jkBwaHgv%2BnItv2dzprVMRumM9uGDoKUMt%2F9kCQaULw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 878be91b9da71c0e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (14)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type