www.usaasupport.secureagent.eztprintsss.xyz Open in urlscan Pro
159.89.94.135 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.usaasupport.secureagent.eztprintsss.xyz/
Effective URL:
https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f59...
Submission: On June 21 via automatic, source certstream-suspicious (June 21st 2020, 3:35:41 am UTC)

Summary HTTP 9 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 9 HTTP transactions. The main IP is 159.89.94.135, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is www.usaasupport.secureagent.eztprintsss.xyz.
TLS certificate: Issued by usaasupport.secureagent.eztprintsss.xyz on June 21st 2020. Valid for: a year.

This is the only time www.usaasupport.secureagent.eztprintsss.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USAA (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3 6	159.89.94.135 159.89.94.135	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
4	23.37.33.137 23.37.33.137	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	54.76.175.152 54.76.175.152	16509 (AMAZON-02) (AMAZON-02)
9	4

6 159.89.94.135 (North Bergen, United States) 3 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: eztpin.com

www.usaasupport.secureagent.eztprintsss.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.37.33.137 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-33-137.deploy.static.akamaitechnologies.com

s.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.175.152 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-175-152.eu-west-1.compute.amazonaws.com

usaa.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	eztprintsss.xyz 3 redirects www.usaasupport.secureagent.eztprintsss.xyz	71 KB
4	usaa.com s.usaa.com content.usaa.com	5 KB
1	demdex.net usaa.demdex.net
1	bing.com bat.bing.com	282 B
9	4

	Domain	Requested by
6	www.usaasupport.secureagent.eztprintsss.xyz	3 redirects www.usaasupport.secureagent.eztprintsss.xyz
2	content.usaa.com	www.usaasupport.secureagent.eztprintsss.xyz
2	s.usaa.com	www.usaasupport.secureagent.eztprintsss.xyz
1	usaa.demdex.net	www.usaasupport.secureagent.eztprintsss.xyz
1	bat.bing.com	www.usaasupport.secureagent.eztprintsss.xyz
9	5

This site contains links to these domains. Also see Links.

Domain
mobile.usaa.com
communities.usaa.com

Subject Issuer	Validity	Valid
usaasupport.secureagent.eztprintsss.xyz usaasupport.secureagent.eztprintsss.xyz	`2020-06-21` - `2021-06-21`	a year	crt.sh
www.usaa.com DigiCert SHA2 Extended Validation Server CA	`2020-03-05` - `2020-11-07`	8 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh

This page contains 2 frames:

Primary Page: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
Frame ID: F5659ED85E2D125A9C6814FE8DC4A633
Requests: 8 HTTP requests in this frame

Frame: https://usaa.demdex.net/dest5.html?d_nsid=0
Frame ID: 19B2288A92A5D279E569ACFFE906B8C8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.usaasupport.secureagent.eztprintsss.xyz/ HTTP 302
https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8 HTTP 301
https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/ HTTP 302
https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

67 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

76 kB
Transfer

75 kB
Size

1
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://mobile.usaa.com/inet/ent_logon/Logon?isUsaaLogo=true
Title:

Search URL Search Domain Scan URL

URL: https://mobile.usaa.com/inet/ent_mobile_storefront/StoreFrontApp/ListSubProductsPage?key=usaa-mobile-social-networks-main
Title: Social Networks

Search URL Search Domain Scan URL

URL: https://communities.usaa.com/
Title: Member Community

Search URL Search Domain Scan URL

URL: https://mobile.usaa.com/inet/pages/accessibility_at_usaa_main
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://mobile.usaa.com/inet/ent_contactus/CpLevelZeroContactUs?channel=mobileMember&ContactUsPageId=PublicMobileContactUs
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://mobile.usaa.com/inet/pages/mobile_factsheet_main
Title: Legal Information

Search URL Search Domain Scan URL

URL: https://mobile.usaa.com/inet/pages/security_online_information_gathering
Title: About Our Ads

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.usaasupport.secureagent.eztprintsss.xyz/ HTTP 302
https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8 HTTP 301
https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/ HTTP 302
https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set vry.php Show response
www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/
Redirect Chain

https://www.usaasupport.secureagent.eztprintsss.xyz/
https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8
https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/
https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b...

10 KB
10 KB

136ms
136ms

Document
text/html

159.89.94.135
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.94.135 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: eztpin.com
Software: Apache /
Resource Hash: f2cac11ef2acf0200a2385186f67709d38c5f4c566aeacb60f4224be19ffd174

Request headers

Host: www.usaasupport.secureagent.eztprintsss.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 21 Jun 2020 03:35:24 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=c00abcf819d9103e7fb6304c328ffb5e; path=/
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Sun, 21 Jun 2020 03:35:24 GMT
Server: Apache
location: vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK aggregator.css
www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/resources/ 35 KB
35 KB 137ms
136ms Stylesheet
text/css 159.89.94.135
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/resources/aggregator.css?type=-min&embed=true&p_/javascript/ent/thirdparty/yui/yui3_5/cssreset/reset.css&p_/javascript/ent/thirdparty/yui/yui3_5/cssgrids/grids.css&p_/mcontent/static_assets/Includes/mobile-header-footer.css&p_/mcontent/static_assets/Includes/mobile-base.css
Requested by: Host: www.usaasupport.secureagent.eztprintsss.xyz
URL: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.94.135 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: eztpin.com
Software: Apache /
Resource Hash: be5ed543cfe8dc9f99e8029f58c630dc359a5cd42129c09f9de81b3a5b0316cb

Request headers

Referer: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 21 Jun 2020 03:35:24 GMT
Last-Modified: Sun, 21 Jun 2020 03:35:24 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 35749

GET
H/1.1 200
OK tridion_DWT.css
www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/resources/ 25 KB
25 KB 373ms
136ms Stylesheet
text/css 159.89.94.135
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/resources/tridion_DWT.css?cacheid=230580983_p
Requested by: Host: www.usaasupport.secureagent.eztprintsss.xyz
URL: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.94.135 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: eztpin.com
Software: Apache /
Resource Hash: bdacd4ea6456c6088b36aba4fc5a6d78ddc2c7fde95873449baeb22b159582c5

Request headers

Referer: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 21 Jun 2020 03:35:25 GMT
Last-Modified: Sun, 21 Jun 2020 03:35:24 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 25791

GET
H2 200 ec_mobile-min.js Show response
s.usaa.com/javascript/ 1 KB
970 B 228ms
72ms Script
application/x-javascript 23.37.33.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s.usaa.com/javascript/ec_mobile-min.js?cacheid=3006656588_p

Requested by

Host: www.usaasupport.secureagent.eztprintsss.xyz
URL: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.33.137 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-33-137.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

f6dece8b5fe928b415179b723fa27412cb3318d2d7ff8dfcefaabba06c4f77c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 21 Jun 2020 03:35:25 GMT
content-encoding: gzip
last-modified: Wed, 20 May 2020 22:25:54 GMT
server: USAA-Honesty
etag: "59c-5a61be1130080"
vary: Accept-Encoding
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=10889
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-type: application/x-javascript
content-length: 659

GET
H2 204 0
bat.bing.com/action/ 0
282 B 49ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=4046839&Ver=2&mid=9e3cd57d-9db0-a260-42db-b36209c5266f&evt=pageLoad&sid=5856c107-0&lt=7991&pi=-1898162245&lg=en-US&sw=1366&sh=768&sc=24&r=https%3A%2F%2Fmobile.usaa.com%2Finet%2Fent_mobile_storefront%2FStoreFrontApp%2FSubProductDetailPage&tl=Log%20On%20to%20USAA%20Mobile&p=https%3A%2F%2Fmobile.usaa.com%2Finet%2Fent_logon%2FLogon%3Facf%3D1&rn=885497
Requested by: Host: www.usaasupport.secureagent.eztprintsss.xyz
URL: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Sun, 21 Jun 2020 03:35:24 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 71D161B9FB8D40FFB909C62B84A96ABB Ref B: FRAEDGE1512 Ref C: 2020-06-21T03:35:24Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 usaa_mobile_sprite_global.png
content.usaa.com/mcontent/static_assets/Media/ 938 B
1 KB 92ms
70ms Image
image/png 23.37.33.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/usaa_mobile_sprite_global.png?cacheid=3169561541_p

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.33.137 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-33-137.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

995c990d85cd456a0730c3f737446f6c092520c0af833195a3bb2e3c4fc93dc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/resources/aggregator.css?type=-min&embed=true&p_/javascript/ent/thirdparty/yui/yui3_5/cssreset/reset.css&p_/javascript/ent/thirdparty/yui/yui3_5/cssgrids/grids.css&p_/mcontent/static_assets/Includes/mobile-header-footer.css&p_/mcontent/static_assets/Includes/mobile-base.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 21 Jun 2020 03:35:25 GMT
last-modified: Wed, 18 Sep 2013 09:36:45 GMT
server: USAA-Honesty
etag: "3aa-4e6a52cf3a540"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=529495
accept-ranges: bytes
content-type: image/png
content-length: 938

GET
H2 200 usaa_mobile_social_media_icons.png
content.usaa.com/mcontent/static_assets/Media/ 1 KB
2 KB 597ms
586ms Image
image/png 23.37.33.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/usaa_mobile_social_media_icons.png?cacheid=1167003346_p

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.33.137 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-33-137.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

9cfae377d27eb106f0fa560f62903bd0b0975efed398cfbaed79de7676d1b386

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/resources/aggregator.css?type=-min&embed=true&p_/javascript/ent/thirdparty/yui/yui3_5/cssreset/reset.css&p_/javascript/ent/thirdparty/yui/yui3_5/cssgrids/grids.css&p_/mcontent/static_assets/Includes/mobile-header-footer.css&p_/mcontent/static_assets/Includes/mobile-base.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 21 Jun 2020 03:35:25 GMT
last-modified: Fri, 01 Dec 2017 15:19:54 GMT
server: USAA-Honesty
etag: "562-55f48e68f7a80"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=604767
accept-ranges: bytes
content-type: image/png
content-length: 1378

GET
H/1.1 200
OK dest5.html
usaa.demdex.net/ Frame 19B2 0
0 292ms
69ms Document
text/html 54.76.175.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://usaa.demdex.net/dest5.html?d_nsid=0

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.76.175.152 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-76-175-152.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: usaa.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 11 Jun 2020 14:08:13 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: 5514CiXWSSw=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 SpeedDetection-min.js Show response
s.usaa.com/javascript/ent/utilities/ 2 KB
1 KB 70ms
70ms Script
application/x-javascript 23.37.33.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s.usaa.com/javascript/ent/utilities/SpeedDetection-min.js?cacheid=3834205916_p

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.33.137 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-33-137.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

3ac38e393a0b51ae5255624dfc1585cc66a5d191fce44c3a025f3424557c4852

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.usaasupport.secureagent.eztprintsss.xyz/490b97c160a3bc847613eaa8ec9fdaa8/vry.php?USAA=login_submit&id=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f&session=5913ea1e7b491e271d6f1ee36463177f5913ea1e7b491e271d6f1ee36463177f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 21 Jun 2020 03:35:25 GMT
content-encoding: gzip
last-modified: Wed, 20 May 2020 22:28:48 GMT
server: USAA-Honesty
etag: "6f9-5a61beb720800"
vary: Accept-Encoding
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=10926
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-type: application/x-javascript
content-length: 805

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USAA (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| speedDetectionJSLoad object| USAA

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.usaasupport.secureagent.eztprintsss.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: c00abcf819d9103e7fb6304c328ffb5e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bat.bing.com
content.usaa.com
s.usaa.com
usaa.demdex.net
www.usaasupport.secureagent.eztprintsss.xyz
159.89.94.135
23.37.33.137
2620:1ec:c11::200
54.76.175.152
3ac38e393a0b51ae5255624dfc1585cc66a5d191fce44c3a025f3424557c4852
995c990d85cd456a0730c3f737446f6c092520c0af833195a3bb2e3c4fc93dc4
9cfae377d27eb106f0fa560f62903bd0b0975efed398cfbaed79de7676d1b386
bdacd4ea6456c6088b36aba4fc5a6d78ddc2c7fde95873449baeb22b159582c5
be5ed543cfe8dc9f99e8029f58c630dc359a5cd42129c09f9de81b3a5b0316cb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f2cac11ef2acf0200a2385186f67709d38c5f4c566aeacb60f4224be19ffd174
f6dece8b5fe928b415179b723fa27412cb3318d2d7ff8dfcefaabba06c4f77c1

www.usaasupport.secureagent.eztprintsss.xyz Open in urlscan Pro 159.89.94.135 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

67 %HTTPS

25 %IPv6

4 Domains

5 Subdomains

4 IPs

3 Countries

76 kBTransfer

75 kBSize

1 Cookies

7 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

www.usaasupport.secureagent.eztprintsss.xyz Open in urlscan Pro
159.89.94.135 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

67 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

76 kB
Transfer

75 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!