s3.us-east-1.amazonaws.com Open in urlscan Pro
52.216.110.93 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
Submission Tags: @ipnigh
Submission: On May 21 via api (May 21st 2020, 12:31:31 am UTC) from GB

Summary HTTP 14 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 52.216.110.93, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is s3.us-east-1.amazonaws.com.
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on November 9th 2019. Valid for: a year.

This is the only time s3.us-east-1.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USAA (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	52.216.110.93 52.216.110.93	16509 (AMAZON-02) (AMAZON-02)
12	104.109.54.95 104.109.54.95	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:1::... 2606:4700:1::6813:8e6f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	3

1 52.216.110.93 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.us-east-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 104.109.54.95 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-54-95.deploy.static.akamaitechnologies.com

s.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:1::6813:8e6f (United States)

ASN13335 (CLOUDFLARENET, US)

i.gyazo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	usaa.com s.usaa.com content.usaa.com	123 KB
1	gyazo.com i.gyazo.com	5 KB
1	amazonaws.com s3.us-east-1.amazonaws.com	32 KB
14	3

	Domain	Requested by
10	content.usaa.com	s3.us-east-1.amazonaws.com
2	s.usaa.com	s3.us-east-1.amazonaws.com
1	i.gyazo.com	s3.us-east-1.amazonaws.com
1	s3.us-east-1.amazonaws.com
14	4

This site contains links to these domains. Also see Links.

Domain
www.usaa.com
trustsealinfo.websecurity.norton.com

Subject Issuer	Validity	Valid
s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2019-11-09` - `2020-12-02`	a year	crt.sh
www.usaa.com DigiCert SHA2 Extended Validation Server CA	`2020-03-05` - `2020-11-07`	8 months	crt.sh
*.gyazo.com RapidSSL RSA CA 2018	`2019-03-27` - `2021-05-08`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
Frame ID: AB06988C9437FC264363F66A04E1CF1E
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers server /^AmazonS3$/i

Amazon S3 (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

headers server /^AmazonS3$/i

Page Statistics

14
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

161 kB
Transfer

209 kB
Size

0
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://www.usaa.com/inet/ent_home/CpHome?action=INIT&wa_ref=pri_auth_nav_home
Title: USAA Home Page

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/ent_community_profile/sso?referer=https://communities.usaa.com/&wa_ref=pri_global_social_bar_footer_member_community&flowState=reset
Title: Share. Connect. Explore. Visit the Member Community.

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/ent_community_profile/sso?referer=https://communities.usaa.com/t5/Ask-USAA/ct-p/ask-usaa&wa_ref=pri_global_socialbar_footer_community_finadvice&flowState=reset
Title: Financial Questions & Answers

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/usaa_mobile_main?wa_ref=global_socialbar_footer_mobile
Title: GO MOBILEapps & more

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/global-community-bar-fb-redirect?wa_ref=global_socialbar_footer_facebook

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/global-community-bar-tw-redirect?wa_ref=global_socialbar_footer_twitter
Title:

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/global-community-bar-yt-redirect?wa_ref=global_socialbar_footer_youtube
Title:

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/usaa_social_main?wa_ref=global_socialbar_footer_more
Title:

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/about_usaa_main?wa_ref=private_subglobal_footer_about_usaa_page
Title: Corporate Info & Media

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/ent_community_profile/sso?flowState=reset&referer=https://communities.usaa.com/t5/News-Center/ct-p/news-center&wa_ref=pri_subglobal_footer_newscenter
Title: News Center

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/security_protect_your_personal_information?wa_ref=pri_subglobal_footer_privacy_promise
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.usaa.com/careers?wa_ref=pub_subglobal_footer_career_center_page
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/accessibility_at_usaa_main?wa_ref=pri_subglobal_footer_accessibility
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/ContactUsOtherServices?wa_ref=private_subglobal_footerUtility_utilityLevelZeroPriReg_CONTACTUS
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/site_map?wa_ref=private_subglobal_footerUtility_utilityLevelZeroPriReg_SITEMAP
Title: Site Map

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/mc_faq/McFAQ?app=CpFaq&FAQPageID=CorpRegistrationFaq&wa_ref=private_subglobal_footerUtility_utilityLevelZeroPriReg_FAQS
Title: FAQs

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/site_terms_and_conditions?wa_ref=private_subglobal_footerUtility_utilityLevelZeroPriReg_TERMCONDITIONS
Title: Site Terms

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/ent_home/CpHome?action=INIT&initCobrowse=https://www.usaa.com/inet/ent_memberassistance/Cobrowse?action=COBROWSE&isWicket=true&AppId=SecurityQuestionsApplication&PageId=ChangeSecurityQuestionsPage&SubPageId=null
Title: Need help? (Opens pop-up layer)

Search URL Search Domain Scan URL

URL: https://trustsealinfo.websecurity.norton.com/splash?form_file=fdf/splash.fdf&dn=www.usaa.com&lang=en
Title: USAA.com is Norton Secured. View Norton VeriSign Certificate

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/ent_utils/CrossChannelAuthRedirect?currentAppId=SecurityQuestionsApplication&targetChannel=mobileMember&targetLookAndFeel=default
Title: Switch to mobile site

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/security_online_information_gathering
Title: About Our Ads

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request 104-702161589892325575.html Show response
s3.us-east-1.amazonaws.com/thapos/member/documents/70216/ 32 KB
32 KB 796ms
398ms Document
text/html 52.216.110.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.110.93 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7b8fecb7aa8982c0b6a915aed4e8eaa03dc4344edabb10d649220e4b78da334b

Request headers

Host: s3.us-east-1.amazonaws.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-id-2: zjLnp6R35W+7OuX/LUtrMnVx9pbVc0IwtUE0dpUUpZa+fLbRtr3kZDGlXjXvENWjBxVXhnVZw+s=
x-amz-request-id: 29CC4C3BF812C07D
Date: Thu, 21 May 2020 00:30:55 GMT
Last-Modified: Tue, 19 May 2020 12:45:26 GMT
ETag: "d6882a02f5353323562a2670cb4c6b95"
Cache-Control: max-age=259200
Accept-Ranges: bytes
Content-Type: text/html
Content-Length: 32310
Server: AmazonS3

GET
H2 200 aggregator
s.usaa.com/inet/resources/ 63 KB
15 KB 380ms
238ms Stylesheet
text/css 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.usaa.com/inet/resources/aggregator?type=-min&fv=2.0&embed=false&k_3.9.0_reset_css:cacheid=3299152759_p&k_3.9.0_fonts_css:cacheid=3363860946_p&k_3.9.0_grids_css:cacheid=3577736449_p&k_2.0_UsaaHtmlBase_css_2:cacheid=3521151343_p&k_2.0_UsaaCommon_css_2:cacheid=2309985328_p&k_2.0_UsaaLabel_css:cacheid=4191120533_p&k_2.0_UsaaLink_css_2:cacheid=2335800588_p&k_2.0_UsaaButton_css:cacheid=1608907356_p&k_2.0_ClientAutoCompleteBehavior_css:cacheid=889516408_p&k_2.0_HeaderPanel_css_3:cacheid=432367985_p&k_2.0_FootnotesContainer_css:cacheid=3317129168_p&k_2.0_UpperFootnotesContainer_css_1:cacheid=2160867919_p&k_2.0_LowerFootnotesContainer_css_1:cacheid=1384337747_p&k_2.0_CrossChannelPanel_css:cacheid=240016603_p&k_2.0_MemberFeedbackBasePanel_css:cacheid=793462235_p&k_2.0_FooterPanel_css_3:cacheid=1721575049_p&k_2.0_UsaaBase_css_2:cacheid=1673589775_p

Requested by

Host: s3.us-east-1.amazonaws.com
URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

1a8aa34330aca3af3cd6e815312258c80047472ded1fe168b921de3694e06305

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
content-encoding: gzip
last-modified: Tue, 28 Apr 2020 13:48:00 GMT
server: USAA-Honesty
status: 200
vary: Accept-Encoding
content-language: en-US
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
access-control-allow-origin: *
cache-control: max-age=577544
usaa_wts_jvm_agent_uuid: 8f1d9f03-4043-4952-85e8-f6db50b29dd9
strict-transport-security: max-age=31536000
content-type: text/css; charset=UTF-8
content-length: 14131

GET
H2 200 aggregator
s.usaa.com/inet/resources/ 7 KB
3 KB 893ms
752ms Stylesheet
text/css 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.usaa.com/inet/resources/aggregator?type=-min&fv=2.0&embed=false&k_2.0_HeadingLabel_css_2:cacheid=4266044238_p&k_3.9.0_overlay_css:cacheid=4602403_p&k_2.0_ModalPanel_css_2:cacheid=3434356096_p&k_2.0_UsaaFeedbackPanel_css_4:cacheid=3252368427_p&k_2.0_PairedInfoTableBorder_css_3:cacheid=3959059769_p&k_2.0_UsaaHidden_css:cacheid=2460684718_p&k_2.0_UsaaBasePageLayout_css_2:cacheid=800684293_p

Requested by

Host: s3.us-east-1.amazonaws.com
URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

afbd51cd31fe74081f434f2bdf9b74258190c7700667087588645a697bf14531

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
content-encoding: gzip
last-modified: Tue, 28 Apr 2020 13:47:56 GMT
server: USAA-Honesty
status: 200
vary: Accept-Encoding
content-language: en-US
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
access-control-allow-origin: *
cache-control: max-age=604800
usaa_wts_jvm_agent_uuid: a9cc6550-3916-45f3-b1bb-366a1b97ce16
strict-transport-security: max-age=31536000
content-type: text/css; charset=UTF-8
content-length: 2076

GET
H2 200 tlClose.png
content.usaa.com/mcontent/static_assets/Media/ 397 B
678 B 213ms
68ms Image
image/png 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/tlClose.png?cacheid=3841836057_p

Requested by

Host: s3.us-east-1.amazonaws.com
URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

b110bcd83560d6f9960baff7ddaa2a8c4529ac63867f54903211e380b3d835e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
last-modified: Thu, 05 Dec 2013 03:07:32 GMT
server: USAA-Honesty
etag: "18d-4ecc0d4a06500"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=515621
accept-ranges: bytes
content-type: image/png
content-length: 397

GET
H2 200 enterprise-global-navigation-sprite.png
content.usaa.com/mcontent/static_assets/Media/ 26 KB
26 KB 245ms
100ms Image
image/png 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/enterprise-global-navigation-sprite.png?cacheid=1472275610_p

Requested by

Host: s3.us-east-1.amazonaws.com
URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

caae59671a39cd84c4d1072f9ffe35c75c4bdbed3a13aeede9381c51575e43fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
last-modified: Fri, 13 Dec 2013 06:06:55 GMT
server: USAA-Honesty
etag: "687e-4ed6444e1bdc0"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=574774
accept-ranges: bytes
content-type: image/png
content-length: 26750

GET
H2 200 2588d593bbb44bfeab6ff15dc0328eef.png
i.gyazo.com/ 5 KB
5 KB 42ms
23ms Image
image/png 2606:4700:1::6813:8e6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/2588d593bbb44bfeab6ff15dc0328eef.png
Requested by: Host: s3.us-east-1.amazonaws.com
URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700:1::6813:8e6f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fbbc5b0317d644cef4324c9b47bf4f416406cccaa1a7b21122e6229d477b12a7

Request headers

Referer: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:54 GMT
via: 1.1 google
cf-cache-status: HIT
age: 613353
x-gyazo-cfworker: true
status: 200
content-length: 4967
cf-request-id: 02d63cf9f10000c28b0b8e6200000001
server: cloudflare
etag: "2588"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
content-dpr: 1.000000
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 596a31098c36c28b-FRA
expires: Fri, 21 May 2021 00:30:54 GMT

GET
H2 200 SocMedIcon_facebook_v2.png
content.usaa.com/mcontent/static_assets/Media/ 1 KB
2 KB 194ms
129ms Image
image/png 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/SocMedIcon_facebook_v2.png?cacheid=2110766211_p

Requested by

Host: s3.us-east-1.amazonaws.com
URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

e9a681648676dcb7d958f77bed911c7a8a30dabe8ef0265b5ee894205c8aef60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
last-modified: Thu, 23 Jan 2014 15:26:32 GMT
server: USAA-Honesty
etag: "518-4f0a4ddb87a00"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=581501
accept-ranges: bytes
content-type: image/png
content-length: 1304

GET
H2 200 SocMedIcon_twitter_v2.png
content.usaa.com/mcontent/static_assets/Media/ 1 KB
2 KB 158ms
94ms Image
image/png 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/SocMedIcon_twitter_v2.png?cacheid=2393434372_p

Requested by

Host: s3.us-east-1.amazonaws.com
URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

ad5980cb9d5ad82571e49366d26c086e2c2bbe7efe6feb729c12f9594948ba21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
last-modified: Thu, 23 Jan 2014 15:26:38 GMT
server: USAA-Honesty
etag: "587-4f0a4de140780"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=572444
accept-ranges: bytes
content-type: image/png
content-length: 1415

GET
H2 200 SocMedIcon_youtube_v2.png
content.usaa.com/mcontent/static_assets/Media/ 1 KB
2 KB 147ms
83ms Image
image/png 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/SocMedIcon_youtube_v2.png?cacheid=2107969893_p

Requested by

Host: s3.us-east-1.amazonaws.com
URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

d317c2e6324cdd35249a3d5b6370b68d5b018fdddecc1dec0b9660f2affff0bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
last-modified: Thu, 23 Jan 2014 15:26:26 GMT
server: USAA-Honesty
etag: "59a-4f0a4dd5cec80"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=531594
accept-ranges: bytes
content-type: image/png
content-length: 1434

GET
H2 200 SocMedIcon_more.png
content.usaa.com/mcontent/static_assets/Media/ 4 KB
4 KB 141ms
77ms Image
image/png 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/SocMedIcon_more.png?cacheid=1317144102_p

Requested by

Host: s3.us-east-1.amazonaws.com
URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

fda9dc9b1feb432da051add9ca8ccdcdedfe460e5e1be4df5f3d17e0bde69c87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
last-modified: Thu, 23 Jan 2014 22:11:23 GMT
server: USAA-Honesty
etag: "eb5-4f0aa8593b8c0"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=581867
accept-ranges: bytes
content-type: image/png
content-length: 3765

GET
H2 200 usaa-sprite-globalNav_v2.png
content.usaa.com/mcontent/static_assets/Media/ 56 KB
57 KB 68ms
68ms Image
image/png 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/usaa-sprite-globalNav_v2.png?cacheid=2167270257_p

Requested by

Host: s3.us-east-1.amazonaws.com
URL: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

522a5fe0b1921acbaa0925b2a50fa141b0719797d5c552ffc150415c7c44d23b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s3.us-east-1.amazonaws.com/thapos/member/documents/70216/104-702161589892325575.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
last-modified: Fri, 13 Feb 2015 21:43:34 GMT
server: USAA-Honesty
etag: "e14a-50eff20d78d80"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=570535
accept-ranges: bytes
x-usaa-o2p-rtt: 1601
content-type: image/png
content-length: 57674
x-usaa-origin-elapsed-ms: 18

GET
H2 200 background_general_fb.png
content.usaa.com/mcontent/static_assets/Media/ 3 KB
3 KB 129ms
128ms Image
image/png 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/background_general_fb.png?cacheid=2934981489_p

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

e2e04a8e937f5b74a4c50cb7592a8e0bba54b40818d44e43ffd5c40c6b4fe72a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.usaa.com/inet/resources/aggregator?type=-min&fv=2.0&embed=false&k_3.9.0_reset_css:cacheid=3299152759_p&k_3.9.0_fonts_css:cacheid=3363860946_p&k_3.9.0_grids_css:cacheid=3577736449_p&k_2.0_UsaaHtmlBase_css_2:cacheid=3521151343_p&k_2.0_UsaaCommon_css_2:cacheid=2309985328_p&k_2.0_UsaaLabel_css:cacheid=4191120533_p&k_2.0_UsaaLink_css_2:cacheid=2335800588_p&k_2.0_UsaaButton_css:cacheid=1608907356_p&k_2.0_ClientAutoCompleteBehavior_css:cacheid=889516408_p&k_2.0_HeaderPanel_css_3:cacheid=432367985_p&k_2.0_FootnotesContainer_css:cacheid=3317129168_p&k_2.0_UpperFootnotesContainer_css_1:cacheid=2160867919_p&k_2.0_LowerFootnotesContainer_css_1:cacheid=1384337747_p&k_2.0_CrossChannelPanel_css:cacheid=240016603_p&k_2.0_MemberFeedbackBasePanel_css:cacheid=793462235_p&k_2.0_FooterPanel_css_3:cacheid=1721575049_p&k_2.0_UsaaBase_css_2:cacheid=1673589775_p
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
last-modified: Mon, 16 Sep 2013 11:24:14 GMT
server: USAA-Honesty
etag: "b13-4e67e71a8d380"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=558675
accept-ranges: bytes
content-type: image/png
content-length: 2835

GET
H2 200 bgFooter_v2.png
content.usaa.com/mcontent/static_assets/Media/ 496 B
777 B 125ms
125ms Image
image/png 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/bgFooter_v2.png?cacheid=1109381259_p

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

09fe494df49bb50492a87d2670d9839f3f4220f300b146809d36b7e805db52a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.usaa.com/inet/resources/aggregator?type=-min&fv=2.0&embed=false&k_3.9.0_reset_css:cacheid=3299152759_p&k_3.9.0_fonts_css:cacheid=3363860946_p&k_3.9.0_grids_css:cacheid=3577736449_p&k_2.0_UsaaHtmlBase_css_2:cacheid=3521151343_p&k_2.0_UsaaCommon_css_2:cacheid=2309985328_p&k_2.0_UsaaLabel_css:cacheid=4191120533_p&k_2.0_UsaaLink_css_2:cacheid=2335800588_p&k_2.0_UsaaButton_css:cacheid=1608907356_p&k_2.0_ClientAutoCompleteBehavior_css:cacheid=889516408_p&k_2.0_HeaderPanel_css_3:cacheid=432367985_p&k_2.0_FootnotesContainer_css:cacheid=3317129168_p&k_2.0_UpperFootnotesContainer_css_1:cacheid=2160867919_p&k_2.0_LowerFootnotesContainer_css_1:cacheid=1384337747_p&k_2.0_CrossChannelPanel_css:cacheid=240016603_p&k_2.0_MemberFeedbackBasePanel_css:cacheid=793462235_p&k_2.0_FooterPanel_css_3:cacheid=1721575049_p&k_2.0_UsaaBase_css_2:cacheid=1673589775_p
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
last-modified: Wed, 18 Sep 2013 17:36:29 GMT
server: USAA-Honesty
etag: "1f0-4e6abe09ca140"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=587617
accept-ranges: bytes
content-type: image/png
content-length: 496

GET
H2 200 misc_accent_socMedia.png
content.usaa.com/mcontent/static_assets/Media/ 9 KB
9 KB 133ms
133ms Image
image/png 104.109.54.95
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/misc_accent_socMedia.png?cacheid=2092261743_p

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.54.95 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-54-95.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

70cc16695978690e74938cae7f3a5f0de6ee23b1837bddca169316c7001eecd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.usaa.com/inet/resources/aggregator?type=-min&fv=2.0&embed=false&k_3.9.0_reset_css:cacheid=3299152759_p&k_3.9.0_fonts_css:cacheid=3363860946_p&k_3.9.0_grids_css:cacheid=3577736449_p&k_2.0_UsaaHtmlBase_css_2:cacheid=3521151343_p&k_2.0_UsaaCommon_css_2:cacheid=2309985328_p&k_2.0_UsaaLabel_css:cacheid=4191120533_p&k_2.0_UsaaLink_css_2:cacheid=2335800588_p&k_2.0_UsaaButton_css:cacheid=1608907356_p&k_2.0_ClientAutoCompleteBehavior_css:cacheid=889516408_p&k_2.0_HeaderPanel_css_3:cacheid=432367985_p&k_2.0_FootnotesContainer_css:cacheid=3317129168_p&k_2.0_UpperFootnotesContainer_css_1:cacheid=2160867919_p&k_2.0_LowerFootnotesContainer_css_1:cacheid=1384337747_p&k_2.0_CrossChannelPanel_css:cacheid=240016603_p&k_2.0_MemberFeedbackBasePanel_css:cacheid=793462235_p&k_2.0_FooterPanel_css_3:cacheid=1721575049_p&k_2.0_UsaaBase_css_2:cacheid=1673589775_p
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 21 May 2020 00:30:55 GMT
last-modified: Mon, 04 Dec 2017 16:00:17 GMT
server: USAA-Honesty
etag: "224d-55f85d081a640"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=527575
accept-ranges: bytes
content-type: image/png
content-length: 8781

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USAA (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

content.usaa.com
i.gyazo.com
s.usaa.com
s3.us-east-1.amazonaws.com
104.109.54.95
2606:4700:1::6813:8e6f
52.216.110.93
09fe494df49bb50492a87d2670d9839f3f4220f300b146809d36b7e805db52a3
1a8aa34330aca3af3cd6e815312258c80047472ded1fe168b921de3694e06305
522a5fe0b1921acbaa0925b2a50fa141b0719797d5c552ffc150415c7c44d23b
70cc16695978690e74938cae7f3a5f0de6ee23b1837bddca169316c7001eecd7
7b8fecb7aa8982c0b6a915aed4e8eaa03dc4344edabb10d649220e4b78da334b
ad5980cb9d5ad82571e49366d26c086e2c2bbe7efe6feb729c12f9594948ba21
afbd51cd31fe74081f434f2bdf9b74258190c7700667087588645a697bf14531
b110bcd83560d6f9960baff7ddaa2a8c4529ac63867f54903211e380b3d835e8
caae59671a39cd84c4d1072f9ffe35c75c4bdbed3a13aeede9381c51575e43fa
d317c2e6324cdd35249a3d5b6370b68d5b018fdddecc1dec0b9660f2affff0bd
e2e04a8e937f5b74a4c50cb7592a8e0bba54b40818d44e43ffd5c40c6b4fe72a
e9a681648676dcb7d958f77bed911c7a8a30dabe8ef0265b5ee894205c8aef60
fbbc5b0317d644cef4324c9b47bf4f416406cccaa1a7b21122e6229d477b12a7
fda9dc9b1feb432da051add9ca8ccdcdedfe460e5e1be4df5f3d17e0bde69c87

s3.us-east-1.amazonaws.com Open in urlscan Pro 52.216.110.93 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

33 %IPv6

3 Domains

4 Subdomains

3 IPs

2 Countries

161 kBTransfer

209 kBSize

0 Cookies

21 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

s3.us-east-1.amazonaws.com Open in urlscan Pro
52.216.110.93 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

161 kB
Transfer

209 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!