![](/screenshots/37e0b127-7805-4a84-92b0-3edd6077dd2e.png)
pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev
Open in
urlscan Pro
104.18.2.35
Malicious Activity!
Public Scan
Effective URL: https://pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev/mimusaa.html
Submission: On June 12 via manual from IN — Scanned from GB
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USAA (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 93.184.221.165 93.184.221.165 | 15133 (EDGECAST) (EDGECAST) | |
1 | 50.6.138.29 50.6.138.29 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | 104.18.2.35 104.18.2.35 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | () () | ||
15 | 172.66.44.203 172.66.44.203 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 172.66.47.53 172.66.47.53 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
38 | 10 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 50-6-138-29.unifiedlayer.com
naisport.com.mx |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
pages.dev
1 redirects
sdsfsfsfs.pages.dev |
437 KB |
2 |
evrpingnjk.com
evrpingnjk.com |
114 KB |
2 |
r2.dev
pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev |
880 B |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 265 |
5 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 3086 |
30 KB |
1 |
naisport.com.mx
naisport.com.mx |
286 B |
1 |
t.co
t.co — Cisco Umbrella Rank: 711 |
559 B |
0 |
usaa.com
Failed
content.usaa.com Failed |
|
38 | 8 |
Domain | Requested by | |
---|---|---|
17 | sdsfsfsfs.pages.dev |
1 redirects
pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev
|
2 | evrpingnjk.com |
pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev
|
2 | pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev |
evrpingnjk.com
|
1 | cdnjs.cloudflare.com |
pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev
|
1 | ajax.aspnetcdn.com |
pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev
|
1 | naisport.com.mx |
t.co
|
1 | t.co | |
0 | content.usaa.com Failed |
sdsfsfsfs.pages.dev
|
38 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.usaa.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-05-08 - 2025-05-07 |
a year | crt.sh |
*.naisport.com.mx R3 |
2024-05-26 - 2024-08-24 |
3 months | crt.sh |
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
evrpingnjk.com GTS CA 1P5 |
2024-05-12 - 2024-08-10 |
3 months | crt.sh |
sdsfsfsfs.pages.dev E1 |
2024-05-01 - 2024-07-30 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-06-06 - 2025-06-06 |
a year | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev/mimusaa.html
Frame ID: 7DADB3E4AB66C6C6CA90F73A5BE343AD
Requests: 39 HTTP requests in this frame
Frame:
https://sdsfsfsfs.pages.dev/files/a
Frame ID: 56DB0704AE304A95A80805F912F5719A
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/37e0b127-7805-4a84-92b0-3edd6077dd2e.png)
Page Title
Member Account Login | USAAPage URL History Show full URLs
- https://t.co/jqrlmV2FtA Page URL
- https://naisport.com.mx/wp-includes/pomo/ Page URL
- https://pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev/mimusaa.html Page URL
Detected technologies
Detected patterns
- /wp-(?:content|includes)/
![](/vendor/wappa/icons/React.png)
Detected patterns
- <[^>]+data-react
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: USAA logo. Redirects to USAA home. USAA logo
Search URL Search Domain Scan URL
Title: Join USAA
Search URL Search Domain Scan URL
Title: Register for access
Search URL Search Domain Scan URL
Title: Security Center
Search URL Search Domain Scan URL
Title: Privacy Center
Search URL Search Domain Scan URL
Title: Accessibility at USAA
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/jqrlmV2FtA Page URL
- https://naisport.com.mx/wp-includes/pomo/ Page URL
- https://pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev/mimusaa.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 24- https://sdsfsfsfs.pages.dev/files/a.html HTTP 308
- https://sdsfsfsfs.pages.dev/files/a
38 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
jqrlmV2FtA
t.co/ |
280 B 559 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
naisport.com.mx/wp-includes/pomo/ |
214 B 286 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
mimusaa.html
pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev/ |
571 B 880 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
naisport.com.mx/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.js
evrpingnjk.com/ologun/sec2/ |
284 KB 84 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
basic.js
evrpingnjk.com/ologun/sec2/ |
87 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
e3f2e479-19ff-416e-8097-01beaa8a503a
https://pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev/ |
65 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
tag.js
sdsfsfsfs.pages.dev/files/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
linkid.js
sdsfsfsfs.pages.dev/files/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
analytics.js
sdsfsfsfs.pages.dev/files/ |
49 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ent-unified-logon-web.562afa512e4a38e235af.css
sdsfsfsfs.pages.dev/files/ |
105 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag.js
sdsfsfsfs.pages.dev/files/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ent-unified-logon-web.js
sdsfsfsfs.pages.dev/files/ |
273 B 637 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag.318.js
sdsfsfsfs.pages.dev/files/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag.272.js
sdsfsfsfs.pages.dev/files/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag.233.js
sdsfsfsfs.pages.dev/files/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag.288.js
sdsfsfsfs.pages.dev/files/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag.417.js
sdsfsfsfs.pages.dev/files/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag.327.js
sdsfsfsfs.pages.dev/files/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
react!react-dom.min.js
sdsfsfsfs.pages.dev/files/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ent-unified-logon-web.ec39118119936b90266f.js
sdsfsfsfs.pages.dev/files/ |
925 KB 203 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
MfAjsB
sdsfsfsfs.pages.dev/files/ |
191 KB 192 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
a
sdsfsfsfs.pages.dev/files/ Frame 56DB Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
155 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
9C7F15704715916A9.woff2
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
E83D71A074DF776F4.woff2
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
F68DD4439278D0467.woff2
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
12C383965421BC56F.woff2
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
9ECBC8FFB535D0532.woff2
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
C1B705B7AD8D5B4C6.woff2
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
E83D71A074DF776F4.woff
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
C1B705B7AD8D5B4C6.woff
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
9ECBC8FFB535D0532.woff
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
12C383965421BC56F.woff
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
F68DD4439278D0467.woff
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
9C7F15704715916A9.woff
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- naisport.com.mx
- URL
- https://naisport.com.mx/favicon.ico
- Domain
- pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev
- URL
- https://pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev/favicon.ico
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff2
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff2
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff2
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff2
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff2
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff2
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USAA (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| USAA object| gaplugins function| ga object| webpackJsonp function| $ function| jQuery number| count number| counts object| google_tag_data1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: f1644314-0163-469a-9a81-066b287b122e |
34 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
cdnjs.cloudflare.com
content.usaa.com
evrpingnjk.com
naisport.com.mx
pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev
sdsfsfsfs.pages.dev
t.co
content.usaa.com
naisport.com.mx
pub-e000217f87524b1fa8c2b1c3e6ed9ca3.r2.dev
104.17.24.14
104.18.2.35
152.199.19.160
172.66.44.203
172.66.47.53
188.114.97.3
50.6.138.29
93.184.221.165
12823479e57e579d5eb7af45a060336db24bfb84bf0af53a1099d6ca016973f2
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
672865c24005bc24df02e9d7aeff21ff5cc97288883a69e7d1015c16056b1845
6a9384bc8a102c2a5028d05506f54d1f56ebee75b1642fdf2e053dc8d8bc924d
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
a066b3278280f500e0465bd6db6a46c5c6850f9f67145d12d9fa8e9d6a5bf682
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
c0cf517cb13b4b1130ffc7e32db66276ce15336379e8da348d86fc68323b2f87
ceec846322efec91a63ccd7c7d369661a99347961bc00e4396d528d9b080f31c
ddb4133f601fa817524466b7bad394bb2330decf57c99762ba9c2cbd34e9e0e2
ef0b9dd38994625b89c173b39924691ff6e38fd2dbd1b2f2f178db36a22a5577
f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f
f426675307979177d431528d09aef43dd4979d5c52b64c8310432769c54d12a0