![](/screenshots/38443ad0-250f-419a-9c43-6acb8decda97.png)
pub-b2ae6eedd903417898322e42a8277137.r2.dev
Open in
urlscan Pro
2606:4700::6812:223
Malicious Activity!
Public Scan
Effective URL: https://pub-b2ae6eedd903417898322e42a8277137.r2.dev/usaa.html
Submission: On June 11 via api from BY — Scanned from DE
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-b2ae6eedd903417898322e42a8277137.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USAA (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 172.67.199.75 172.67.199.75 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:223 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
1 | () () | ||
4 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
1 | 23.37.55.84 23.37.55.84 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
13 | 9 |
ASN13335 (CLOUDFLARENET, US)
pub-b2ae6eedd903417898322e42a8277137.r2.dev |
ASN16625 (AKAMAI-AS, US)
PTR: a23-37-55-84.deploy.static.akamaitechnologies.com
content.usaa.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
pages.dev
stylesheet-css-us.pages.dev |
7 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 260 |
11 KB |
2 |
r2.dev
pub-b2ae6eedd903417898322e42a8277137.r2.dev |
30 KB |
1 |
usaa.com
content.usaa.com — Cisco Umbrella Rank: 45045 |
2 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 3104 |
30 KB |
1 |
tenor.com
media.tenor.com — Cisco Umbrella Rank: 7739 |
41 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 824 |
30 KB |
1 |
trimmer.to
1 redirects
trimmer.to |
716 B |
13 | 8 |
Domain | Requested by | |
---|---|---|
4 | stylesheet-css-us.pages.dev |
pub-b2ae6eedd903417898322e42a8277137.r2.dev
|
2 | cdnjs.cloudflare.com |
pub-b2ae6eedd903417898322e42a8277137.r2.dev
|
2 | pub-b2ae6eedd903417898322e42a8277137.r2.dev |
pub-b2ae6eedd903417898322e42a8277137.r2.dev
|
1 | content.usaa.com | |
1 | ajax.aspnetcdn.com |
pub-b2ae6eedd903417898322e42a8277137.r2.dev
|
1 | media.tenor.com |
pub-b2ae6eedd903417898322e42a8277137.r2.dev
|
1 | code.jquery.com |
pub-b2ae6eedd903417898322e42a8277137.r2.dev
|
1 | trimmer.to | 1 redirects |
13 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
stylesheet-css-us.pages.dev GTS CA 1P5 |
2024-04-26 - 2024-07-25 |
3 months | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
c.tenor.com WR2 |
2024-05-21 - 2024-08-13 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-06-06 - 2025-06-06 |
a year | crt.sh |
www.usaa.com DigiCert EV RSA CA G2 |
2024-01-09 - 2024-09-18 |
8 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-b2ae6eedd903417898322e42a8277137.r2.dev/usaa.html
Frame ID: 635B63B02B8FC9FA3EC13F6D395C7220
Requests: 13 HTTP requests in this frame
Screenshot
![](/screenshots/38443ad0-250f-419a-9c43-6acb8decda97.png)
Page Title
Member Account Login | USAAPage URL History Show full URLs
-
https://trimmer.to/folwa
HTTP 301
https://pub-b2ae6eedd903417898322e42a8277137.r2.dev/usaa.html Page URL
Detected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://trimmer.to/folwa
HTTP 301
https://pub-b2ae6eedd903417898322e42a8277137.r2.dev/usaa.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
usaa.html
pub-b2ae6eedd903417898322e42a8277137.r2.dev/ Redirect Chain
|
30 KB 30 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
79eb7af3-e0fb-4c7b-911f-b2029a2c8fcb
https://pub-b2ae6eedd903417898322e42a8277137.r2.dev/ |
22 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
pub-b2ae6eedd903417898322e42a8277137.r2.dev/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.css
stylesheet-css-us.pages.dev/ |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.svg
stylesheet-css-us.pages.dev/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
flower.svg
stylesheet-css-us.pages.dev/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.js
stylesheet-css-us.pages.dev/ |
2 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading-gif.gif
media.tenor.com/On7kvXhzml4AAAAi/ |
40 KB 41 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
usaaicon.ico
content.usaa.com/mcontent/static_assets/Media/ |
7 KB 2 KB |
Other
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- pub-b2ae6eedd903417898322e42a8277137.r2.dev
- URL
- https://pub-b2ae6eedd903417898322e42a8277137.r2.dev/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USAA (Banking)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _0x1d44 function| _0x1fe4 function| _0xb0d6a0 function| $ function| jQuery number| count number| counts2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
trimmer.to/ | Name: PHPSESSID Value: qd7ldeo40g0n3atqu3nsp752e5 |
|
trimmer.to/ | Name: short_4772 Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
cdnjs.cloudflare.com
code.jquery.com
content.usaa.com
media.tenor.com
pub-b2ae6eedd903417898322e42a8277137.r2.dev
stylesheet-css-us.pages.dev
trimmer.to
pub-b2ae6eedd903417898322e42a8277137.r2.dev
104.17.25.14
152.199.19.160
172.67.199.75
188.114.97.3
23.37.55.84
2606:4700::6812:223
2a00:1450:4001:82a::200a
2a04:4e42:200::649
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
16a21c8ce9b295166b6020908da783b7399308175f0c2428fcfc20ba66706b85
2afb46bd94e0d1c3d3df1e23bd796dd03e0279f0ad80efdb53c0da7c638fb4a3
4ac23a611f6972750bf5fb2f0f6336e4dee18b4f70871174b6c0a4a2f52a1817
563d0ba5e849acbd5eba4c5a452930f1795cfbc5f92a60a4f0d0426afb5bb3f4
58df4fc27f6f76ef963eef86805776c577201a929aa1b11c53e1cb3cafc7207d
682806dc09a4c65e477ec43b3b00ecfccaa700385d5f10f1f10c80c5a9763a1a
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
b360359ffe7d46d32329b6a454b0540e6d34bd444a6f9ecface6663e1cb98aba
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
f1b3ca7b348de5507fa0dc8fe5960fecca32cdbc2e81d03743ba426f8d3c7aa9