www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia
Open in
urlscan Pro
203.210.102.57
Malicious Activity!
Public Scan
Submission: On November 30 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on November 29th 2023. Valid for: 3 months.
This is the only time www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USAA (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 203.210.102.57 203.210.102.57 | 63956 (INT-5GN-A...) (INT-5GN-AS-AP 5G NETWORK OPERATIONS PTY LTD) | |
1 | 2606:4700:303... 2606:4700:3035::ac43:d099 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
powerstar.asia
www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia |
562 KB |
1 |
none.com
none.com — Cisco Umbrella Rank: 664245 |
|
7 | 2 |
Domain | Requested by | |
---|---|---|
6 | www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia |
www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia
|
1 | none.com |
www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia
|
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
R3 |
2023-11-29 - 2024-02-27 |
3 months | crt.sh |
none.com GTS CA 1P5 |
2023-10-29 - 2024-01-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia/
Frame ID: 8CB6783A6B906C5E58A02B6B9D38CAB7
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia/ |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.png
www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia/img/ |
282 KB 282 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.png
www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia/img/ |
121 KB 121 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5.png
www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia/img/ |
59 KB 59 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7.png
www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia/img/ |
95 KB 95 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logone1.png
www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
none.com/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USAA (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
none.com
www.usaa.com-inet-ent-logoff-logoff-detour-start-detourid-iscadmember.powerstar.asia
203.210.102.57
2606:4700:3035::ac43:d099
0a0fd8cc4912fb7d6c01d2caa433aa1a02aca6919be29e1028a9501036b381db
138836ca4165eb8ca34395b751fac6403c2ecad71b205bcbed9eabcc5b6ea362
41bf0e92e388d81eccf3510c3768126e4d50f3fa8a979b8bc55b5754fd5bb369
90802fadbfc4931db80a9cfbe7c2b4a0c41182bf1f85610331cad4a046ffaaba
bbdb984bc89ea8e04389ecb0706f5951b033292975671fb14e2ffb74eb178305
e31f5a09c87eb85542b4e8b1c7c262c851c28532bd8243720df1940ef6302e37
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855