pub-baeead66d06d448aa1c7dffaded20746.r2.dev
Open in
urlscan Pro
2606:4700::6812:323
Malicious Activity!
Public Scan
Effective URL: https://pub-baeead66d06d448aa1c7dffaded20746.r2.dev/usaa.html
Submission: On July 12 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-baeead66d06d448aa1c7dffaded20746.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USAA (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3030::6815:24cc | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:323 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:600... 2a04:4e42:600::649 | 54113 (FASTLY) (FASTLY) | |
1 | () () | ||
4 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
1 | 184.31.88.123 184.31.88.123 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
13 | 9 |
ASN13335 (CLOUDFLARENET, US)
pub-baeead66d06d448aa1c7dffaded20746.r2.dev |
ASN16625 (AKAMAI-AS, US)
PTR: a184-31-88-123.deploy.static.akamaitechnologies.com
content.usaa.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
pages.dev
stylesheet-css-us.pages.dev |
7 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 240 |
11 KB |
2 |
r2.dev
pub-baeead66d06d448aa1c7dffaded20746.r2.dev |
30 KB |
1 |
usaa.com
content.usaa.com — Cisco Umbrella Rank: 45933 |
2 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2522 |
30 KB |
1 |
tenor.com
media.tenor.com — Cisco Umbrella Rank: 7533 |
41 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 736 |
30 KB |
1 |
trimmer.to
1 redirects
trimmer.to |
733 B |
13 | 8 |
Domain | Requested by | |
---|---|---|
4 | stylesheet-css-us.pages.dev |
pub-baeead66d06d448aa1c7dffaded20746.r2.dev
|
2 | cdnjs.cloudflare.com |
pub-baeead66d06d448aa1c7dffaded20746.r2.dev
|
2 | pub-baeead66d06d448aa1c7dffaded20746.r2.dev |
pub-baeead66d06d448aa1c7dffaded20746.r2.dev
|
1 | content.usaa.com | |
1 | ajax.aspnetcdn.com |
pub-baeead66d06d448aa1c7dffaded20746.r2.dev
|
1 | media.tenor.com |
pub-baeead66d06d448aa1c7dffaded20746.r2.dev
|
1 | code.jquery.com |
pub-baeead66d06d448aa1c7dffaded20746.r2.dev
|
1 | trimmer.to | 1 redirects |
13 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
stylesheet-css-us.pages.dev WE1 |
2024-06-24 - 2024-09-22 |
3 months | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
c.tenor.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-06-06 - 2025-06-06 |
a year | crt.sh |
www.usaa.com DigiCert EV RSA CA G2 |
2024-01-09 - 2024-09-18 |
8 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-baeead66d06d448aa1c7dffaded20746.r2.dev/usaa.html
Frame ID: 7E8213501CF99B89F8F742B9D4B15501
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Member Account Login | USAAPage URL History Show full URLs
-
https://trimmer.to/hYhBK
HTTP 301
https://pub-baeead66d06d448aa1c7dffaded20746.r2.dev/usaa.html Page URL
Detected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://trimmer.to/hYhBK
HTTP 301
https://pub-baeead66d06d448aa1c7dffaded20746.r2.dev/usaa.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
usaa.html
pub-baeead66d06d448aa1c7dffaded20746.r2.dev/ Redirect Chain
|
30 KB 30 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
263c3886-8056-408f-8f72-e2cc6ad233a5
https://pub-baeead66d06d448aa1c7dffaded20746.r2.dev/ |
22 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
pub-baeead66d06d448aa1c7dffaded20746.r2.dev/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.css
stylesheet-css-us.pages.dev/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.svg
stylesheet-css-us.pages.dev/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
flower.svg
stylesheet-css-us.pages.dev/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.js
stylesheet-css-us.pages.dev/ |
2 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading-gif.gif
media.tenor.com/On7kvXhzml4AAAAi/ |
40 KB 41 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
usaaicon.ico
content.usaa.com/mcontent/static_assets/Media/ |
7 KB 2 KB |
Other
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- pub-baeead66d06d448aa1c7dffaded20746.r2.dev
- URL
- https://pub-baeead66d06d448aa1c7dffaded20746.r2.dev/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USAA (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _0x1d44 function| _0x1fe4 function| _0xb0d6a0 function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
trimmer.to/ | Name: PHPSESSID Value: 1afid06g0nok455qh3kv7gm6o4 |
|
trimmer.to/ | Name: short_4954 Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
cdnjs.cloudflare.com
code.jquery.com
content.usaa.com
media.tenor.com
pub-baeead66d06d448aa1c7dffaded20746.r2.dev
stylesheet-css-us.pages.dev
trimmer.to
pub-baeead66d06d448aa1c7dffaded20746.r2.dev
152.199.19.160
184.31.88.123
2606:4700:3030::6815:24cc
2606:4700::6811:180e
2606:4700::6812:323
2a00:1450:4001:81d::200a
2a04:4e42:600::649
2a06:98c1:3120::3
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
16a21c8ce9b295166b6020908da783b7399308175f0c2428fcfc20ba66706b85
2afb46bd94e0d1c3d3df1e23bd796dd03e0279f0ad80efdb53c0da7c638fb4a3
4ac23a611f6972750bf5fb2f0f6336e4dee18b4f70871174b6c0a4a2f52a1817
563d0ba5e849acbd5eba4c5a452930f1795cfbc5f92a60a4f0d0426afb5bb3f4
79094239f86cda6c10cabe654aa0d83d3d404ed682367c46723d9f90334d1ad3
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
b360359ffe7d46d32329b6a454b0540e6d34bd444a6f9ecface6663e1cb98aba
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
ed5f1ca24fc247372dc6e1708ae19f3181ce65d86e82982c9fba99109af14cba
f1b3ca7b348de5507fa0dc8fe5960fecca32cdbc2e81d03743ba426f8d3c7aa9
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e