![](/screenshots/88a97b8f-9595-4a23-8d54-fbf5b61eb6e7.png)
pub-b481f848746644b5b9c6834b540a33a7.r2.dev
Open in
urlscan Pro
2606:4700::6812:223
Malicious Activity!
Public Scan
Effective URL: https://pub-b481f848746644b5b9c6834b540a33a7.r2.dev/howaasa.html
Submission: On May 09 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.
This is the only time pub-b481f848746644b5b9c6834b540a33a7.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USAA (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.244.42.133 104.244.42.133 | 13414 (TWITTER) (TWITTER) | |
2 | 108.167.132.144 108.167.132.144 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | 2606:4700::68... 2606:4700::6812:223 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2620:12a:8001::4 2620:12a:8001::4 | 54113 (FASTLY) (FASTLY) | |
1 | () () | ||
13 | 172.66.44.92 172.66.44.92 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 9 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: srv234
clarakislanov.com.br |
ASN13335 (CLOUDFLARENET, US)
pub-b481f848746644b5b9c6834b540a33a7.r2.dev |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
pages.dev
aset-55r.pages.dev |
58 KB |
2 |
pantheonsite.io
dev-wwwmm.pantheonsite.io |
115 KB |
2 |
r2.dev
pub-b481f848746644b5b9c6834b540a33a7.r2.dev |
886 B |
2 |
clarakislanov.com.br
clarakislanov.com.br |
302 B |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237 |
5 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2465 |
30 KB |
1 |
t.co
t.co — Cisco Umbrella Rank: 717 |
574 B |
23 | 7 |
Domain | Requested by | |
---|---|---|
13 | aset-55r.pages.dev |
pub-b481f848746644b5b9c6834b540a33a7.r2.dev
aset-55r.pages.dev |
2 | dev-wwwmm.pantheonsite.io |
pub-b481f848746644b5b9c6834b540a33a7.r2.dev
|
2 | pub-b481f848746644b5b9c6834b540a33a7.r2.dev |
dev-wwwmm.pantheonsite.io
|
2 | clarakislanov.com.br |
t.co
|
1 | cdnjs.cloudflare.com |
pub-b481f848746644b5b9c6834b540a33a7.r2.dev
|
1 | ajax.aspnetcdn.com |
pub-b481f848746644b5b9c6834b540a33a7.r2.dev
|
1 | t.co | |
23 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-01-07 - 2025-01-06 |
a year | crt.sh |
clarakislanov.com.br R3 |
2024-04-02 - 2024-07-01 |
3 months | crt.sh |
*.r2.dev E1 |
2024-04-05 - 2024-07-04 |
3 months | crt.sh |
pantheonsite.io R3 |
2024-04-22 - 2024-07-21 |
3 months | crt.sh |
aset-55r.pages.dev GTS CA 1P5 |
2024-03-27 - 2024-06-25 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-01-30 - 2025-01-30 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-b481f848746644b5b9c6834b540a33a7.r2.dev/howaasa.html
Frame ID: 89462EC322EB7090598EFFA808B9BD6E
Requests: 24 HTTP requests in this frame
Screenshot
![](/screenshots/88a97b8f-9595-4a23-8d54-fbf5b61eb6e7.png)
Page Title
Member Account Login | USAAPage URL History Show full URLs
- https://t.co/vI9euOkVxP Page URL
- https://clarakislanov.com.br/wp-includes/images/smilies/ Page URL
- https://pub-b481f848746644b5b9c6834b540a33a7.r2.dev/howaasa.html Page URL
Detected technologies
Detected patterns
- /wp-(?:content|includes)/
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/vI9euOkVxP Page URL
- https://clarakislanov.com.br/wp-includes/images/smilies/ Page URL
- https://pub-b481f848746644b5b9c6834b540a33a7.r2.dev/howaasa.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
vI9euOkVxP
t.co/ |
326 B 574 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
clarakislanov.com.br/wp-includes/images/smilies/ |
214 B 285 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
howaasa.html
pub-b481f848746644b5b9c6834b540a33a7.r2.dev/ |
577 B 886 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
clarakislanov.com.br/ |
0 17 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
dev-wwwmm.pantheonsite.io/ggg/ |
284 KB 101 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
basic.js
dev-wwwmm.pantheonsite.io/ggg/ |
50 KB 14 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
5409595b-eb75-4dd7-b109-de0b9f715d6e
https://pub-b481f848746644b5b9c6834b540a33a7.r2.dev/ |
37 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
pub-b481f848746644b5b9c6834b540a33a7.r2.dev/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
web.css
aset-55r.pages.dev/assets/css/ |
125 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
spin.gif
aset-55r.pages.dev/assets/ |
12 KB 12 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
155 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
C1B705B7AD8D5B4C6.woff2
aset-55r.pages.dev/assets/css/fonts/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
9C7F15704715916A9.woff2
aset-55r.pages.dev/assets/css/fonts/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
E83D71A074DF776F4.woff2
aset-55r.pages.dev/assets/css/fonts/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
12C383965421BC56F.woff2
aset-55r.pages.dev/assets/css/fonts/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
9ECBC8FFB535D0532.woff2
aset-55r.pages.dev/assets/css/fonts/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
9ECBC8FFB535D0532.woff
aset-55r.pages.dev/assets/css/fonts/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
C1B705B7AD8D5B4C6.woff
aset-55r.pages.dev/assets/css/fonts/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
E83D71A074DF776F4.woff
aset-55r.pages.dev/assets/css/fonts/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
9C7F15704715916A9.woff
aset-55r.pages.dev/assets/css/fonts/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
12C383965421BC56F.woff
aset-55r.pages.dev/assets/css/fonts/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
aset-55r.pages.dev/assets/ |
66 KB 25 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- pub-b481f848746644b5b9c6834b540a33a7.r2.dev
- URL
- https://pub-b481f848746644b5b9c6834b540a33a7.r2.dev/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USAA (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showpsw function| ooth function| psload function| disperr function| valid function| $ function| jQuery number| count number| counts1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: 53534c44-2476-4536-a462-9f718ade05cf |
10 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
aset-55r.pages.dev
cdnjs.cloudflare.com
clarakislanov.com.br
dev-wwwmm.pantheonsite.io
pub-b481f848746644b5b9c6834b540a33a7.r2.dev
t.co
pub-b481f848746644b5b9c6834b540a33a7.r2.dev
104.17.24.14
104.244.42.133
108.167.132.144
152.199.19.160
172.66.44.92
2606:4700::6812:223
2620:12a:8001::4
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2364dfaeac23dad5aa574e54b6f79d3adbea213ed8f35162fdd635bd9729b8be
388fb6115aff1cf905f740b03153e42474a27aa4b46319b61bff485cea2bd024
9f3d538eecb4af12946ae7133479ea7c042794db8d0651504d4d2b3d371f396e
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
ceec846322efec91a63ccd7c7d369661a99347961bc00e4396d528d9b080f31c
d1ebe550d9854a560eda19829e29125425d3eb5a0713010f4c15cc8d62bc8538
ddb4133f601fa817524466b7bad394bb2330decf57c99762ba9c2cbd34e9e0e2
f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f
f47716799896345c25a000a68757740b00f236cf70d66815d9cbfcb9dc6862a5