pub-0778b2930ff545d590577838b972ca5d.r2.dev
Open in
urlscan Pro
2606:4700::6812:223
Malicious Activity!
Public Scan
Effective URL: https://pub-0778b2930ff545d590577838b972ca5d.r2.dev/usa.html
Submission: On May 10 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.
This is the only time pub-0778b2930ff545d590577838b972ca5d.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USAA (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.244.42.133 104.244.42.133 | 13414 (TWITTER) (TWITTER) | |
2 | 2606:4700::68... 2606:4700::6812:223 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
1 | 23.37.33.137 23.37.33.137 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
12 | 7 |
ASN13335 (CLOUDFLARENET, US)
pub-0778b2930ff545d590577838b972ca5d.r2.dev |
ASN16625 (AKAMAI-AS, US)
PTR: a23-37-33-137.deploy.static.akamaitechnologies.com
content.usaa.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
pages.dev
stylesheet-css-us.pages.dev |
7 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237 |
11 KB |
2 |
r2.dev
pub-0778b2930ff545d590577838b972ca5d.r2.dev |
49 KB |
1 |
usaa.com
content.usaa.com — Cisco Umbrella Rank: 43354 |
2 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2465 |
30 KB |
1 |
tenor.com
media.tenor.com — Cisco Umbrella Rank: 6923 |
41 KB |
1 |
t.co
t.co — Cisco Umbrella Rank: 717 |
576 B |
12 | 7 |
Domain | Requested by | |
---|---|---|
4 | stylesheet-css-us.pages.dev |
pub-0778b2930ff545d590577838b972ca5d.r2.dev
|
2 | cdnjs.cloudflare.com |
pub-0778b2930ff545d590577838b972ca5d.r2.dev
|
2 | pub-0778b2930ff545d590577838b972ca5d.r2.dev |
t.co
pub-0778b2930ff545d590577838b972ca5d.r2.dev |
1 | content.usaa.com | |
1 | ajax.aspnetcdn.com |
pub-0778b2930ff545d590577838b972ca5d.r2.dev
|
1 | media.tenor.com |
pub-0778b2930ff545d590577838b972ca5d.r2.dev
|
1 | t.co | |
12 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-10-16 - 2024-10-14 |
a year | crt.sh |
*.r2.dev E1 |
2024-04-05 - 2024-07-04 |
3 months | crt.sh |
stylesheet-css-us.pages.dev GTS CA 1P5 |
2024-04-26 - 2024-07-25 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
c.tenor.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-01-30 - 2025-01-30 |
a year | crt.sh |
www.usaa.com DigiCert EV RSA CA G2 |
2024-01-09 - 2024-09-18 |
8 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-0778b2930ff545d590577838b972ca5d.r2.dev/usa.html
Frame ID: E18AB3D1EECA763A002ADAFEDACFC384
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Member Account Login | USAAPage URL History Show full URLs
- https://t.co/WtsPymQxZZ Page URL
- https://pub-0778b2930ff545d590577838b972ca5d.r2.dev/usa.html Page URL
Detected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/WtsPymQxZZ Page URL
- https://pub-0778b2930ff545d590577838b972ca5d.r2.dev/usa.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
WtsPymQxZZ
t.co/ |
335 B 576 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
usa.html
pub-0778b2930ff545d590577838b972ca5d.r2.dev/ |
23 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.css
stylesheet-css-us.pages.dev/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.svg
stylesheet-css-us.pages.dev/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon.svg
pub-0778b2930ff545d590577838b972ca5d.r2.dev/css/ |
27 KB 27 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
flower.svg
stylesheet-css-us.pages.dev/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.js
stylesheet-css-us.pages.dev/ |
2 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading-gif.gif
media.tenor.com/On7kvXhzml4AAAAi/ |
40 KB 41 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
usaaicon.ico
content.usaa.com/mcontent/static_assets/Media/ |
7 KB 2 KB |
Other
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USAA (Banking)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _0x1d44 function| _0x1fe4 function| _0xb0d6a0 function| $ function| jQuery number| count number| counts1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: 5743f408-c846-4eb5-a6ae-c540090b7c70 |
10 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
cdnjs.cloudflare.com
content.usaa.com
media.tenor.com
pub-0778b2930ff545d590577838b972ca5d.r2.dev
stylesheet-css-us.pages.dev
t.co
104.244.42.133
152.199.19.160
23.37.33.137
2606:4700::6811:180e
2606:4700::6812:223
2a00:1450:4001:80f::200a
2a06:98c1:3120::3
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
16a21c8ce9b295166b6020908da783b7399308175f0c2428fcfc20ba66706b85
2afb46bd94e0d1c3d3df1e23bd796dd03e0279f0ad80efdb53c0da7c638fb4a3
4ac23a611f6972750bf5fb2f0f6336e4dee18b4f70871174b6c0a4a2f52a1817
563d0ba5e849acbd5eba4c5a452930f1795cfbc5f92a60a4f0d0426afb5bb3f4
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
b360359ffe7d46d32329b6a454b0540e6d34bd444a6f9ecface6663e1cb98aba
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
e89f1ba1fc9b6955a20e36bedce41f31f1bcf454fcdc6a1cf47ea015f5041d0a
f1b3ca7b348de5507fa0dc8fe5960fecca32cdbc2e81d03743ba426f8d3c7aa9