usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au Open in urlscan Pro
27.121.64.96 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Submission: On September 17 via automatic, source openphish (September 17th 2017, 3:12:28 am UTC)

Summary HTTP 10 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 27.121.64.96, located in Brisbane, Australia and belongs to NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU. The main domain is usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au.

This is the only time usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USAA (Banking)

Domain & IP information

	IP Address		AS Autonomous System
9	27.121.64.96 27.121.64.96		24446 (NETREGIST...) (NETREGISTRY-AS-AP NetRegistry Pty Ltd.)
1	23.35.107.177 23.35.107.177		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
10	2

9 27.121.64.96 (Brisbane, Australia)

ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU)
PTR: cp96.ezyreg.com

usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.35.107.177 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-35-107-177.deploy.static.akamaitechnologies.com

content.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	ozinta.com.au usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au	264 KB
1	usaa.com content.usaa.com	3 KB
10	2

	Domain	Requested by
9	usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au	usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
1	content.usaa.com	usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
10	2

This site contains no links.

Subject Issuer	Validity	Valid
www.usaa.com Symantec Class 3 EV SSL CA - G3	`2017-01-31` - `2018-03-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Frame ID: 22694.1
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

10
Requests

10 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

267 kB
Transfer

267 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request email2.php Show response
usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/ 4 KB
4 KB 741ms
400ms Document
text/html 27.121.64.96
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Protocol: HTTP/1.1
Server: 27.121.64.96 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp96.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.3.29
Resource Hash: 1f545535d428814a20f009aa4d4614d60a761c752fa4d57794655f6392ada7b2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Sun, 17 Sep 2017 03:12:15 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Connection: Keep-Alive
X-Powered-By: PHP/5.3.29
Transfer-Encoding: chunked
Keep-Alive: timeout=3, max=100
Content-Type: text/html

GET
H/1.1 404
Not Found bat.js
usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/imgs/ 0
0 341ms
341ms Script
text/html 27.121.64.96
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/imgs/bat.js
Requested by: Host: usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Protocol: HTTP/1.1
Server: 27.121.64.96 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp96.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash

Request headers

Referer: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Sun, 17 Sep 2017 03:12:16 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Connection: Keep-Alive
Keep-Alive: timeout=3, max=100
Content-Length: 328
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found s39876891442473.js
usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/imgs/ 0
0 341ms
341ms Script
text/html 27.121.64.96
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/imgs/s39876891442473.js
Requested by: Host: usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Protocol: HTTP/1.1
Server: 27.121.64.96 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp96.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash

Request headers

Referer: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Sun, 17 Sep 2017 03:12:17 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Connection: Keep-Alive
Keep-Alive: timeout=3, max=99
Content-Length: 340
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK aggregator.css
usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/img/ 190 KB
190 KB 343ms
340ms Stylesheet
text/css 27.121.64.96
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/img/aggregator.css
Requested by: Host: usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Protocol: HTTP/1.1
Server: 27.121.64.96 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp96.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 9da8810bcf8f1cbf33a79dc4c9fede09b754a0694cf1c4befbf94a863e7032f1

Request headers

Referer: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Sun, 17 Sep 2017 03:12:16 GMT
Last-Modified: Sat, 09 Jan 2016 23:38:56 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "4a9c3-2f9ed-528ef350ea400"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=99
Content-Length: 195053

GET
H/1.1 404
Not Found aggregator.css
usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/imgs/ 0
0 681ms
341ms Stylesheet
text/html 27.121.64.96
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/imgs/aggregator.css
Requested by: Host: usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Protocol: HTTP/1.1
Server: 27.121.64.96 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp96.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash

Request headers

Referer: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Sun, 17 Sep 2017 03:12:16 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Connection: Keep-Alive
Keep-Alive: timeout=3, max=100
Content-Length: 336
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK emailerror.PNG
usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/ 5 KB
5 KB 341ms
341ms Image
image/png 27.121.64.96
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/emailerror.PNG
Requested by: Host: usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Protocol: HTTP/1.1
Server: 27.121.64.96 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp96.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: e4948db94661d9e00e315d8a268702986351e9b8db6d0a97002f3f90127ddb7f

Request headers

Referer: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Sun, 17 Sep 2017 03:12:17 GMT
Last-Modified: Sat, 05 Nov 2016 07:14:32 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "4a9ac-1339-540888acd6600"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=98
Content-Length: 4921

GET
H/1.1 200
OK emailinfo.PNG
usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/ 16 KB
16 KB 341ms
341ms Image
image/png 27.121.64.96
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/emailinfo.PNG
Requested by: Host: usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Protocol: HTTP/1.1
Server: 27.121.64.96 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp96.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 067428d80c73ef393274984a719b7310d8f2200805430cd67cc5a6e5e19ef3f8

Request headers

Referer: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Sun, 17 Sep 2017 03:12:17 GMT
Last-Modified: Tue, 01 Nov 2016 19:18:52 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "4a9ca-3f5c-5404231dadf00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=97
Content-Length: 16220

GET
H/1.1 200
OK emailpass.PNG
usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/ 12 KB
12 KB 341ms
340ms Image
image/png 27.121.64.96
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/emailpass.PNG
Requested by: Host: usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Protocol: HTTP/1.1
Server: 27.121.64.96 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp96.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 8ae5885bca081d6173707e0e86925cd428965f25b070aaae1df00e381aeb4398

Request headers

Referer: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Sun, 17 Sep 2017 03:12:18 GMT
Last-Modified: Tue, 01 Nov 2016 19:25:46 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "4a9cd-30e0-540424a880280"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=96
Content-Length: 12512

GET
H/1.1 200
OK Capture11.PNG
usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/ 36 KB
36 KB 340ms
340ms Image
image/png 27.121.64.96
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/Capture11.PNG
Requested by: Host: usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
Protocol: HTTP/1.1
Server: 27.121.64.96 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp96.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: f8a452b38c46c6307b693f244bae878a27c438bbb9b52625941b21b27a8f69b0

Request headers

Referer: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Sun, 17 Sep 2017 03:12:18 GMT
Last-Modified: Sat, 30 Jul 2016 13:40:56 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "4a9b5-911d-538da843a6a00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=98
Content-Length: 37149

GET
S 200 background_general_fb.png
content.usaa.com/mcontent/static_assets/Media/ 3 KB
3 KB 8ms
8ms Image
image/png 23.35.107.177
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.usaa.com/mcontent/static_assets/Media/background_general_fb.png?cacheid=2934981489_p

Requested by

Host: usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
URL: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/email2.php

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.35.107.177 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-35-107-177.deploy.static.akamaitechnologies.com

Software

USAA-Service /

Resource Hash

e2e04a8e937f5b74a4c50cb7592a8e0bba54b40818d44e43ffd5c40c6b4fe72a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au/img/aggregator.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

date: Sun, 17 Sep 2017 03:12:18 GMT
last-modified: Mon, 16 Sep 2013 11:24:14 GMT
server: USAA-Service
etag: "b13-4e67e71a8d380"
strict-transport-security: max-age=31536000
p3p: policyref="https://www.usaa.com/w3c/USAA_Full_P3P_Policy.xml", CP="IDC DSP COR CUR ADM DEV CUS DEV PSA IVA CON HIS TEL OPT OUR SAM IND PRE"
status: 200
cache-control: max-age=532299
accept-ranges: bytes
content-type: image/png
content-length: 2835

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USAA (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

content.usaa.com
usaa.com-inet-true-auth-secured-checking-home.ozinta.com.au
23.35.107.177
27.121.64.96
067428d80c73ef393274984a719b7310d8f2200805430cd67cc5a6e5e19ef3f8
1f545535d428814a20f009aa4d4614d60a761c752fa4d57794655f6392ada7b2
8ae5885bca081d6173707e0e86925cd428965f25b070aaae1df00e381aeb4398
9da8810bcf8f1cbf33a79dc4c9fede09b754a0694cf1c4befbf94a863e7032f1
e2e04a8e937f5b74a4c50cb7592a8e0bba54b40818d44e43ffd5c40c6b4fe72a
e4948db94661d9e00e315d8a268702986351e9b8db6d0a97002f3f90127ddb7f
f8a452b38c46c6307b693f244bae878a27c438bbb9b52625941b21b27a8f69b0