byashi.com.br
Open in
urlscan Pro
192.185.210.37
Malicious Activity!
Public Scan
URL:
https://byashi.com.br/jss/details.php?&sessionid=90b6d23d491ec570b9b691d7d4764d76&securessl=true
Submission: On November 29 via automatic, source openphish — Scanned from DE
Submission: On November 29 via automatic, source openphish — Scanned from DE
Summary
This website contacted 4 IPs
in 2 countries
across 2 domains to perform 23 HTTP transactions.
The main IP is 192.185.210.37, located in
United States and
belongs to NETWORK-SOLUTIONS-HOSTING, US.
The main domain is byashi.com.br.
TLS certificate: Issued by R3 on October 15th 2022. Valid for: 3 months.
This is the only time byashi.com.br was scanned on urlscan.io!
TLS certificate: Issued by R3 on October 15th 2022. Valid for: 3 months.
This is the only time byashi.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) USAA (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 15 | 192.185.210.37 192.185.210.37 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
| 5 | 104.111.229.42 104.111.229.42 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 1 | 104.111.231.125 104.111.231.125 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 23 | 4 |
15
192.185.210.37
(United States)
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: br110-ip21.hostgator.com.br
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: br110-ip21.hostgator.com.br
| byashi.com.br |
5
104.111.229.42
(Frankfurt am Main, Germany)
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-229-42.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-229-42.deploy.static.akamaitechnologies.com
| content.usaa.com |
1
104.111.231.125
(Frankfurt am Main, Germany)
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-231-125.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-231-125.deploy.static.akamaitechnologies.com
| statmcstg.usaa.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 15 |
byashi.com.br
byashi.com.br |
189 KB |
| 6 |
usaa.com
content.usaa.com — Cisco Umbrella Rank: 77997 statmcstg.usaa.com — Cisco Umbrella Rank: 376593 |
74 KB |
| 23 | 2 |
| Domain | Requested by | |
|---|---|---|
| 15 | byashi.com.br |
byashi.com.br
|
| 5 | content.usaa.com |
byashi.com.br
|
| 1 | statmcstg.usaa.com |
byashi.com.br
|
| 23 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.byashi.com.br R3 |
2022-10-15 - 2023-01-13 |
3 months | crt.sh |
| www.usaa.com DigiCert SHA2 Extended Validation Server CA |
2022-04-05 - 2023-05-06 |
a year | crt.sh |
| rwww.usaa.com DigiCert SHA2 Extended Validation Server CA |
2022-10-29 - 2023-11-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://byashi.com.br/jss/details.php?&sessionid=90b6d23d491ec570b9b691d7d4764d76&securessl=true
Frame ID: 8AB62CB105B6A83C67A4CD8E74A6ED86
Requests: 28 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
details.php
byashi.com.br/jss/ |
83 KB 22 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
MaskedPassword.js
byashi.com.br/jss/pin_files/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
byashi.com.br/jss/pin_files/ |
82 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
aggregator.css
byashi.com.br/jss/pin_files/ |
116 KB 33 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
enterprise_nav_globalnav_usaalogo.svg
byashi.com.br/jss/pin_files/ |
11 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
misc_accent_computerIcon.png
byashi.com.br/jss/pin_files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
enterprise_sprite_messagecenter_globalenvelope.png
byashi.com.br/jss/pin_files/ |
438 B 476 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SocMedIcon_facebook_v2.png
byashi.com.br/jss/pin_files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SocMedIcon_twitter_v2.png
byashi.com.br/jss/pin_files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SocMedIcon_youtube_v2.png
byashi.com.br/jss/pin_files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SocMedIcon_more.png
byashi.com.br/jss/pin_files/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
usaa-sprite-globalNav_v2.png
byashi.com.br/jss/pin_files/ |
56 KB 57 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ScreenShareMember.css
byashi.com.br/jss/pin_files/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
tlClose.png
byashi.com.br/jss/pin_files/ |
397 B 427 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
spinIndiicator48x48.gif
byashi.com.br/jss/pin_files/ |
11 KB 11 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
228 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
229 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
background_general_fb.png
content.usaa.com/mcontent/static_assets/Media/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
enterprise_nav_globalnav_sprite.svg
content.usaa.com/mcontent/static_assets/Media/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
347 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
CC8B46FD41C3A5502.woff2
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
598 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
386 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bgFooter_v2.png
content.usaa.com/mcontent/static_assets/Media/ |
496 B 939 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
misc_accent_socMedia.png
content.usaa.com/mcontent/static_assets/Media/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
usaa-sprite-globalNav_v2.png
content.usaa.com/mcontent/static_assets/Media/ |
56 KB 57 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
prodOther_accent_OpinionLabIcon.png
statmcstg.usaa.com/mcontent/static_assets/Media/ |
548 B 989 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
CC8B46FD41C3A5502.woff
content.usaa.com/mcontent/static_assets/Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/CC8B46FD41C3A5502.woff2?cacheid=2159110100_p
- Domain
- content.usaa.com
- URL
- https://content.usaa.com/mcontent/static_assets/Fonts/CC8B46FD41C3A5502.woff?cacheid=1373003117_p
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) USAA (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| MaskedPassword function| empty function| change function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| byashi.com.br/ | Name: PHPSESSID Value: a677489fe4f04d11da99d999e611fdfa |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
byashi.com.br
content.usaa.com
statmcstg.usaa.com
content.usaa.com
104.111.229.42
104.111.231.125
192.185.210.37
09fe494df49bb50492a87d2670d9839f3f4220f300b146809d36b7e805db52a3
0deb9be54a4aa9378715cb98c0249fb987a1f28ee587145962330b5cabb145a0
148407c00960f8321a6d638e8a8bbc3e1da42b1a248b2d1ffd7022d25c0faa2e
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
32a78d62b883ff9ad4da5253ea3390908f472a71835a46d387b88bcfda209ea6
378c606eae5ad82adfa88d102ad639364f976091246d1ea29a798b6b8516de9c
522a5fe0b1921acbaa0925b2a50fa141b0719797d5c552ffc150415c7c44d23b
5f37758ffd7d456a020ad4400fbb49598ce23e634add3d6704ab69973bc823df
70cc16695978690e74938cae7f3a5f0de6ee23b1837bddca169316c7001eecd7
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
8787da31ff9af74162852c58126e6a8fad1838041ae1e47f460d62830f297ac0
96dc99444ec962965b04b0a9671b844bf24705697697e48ad42c6dc5f7d8325b
ad5980cb9d5ad82571e49366d26c086e2c2bbe7efe6feb729c12f9594948ba21
b110bcd83560d6f9960baff7ddaa2a8c4529ac63867f54903211e380b3d835e8
c9f4a580494365cddc8105e91fd47b03befa8ff569bd10ed24458f3b4c56de04
d1886043ac668fcd2ccb7019ba9b35ef16f7d0c3db9d9dedf3862b036a4ae2d3
d317c2e6324cdd35249a3d5b6370b68d5b018fdddecc1dec0b9660f2affff0bd
d40cd15afd61f014315bc50972acd75d4c43f59edfd18bdb965255d2120dc00a
d5943a74aff051f920e7f45b07f0aa23dd53d1f24b308a496b623a1475ef0424
d623995ba8a2adc0afab831b836b8c624b4f40c0e905a4e2e899d493a283041e
ddaa6ef7466b6e224c834f62c39b381044760a5fe06238ba09b3a0b1a5e6525c
e2e04a8e937f5b74a4c50cb7592a8e0bba54b40818d44e43ffd5c40c6b4fe72a
e71a48d99cc509ca0d2108ccfec7802c98f41a37b772c1ebb034374fa84909fa
e9a681648676dcb7d958f77bed911c7a8a30dabe8ef0265b5ee894205c8aef60
fda9dc9b1feb432da051add9ca8ccdcdedfe460e5e1be4df5f3d17e0bde69c87