urlscan.io logo urlscan.io
SecurityTrails logo

vvsicse.com Open in urlscan Pro
103.159.84.145  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://pearthlending.com/usaa?usaa
Effective URL: https://vvsicse.com/home/?usaa
Submission: On April 06 via automatic, source openphish — Scanned from SG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 103.159.84.145, located in India and belongs to QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN. The main domain is vvsicse.com.
TLS certificate: Issued by R3 on February 15th 2023. Valid for: 3 months.
This is the only time vvsicse.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USAA (Banking)

Domain & IP information

IP Address AS Autonomous System
1 2 148.66.138.118 26496 (AS-26496-...)
1 11 103.159.84.145 141004 (QTIME-AS-...)
11 2
Apex Domain
Subdomains		 Transfer
11 vvsicse.com
vvsicse.com
40 KB
2 pearthlending.com
pearthlending.com
594 B
11 2
Domain Requested by
11 vvsicse.com 1 redirects vvsicse.com
2 pearthlending.com 1 redirects
11 2

This site contains no links.

Subject Issuer Validity Valid
ftp.vvsicse.com
R3		 2023-02-15 -
2023-05-16		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://vvsicse.com/home/?usaa
Frame ID: 9369AD143E5F88346A029D2FAECC4128
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Member Account Login | USAA

Page URL History Show full URLs

  1. http://pearthlending.com/usaa?usaa HTTP 301
    http://pearthlending.com/usaa/?usaa Page URL
  2. https://vvsicse.com/home?usaa HTTP 301
    https://vvsicse.com/home/?usaa Page URL

Page Statistics

11
Requests

91 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

40 kB
Transfer

54 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://pearthlending.com/usaa?usaa HTTP 301
    http://pearthlending.com/usaa/?usaa Page URL
  2. https://vvsicse.com/home?usaa HTTP 301
    https://vvsicse.com/home/?usaa Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://pearthlending.com/usaa?usaa HTTP 301
  • http://pearthlending.com/usaa/?usaa

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
pearthlending.com/usaa/
Redirect Chain
  • http://pearthlending.com/usaa?usaa
  • http://pearthlending.com/usaa/?usaa
78 B
347 B 		Document
General
Check archive.org
Download Go to
Full URL
http://pearthlending.com/usaa/?usaa
Protocol
HTTP/1.1
Server
148.66.138.118 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software
Apache / PHP/7.2.34
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
95
Content-Type
text/html; charset=UTF-8
Date
Thu, 06 Apr 2023 04:05:17 GMT
Keep-Alive
timeout=5
Server
Apache
Vary
Accept-Encoding
X-Powered-By
PHP/7.2.34

Redirect headers

Connection
Keep-Alive
Content-Length
243
Content-Type
text/html; charset=iso-8859-1
Date
Thu, 06 Apr 2023 04:05:17 GMT
Keep-Alive
timeout=5
Location
http://pearthlending.com/usaa/?usaa
Server
Apache
Primary Request /
vvsicse.com/home/
Redirect Chain
  • https://vvsicse.com/home?usaa
  • https://vvsicse.com/home/?usaa
3 KB
944 B 		Document
General
Check archive.org
Download Go to
Full URL
https://vvsicse.com/home/?usaa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.159.84.145 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN),
Reverse DNS
server102da.hostcats.com
Software
/
Resource Hash
b883beee2d337d8e5fcbbab3ab74df01605ca047e141b2567dfa64582c1f7308

Request headers

Referer
http://pearthlending.com/usaa/?usaa
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

content-encoding
gzip
content-length
871
content-type
text/html; charset=UTF-8
date
Thu, 06 Apr 2023 04:05:18 GMT
server
vary
Accept-Encoding,User-Agent

Redirect headers

content-length
238
content-type
text/html; charset=iso-8859-1
date
Thu, 06 Apr 2023 04:05:18 GMT
location
https://vvsicse.com/home/?usaa
server
Untitled1.css
vvsicse.com/home/ 		2 KB
485 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://vvsicse.com/home/Untitled1.css
Requested by
Host: vvsicse.com
URL: https://vvsicse.com/home/?usaa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.159.84.145 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN),
Reverse DNS
server102da.hostcats.com
Software
/
Resource Hash
97eeb3dfa47efa7aafbaf073eaf579b71c9ee1f885d4f7a070d8eeeb1114dd7e

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://vvsicse.com/home/?usaa
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 04:05:19 GMT
content-encoding
gzip
last-modified
Wed, 05 Apr 2023 09:05:15 GMT
server
etag
"7c7-5f8931721f27b-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
accept-ranges
bytes
content-length
373
index.css
vvsicse.com/home/ 		13 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://vvsicse.com/home/index.css
Requested by
Host: vvsicse.com
URL: https://vvsicse.com/home/?usaa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.159.84.145 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN),
Reverse DNS
server102da.hostcats.com
Software
/
Resource Hash
f2f26f331d9c4ec7d46988822c0abeb589e15b51ce944848440e8e075ea56c6e

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://vvsicse.com/home/?usaa
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 04:05:19 GMT
content-encoding
gzip
last-modified
Wed, 05 Apr 2023 09:05:15 GMT
server
etag
"33e5-5f893171ee91e-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
accept-ranges
bytes
content-length
2062
Capture.PNG
vvsicse.com/home/images/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vvsicse.com/home/images/Capture.PNG
Requested by
Host: vvsicse.com
URL: https://vvsicse.com/home/?usaa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.159.84.145 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN),
Reverse DNS
server102da.hostcats.com
Software
/
Resource Hash
595e273018ad95b90da98535769f2fa29d3eefbd1a25349228e912de82c7e340

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://vvsicse.com/home/?usaa
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 04:05:19 GMT
last-modified
Wed, 05 Apr 2023 09:05:15 GMT
server
accept-ranges
bytes
etag
"4952-5f893171e3185"
content-length
18770
content-type
image/png
id.PNG
vvsicse.com/home/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vvsicse.com/home/images/id.PNG
Requested by
Host: vvsicse.com
URL: https://vvsicse.com/home/?usaa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.159.84.145 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN),
Reverse DNS
server102da.hostcats.com
Software
/
Resource Hash
6b0ded8f9af9c49c676f84566b40a6424c0708a5611705bdfa3b00c8d063536d

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://vvsicse.com/home/?usaa
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 04:05:19 GMT
last-modified
Wed, 05 Apr 2023 09:05:15 GMT
server
accept-ranges
bytes
etag
"457-5f893171e7bbe"
content-length
1111
content-type
image/png
pwd.PNG
vvsicse.com/home/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vvsicse.com/home/images/pwd.PNG
Requested by
Host: vvsicse.com
URL: https://vvsicse.com/home/?usaa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.159.84.145 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN),
Reverse DNS
server102da.hostcats.com
Software
/
Resource Hash
051b0ba3732f4f242e6228ab82230ca4dcae40ce4c05dc4270c1d6bb0ea402da

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://vvsicse.com/home/?usaa
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 04:05:19 GMT
last-modified
Wed, 05 Apr 2023 09:05:15 GMT
server
accept-ranges
bytes
etag
"580-5f893171e9afe"
content-length
1408
content-type
image/png
logCapture.PNG
vvsicse.com/home/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vvsicse.com/home/images/logCapture.PNG
Requested by
Host: vvsicse.com
URL: https://vvsicse.com/home/?usaa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.159.84.145 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN),
Reverse DNS
server102da.hostcats.com
Software
/
Resource Hash
d52b271f17694d8468f772200065e77721836e4a383d8ab1fea902ff68d207ae

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://vvsicse.com/home/?usaa
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 04:05:19 GMT
last-modified
Wed, 05 Apr 2023 09:05:15 GMT
server
accept-ranges
bytes
etag
"75b-5f893171e8b5e"
content-length
1883
content-type
image/png
WWWCapture.PNG
vvsicse.com/home/images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vvsicse.com/home/images/WWWCapture.PNG
Requested by
Host: vvsicse.com
URL: https://vvsicse.com/home/?usaa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.159.84.145 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN),
Reverse DNS
server102da.hostcats.com
Software
/
Resource Hash
b3a64b17f3736d0d13d8377ddba6f9312be40a9813ba268058dca46e0e60b091

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://vvsicse.com/home/?usaa
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 04:05:19 GMT
last-modified
Wed, 05 Apr 2023 09:05:15 GMT
server
accept-ranges
bytes
etag
"210a-5f893171eaa9e"
content-length
8458
content-type
image/png
aCapture.PNG
vvsicse.com/home/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vvsicse.com/home/images/aCapture.PNG
Requested by
Host: vvsicse.com
URL: https://vvsicse.com/home/?usaa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.159.84.145 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN),
Reverse DNS
server102da.hostcats.com
Software
/
Resource Hash
75aab5df282099b602d349c5703c25b695aba5175cfc54b87e305b32b0a06eea

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://vvsicse.com/home/?usaa
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 04:05:19 GMT
last-modified
Wed, 05 Apr 2023 09:05:15 GMT
server
accept-ranges
bytes
etag
"71c-5f893171e21e5"
content-length
1820
content-type
image/png
zCapture.PNG
vvsicse.com/home/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vvsicse.com/home/images/zCapture.PNG
Requested by
Host: vvsicse.com
URL: https://vvsicse.com/home/?usaa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.159.84.145 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN),
Reverse DNS
server102da.hostcats.com
Software
/
Resource Hash
d1c9b0d47d2841aceb602141b665b7155b2f2e8325c25e0cdd4428c54fe1302e

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://vvsicse.com/home/?usaa
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 04:05:19 GMT
last-modified
Wed, 05 Apr 2023 09:05:15 GMT
server
accept-ranges
bytes
etag
"d8e-5f893171ed97e"
content-length
3470
content-type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USAA (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies