pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev Open in urlscan Pro
2606:4700::6812:323 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Effective URL:
https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Submission: On February 24 via automatic, source openphish (February 24th 2024, 1:10:34 pm UTC) — Scanned from DE

Summary HTTP 34 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 9 IPs in 2 countries across 7 domains to perform 34 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev.
TLS certificate: Issued by E1 on February 6th 2024. Valid for: 3 months.

This is the only time pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USAA (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4	2606:4700::68... 2606:4700::6812:323	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	184.31.88.123 184.31.88.123	16625 (AKAMAI-AS) (AKAMAI-AS)
7	23.212.210.218 23.212.210.218	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2600:9000:26d... 2600:9000:26db:d000:7:2bfb:7c00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
1	3.67.108.235 3.67.108.235	16509 (AMAZON-02) (AMAZON-02)
4	2a02:26f0:310... 2a02:26f0:3100::1735:2a82	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	172.67.74.152 172.67.74.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
34	9

4 2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 184.31.88.123 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-88-123.deploy.static.akamaitechnologies.com

www.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 23.212.210.218 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-212-210-218.deploy.static.akamaitechnologies.com

tms.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
da.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:26db:d000:7:2bfb:7c00:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.67.108.235 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-67-108-235.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:3100::1735:2a82 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p11.techlab-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.74.152 (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	usaa.com 1 redirects www.usaa.com — Cisco Umbrella Rank: 40278 tms.usaa.com — Cisco Umbrella Rank: 33600 content.usaa.com Failed da.usaa.com — Cisco Umbrella Rank: 33797	328 KB
4	techlab-cdn.com p11.techlab-cdn.com — Cisco Umbrella Rank: 3684	59 KB
4	r2.dev pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev	123 KB
2	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1214	1 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 3053	155 B
1	agkn.com d.agkn.com — Cisco Umbrella Rank: 768	761 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 362	30 KB
34	7

	Domain	Requested by
6	tms.usaa.com	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
4	p11.techlab-cdn.com	www.usaa.com
4	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
3	www.usaa.com	1 redirects pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
2	tags.tiqcdn.com	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev www.usaa.com
1	api.ipify.org	www.usaa.com
1	da.usaa.com	www.usaa.com
1	d.agkn.com	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
1	ajax.googleapis.com	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
0	content.usaa.com Failed	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
34	10

This site contains links to these domains. Also see Links.

Domain
www.usaa.com

Subject Issuer	Validity	Valid
*.r2.dev E1	`2024-02-06` - `2024-05-06`	3 months	crt.sh
www.usaa.com DigiCert EV RSA CA G2	`2024-01-09` - `2024-09-18`	8 months	crt.sh
da.usaa.com DigiCert EV RSA CA G2	`2023-07-19` - `2024-08-18`	a year	crt.sh
tags.tiqcdn.com Amazon RSA 2048 M01	`2023-04-18` - `2024-05-17`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.agkn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2023-09-07` - `2024-09-29`	a year	crt.sh
p11.techlab-cdn.com R3	`2024-01-18` - `2024-04-17`	3 months	crt.sh
ipify.org GTS CA 1P5	`2024-01-22` - `2024-04-21`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Frame ID: C42827DD981AE3078A8FC3D38C84B1CA
Requests: 33 HTTP requests in this frame

Frame: https://d.agkn.com/iframe/9297/?amcid=32262987562682621898658789104096920213&type=1000&che=0.6300761500650991
Frame ID: FDAB6B454E3B7B3FA3D61411E01C4685
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Member Account Login | USAAUSAA logo. Redirects to USAA home. USAA logousaa-symbol-laurel

Page URL History Show full URLs

http://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html HTTP 307
https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Page URL

Detected technologies

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

34
Requests

62 %
HTTPS

50 %
IPv6

7
Domains

10
Subdomains

9
IPs

2
Countries

542 kB
Transfer

1463 kB
Size

5
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.usaa.com/
Title: USAA logo. Redirects to USAA home. USAA logo

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/wc/security_center?0&wa_ref=logon_jump_security_center
Title: Security Center

Search URL Search Domain Scan URL

URL: https://www.usaa.com/privacy
Title: Privacy Center

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/accessibility_at_usaa_main?wa_ref=pub_subglobal_footer_accessibility
Title: Accessibility at USAA

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html HTTP 307
https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9

https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js HTTP 302
https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js?akredirect=true

34 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request index.html Show response
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
Redirect Chain

http://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

16 KB
17 KB

83ms
57ms

Document
text/html

2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83715cbbb065ced28d5098b14e7fe6b7b42d830a733f5813a71ec67cd22535e7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
CF-RAY: 85a7f2e99a439268-FRA
Connection: keep-alive
Content-Length: 16872
Content-Type: text/html
Date: Sat, 24 Feb 2024 13:10:28 GMT
ETag: "300a48576e7f4bb1835ed1dacef6bd32"
Last-Modified: Fri, 19 Jan 2024 22:57:51 GMT
Server: cloudflare
Vary: Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Non-Authoritative-Reason: HSTS

GET
H2 200 43b1988e1728f7041b7be65970c00a98968411a756c2e Show response
www.usaa.com/resources/ 153 KB
57 KB 689ms
188ms Script
application/javascript 184.31.88.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.31.88.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-31-88-123.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

368a97b6ef5e5696f8a482804eb49982c121445d9bf5b80bf619e0d82fa371a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
content-md5: nZDKa/+ZxrKCSjOs2XHoug==
x-ref-id: 0.bee22517.1708780228.524b8c50
server-timing: edge;desc=524b8c50
content-length: 57283
last-modified: Sat, 20 Jan 2024 03:37:12 GMT
server: USAA-Honesty
etag: 0x8DC1969169E7FD8
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 13:20:28 GMT

GET
H/1.1 200
OK style.css
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/style/ 106 KB
106 KB 56ms
56ms Stylesheet
text/plain 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/style/style.css
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89dc993c24812f699d75b2060b70703f66b895b92d01f944ed33739f17ffb978

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sat, 24 Feb 2024 13:10:28 GMT
Last-Modified: Fri, 19 Jan 2024 22:57:55 GMT
Server: cloudflare
ETag: "d9a0ca73c773e9955b3e313410b2533c"
Vary: Accept-Encoding
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 85a7f2e9fa769268-FRA
Content-Length: 108036

GET
H2 200 utag.js Show response
tms.usaa.com/nw/prod/ 304 KB
68 KB 744ms
237ms Script
application/x-javascript 23.212.210.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.js

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.210.218 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-210-218.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

155f16475e8a93c318814bf4fe5305e66a1ae866ac74e3fceed9343d527d1f7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 23 Feb 2024 18:53:27 GMT
server: AkamaiNetStorage
etag: "0878aabab54365cf2522d0d54201f828:1708714406.976853"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
expires: Sat, 24 Feb 2024 13:40:28 GMT

GET
H2 200 ent-unified-logon-web.js Show response
tags.tiqcdn.com/dle/usaa/nw/ 273 B
671 B 103ms
26ms Script
application/javascript 2600:9000:26db:d000:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/dle/usaa/nw/ent-unified-logon-web.js
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26db:d000:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 12823479e57e579d5eb7af45a060336db24bfb84bf0af53a1099d6ca016973f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 12:13:59 GMT
via: 1.1 03d32b94cb61a4fdb1e546e888f089e4.cloudfront.net (CloudFront)
last-modified: Tue, 24 Nov 2020 19:54:16 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P3
age: 3517
x-amz-server-side-encryption: AES256
etag: "1a6e4c1aade1d02a22faec181b827e84"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 273
x-amz-cf-id: N01rVit1q35qPy0B06pvtq4RejfJ3yXY-lPPlgj8PU4hPNvinFoGcA==

GET
H2 200 utag.318.js Show response
tms.usaa.com/nw/prod/ 490 KB
148 KB 1721ms
1215ms Script
application/x-javascript 23.212.210.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.318.js?utv=ut4.46.202312071647

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.210.218 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-210-218.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

05de608f0d5842c448775cf281a36d7b13429dcd4e98bc6e6a5031d69e926f29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 22 Feb 2024 18:06:50 GMT
server: AkamaiNetStorage
etag: "0c47667c4394aec5d9adb54a552a6c21:1708625210.122445"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
expires: Sat, 24 Feb 2024 13:40:29 GMT

GET
H2 200 utag.233.js Show response
tms.usaa.com/nw/prod/ 141 KB
45 KB 1024ms
517ms Script
application/x-javascript 23.212.210.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.233.js?utv=ut4.46.202312141522

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.210.218 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-210-218.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

9809e4b1eae0adde161b5ce78d609ee67bfdd8013d018bf5858ada601d45d134

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 22 Feb 2024 18:06:53 GMT
server: AkamaiNetStorage
etag: "6a3ad6cdd20979d4f9d597140dfe6e55:1708625213.927258"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
expires: Sat, 24 Feb 2024 13:40:29 GMT

GET
H2 200 utag.480.js Show response
tms.usaa.com/nw/prod/ 20 KB
6 KB 1629ms
1123ms Script
application/x-javascript 23.212.210.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.480.js?utv=ut4.46.202312071647

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.210.218 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-210-218.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

e6f451434f9a09dc6b7ffbe8d273bd983955c9ab483440c7e58dce8f714e6229

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 22 Feb 2024 18:06:52 GMT
server: AkamaiNetStorage
etag: "49976a70cb29d71d95648ef2d4877295:1708625212.825619"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
content-length: 5936
expires: Sat, 24 Feb 2024 13:40:29 GMT

GET
H2 200 utag.327.js Show response
tms.usaa.com/nw/prod/ 4 KB
2 KB 1021ms
515ms Script
application/x-javascript 23.212.210.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.327.js?utv=ut4.46.202312071647

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.210.218 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-210-218.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

961854498fae2a8b5e1a81928529e4324eb96aa647e79a150c10502570e329ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 22 Feb 2024 18:06:53 GMT
server: AkamaiNetStorage
etag: "43ea3c92939c8ad7ef92450e1b24734b:1708625213.440631"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
content-length: 1614
expires: Sat, 24 Feb 2024 13:40:29 GMT

GET
H2 200 utag.495.js Show response
tms.usaa.com/nw/prod/ 4 KB
2 KB 1136ms
630ms Script
application/x-javascript 23.212.210.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.495.js?utv=ut4.46.202312071647

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.210.218 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-210-218.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

96f6aae9b5454059ad7e99847fe96a9f05b85230206e234aa7e7059aff6c2d62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 22 Feb 2024 18:06:48 GMT
server: AkamaiNetStorage
etag: "3b5e2a7b5612193b5abd244024091c6d:1708625208.0104"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
content-length: 1880
expires: Sat, 24 Feb 2024 13:40:29 GMT

GET
H2

200

react!react-dom.min.js Show response
www.usaa.com/utils/externals/react!react-dom/17.0.2/
Redirect Chain

https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js
https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js?akredirect=true

0
0

950ms
950ms

Script
text/html

184.31.88.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js?akredirect=true
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: H2
Server: 184.31.88.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-88-123.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Redirect headers

date: Sat, 24 Feb 2024 13:10:28 GMT
strict-transport-security: max-age=31536000
server: USAA-Loyalty
location: https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js?akredirect=true
x-ref-id: 0.bee22517.1708780228.524b8c4f
cache-control: max-age=2592000
server-timing: edge;desc=524b8c4f
content-length: 0
expires: Mon, 25 Mar 2024 13:10:28 GMT

GET
H/1.1 404
Not Found ent-unified-logon-web.daae48898ca3ca520b1d.js
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/my/logon/ 0
0 63ms
49ms Script
text/html 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/my/logon/ent-unified-logon-web.daae48898ca3ca520b1d.js
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sat, 24 Feb 2024 13:10:28 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 85a7f2ea0d3437c6-FRA
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

GET
H/1.1 404
Not Found 5PRVYfRE
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/8vKkY0CQQRVH/qD/QCN8X5Jjek/upaGXDXtLh/ER9YcQE/Q2t/ 0
0 71ms
56ms Script
text/html 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/8vKkY0CQQRVH/qD/QCN8X5Jjek/upaGXDXtLh/ER9YcQE/Q2t/5PRVYfRE
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sat, 24 Feb 2024 13:10:28 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 85a7f2ea1a3a9be9-FRA
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 85 KB
30 KB 28ms
8ms Script
text/javascript 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 08:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30306
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 23 Feb 2025 08:13:00 GMT

GET
H/1.1 200 / Show response
d.agkn.com/iframe/9297/ Frame FDAB 223 B
761 B 59ms
14ms Document
text/html 3.67.108.235
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.agkn.com/iframe/9297/?amcid=32262987562682621898658789104096920213&type=1000&che=0.6300761500650991
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.67.108.235 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-67-108-235.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 52a1d0f52f460e327988c355867521b4de4af61472d94935afb22dd20cfea935

Request headers

Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 223
Content-Type: text/html;charset=UTF-8
Date: Sat, 24 Feb 2024 13:10:27 GMT
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: no-cache

GET C1B705B7AD8D5B4C6.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 9C7F15704715916A9.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET E83D71A074DF776F4.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET F68DD4439278D0467.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 12C383965421BC56F.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 9ECBC8FFB535D0532.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET C1B705B7AD8D5B4C6.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET
H2 200 65319_1825202430.js Show response
p11.techlab-cdn.com/e/ 54 KB
18 KB 101ms
28ms Fetch
application/javascript 2a02:26f0:3100::1735:2a82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p11.techlab-cdn.com/e/65319_1825202430.js
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3100::1735:2a82 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 1762a6d546dfc49a32e2e4b2caefb01368b948b0d137b4e03447e18e3119c65a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
content-encoding: gzip
last-modified: Mon, 04 Dec 2023 13:18:33 GMT
content-md5: rUBDMtkKPwbICzxwW6Zmug==
etag: 0x8DBF4CB84416B0B
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
timing-allow-origin: *
content-length: 18224
expires: Sat, 24 Feb 2024 13:20:29 GMT

GET
H2 200 65257_1825232097.js Show response
p11.techlab-cdn.com/e/ 14 KB
6 KB 129ms
56ms Fetch
application/javascript 2a02:26f0:3100::1735:2a82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p11.techlab-cdn.com/e/65257_1825232097.js
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3100::1735:2a82 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 74a7a53097f5335e794968f4f7c27d089701fd635c8698c5f5fda7f30356cacb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
content-encoding: gzip
last-modified: Thu, 01 Dec 2022 12:38:55 GMT
content-md5: 7rdGFe+/Y2zHt4sXxqkzxw==
etag: 0x8DAD39902829531
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
timing-allow-origin: *
content-length: 6061
expires: Sat, 24 Feb 2024 13:20:29 GMT

GET
H2 200 64885_1825202523.js Show response
p11.techlab-cdn.com/e/ 3 KB
2 KB 100ms
27ms Fetch
application/javascript 2a02:26f0:3100::1735:2a82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p11.techlab-cdn.com/e/64885_1825202523.js
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3100::1735:2a82 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 422aa4e7ba5ff626a830dbbee358cb5055122a03b5c36b5f7608e1b34999e529

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
content-encoding: gzip
last-modified: Sun, 24 Apr 2022 12:00:07 GMT
content-md5: DnvBZTKTbXGPNtxH2P6zMg==
etag: "0x8DA25E9F9A41165"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
accept-ranges: bytes
timing-allow-origin: *
content-length: 1470
expires: Sat, 24 Feb 2024 13:20:29 GMT

GET
H2 200 65226_747628217.js Show response
p11.techlab-cdn.com/e/ 70 KB
33 KB 120ms
47ms Fetch
application/javascript 2a02:26f0:3100::1735:2a82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p11.techlab-cdn.com/e/65226_747628217.js
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3100::1735:2a82 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 4e5abd4a0506bb0c5426fddde67167e2f86cdad465d7fb77ce459988d26964ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
content-encoding: gzip
last-modified: Thu, 07 Dec 2023 21:28:41 GMT
content-md5: FfPxnOXyJHEeTjF3kZAIQQ==
etag: 0x8DBF76B7C0E97C7
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
timing-allow-origin: *
content-length: 33072
expires: Sat, 24 Feb 2024 13:20:29 GMT

GET
H2 200 ent-unified-logon-web.js Show response
tags.tiqcdn.com/dle/usaa/nw/ 273 B
661 B 25ms
25ms Script
application/javascript 2600:9000:26db:d000:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/dle/usaa/nw/ent-unified-logon-web.js
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26db:d000:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 12823479e57e579d5eb7af45a060336db24bfb84bf0af53a1099d6ca016973f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 12:13:59 GMT
via: 1.1 03d32b94cb61a4fdb1e546e888f089e4.cloudfront.net (CloudFront)
last-modified: Tue, 24 Nov 2020 19:54:16 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P3
age: 3518
x-amz-server-side-encryption: AES256
etag: "1a6e4c1aade1d02a22faec181b827e84"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 273
x-amz-cf-id: fysoQIESKJTHEBojHJYHo12y8zH2Uo3UfnK9a_iNpaYikcG_l8JxhQ==

GET E83D71A074DF776F4.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 12C383965421BC56F.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 9ECBC8FFB535D0532.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET
H2 200 id Show response
da.usaa.com/ 2 B
291 B 205ms
196ms XHR
application/x-javascript 23.212.210.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://da.usaa.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=47977B2A53A852210A490D45%40AdobeOrg&mid=91054898338661313266057115680221826514&d_coppa=true&ts=1708780229283

Requested by

Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.210.218 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-210-218.deploy.static.akamaitechnologies.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
server: jag
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 2
x-xss-protection: 1; mode=block

GET F68DD4439278D0467.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 9C7F15704715916A9.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET
H2 200 / Show response
api.ipify.org/ 22 B
155 B 186ms
163ms XHR
application/json 172.67.74.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb3e6805c49a69e254692f39973f90dafe0e09cdc7684770962a8688c97f8879

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 13:10:29 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: application/json
access-control-allow-origin: *
cf-ray: 85a7f2f458371ad7-FRA
content-length: 22

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USAA (Banking)

44 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.agkn.com/	1970-01-21 03:25:16	Name: ab Value: 0001%3Awrhmv6Jwb7EEYcruYA53nc6HPTVIbz%2BQ
.agkn.com/	1970-01-21 03:25:16	Name: u Value: C\|0CAAtbKdELWynRAAAAAAAATNdCAAAAA
.pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/	1969-12-31 23:59:59	Name: PIM-SESSION-ID Value: LCDcZlIKRgd1Mt94
.pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/	1969-12-31 23:59:59	Name: AMCVS_47977B2A53A852210A490D45%40AdobeOrg Value: 1
.pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/	1970-01-21 04:15:40	Name: AMCV_47977B2A53A852210A490D45%40AdobeOrg Value: 1585540135%7CMCMID%7C91054898338661313266057115680221826514%7CMCAID%7CNONE%7CMCOPTOUT-1708787429s%7CNONE%7CvVersion%7C4.4.0

28 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html(Line 47) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html(Line 47) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/my/logon/ent-unified-logon-web.daae48898ca3ca520b1d.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/8vKkY0CQQRVH/qD/QCN8X5Jjek/upaGXDXtLh/ER9YcQE/Q2t/5PRVYfRE Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
content.usaa.com
d.agkn.com
da.usaa.com
p11.techlab-cdn.com
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
tags.tiqcdn.com
tms.usaa.com
www.usaa.com
content.usaa.com
172.67.74.152
184.31.88.123
23.212.210.218
2600:9000:26db:d000:7:2bfb:7c00:93a1
2606:4700::6812:323
2a00:1450:4001:82f::200a
2a02:26f0:3100::1735:2a82
3.67.108.235
05de608f0d5842c448775cf281a36d7b13429dcd4e98bc6e6a5031d69e926f29
12823479e57e579d5eb7af45a060336db24bfb84bf0af53a1099d6ca016973f2
155f16475e8a93c318814bf4fe5305e66a1ae866ac74e3fceed9343d527d1f7b
1762a6d546dfc49a32e2e4b2caefb01368b948b0d137b4e03447e18e3119c65a
368a97b6ef5e5696f8a482804eb49982c121445d9bf5b80bf619e0d82fa371a7
422aa4e7ba5ff626a830dbbee358cb5055122a03b5c36b5f7608e1b34999e529
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4e5abd4a0506bb0c5426fddde67167e2f86cdad465d7fb77ce459988d26964ca
52a1d0f52f460e327988c355867521b4de4af61472d94935afb22dd20cfea935
74a7a53097f5335e794968f4f7c27d089701fd635c8698c5f5fda7f30356cacb
83715cbbb065ced28d5098b14e7fe6b7b42d830a733f5813a71ec67cd22535e7
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
89dc993c24812f699d75b2060b70703f66b895b92d01f944ed33739f17ffb978
961854498fae2a8b5e1a81928529e4324eb96aa647e79a150c10502570e329ee
96f6aae9b5454059ad7e99847fe96a9f05b85230206e234aa7e7059aff6c2d62
9809e4b1eae0adde161b5ce78d609ee67bfdd8013d018bf5858ada601d45d134
bb3e6805c49a69e254692f39973f90dafe0e09cdc7684770962a8688c97f8879
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6f451434f9a09dc6b7ffbe8d273bd983955c9ab483440c7e58dce8f714e6229

pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev Open in urlscan Pro 2606:4700::6812:323 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

34 Requests

62 %HTTPS

50 %IPv6

7 Domains

10 Subdomains

9 IPs

2 Countries

542 kBTransfer

1463 kBSize

5 Cookies

4 Outgoing links

Page URL History

Redirected requests

34 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

44 JavaScript Global Variables

5 Cookies

28 Console Messages

Indicators

pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev Open in urlscan Pro
2606:4700::6812:323 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

34
Requests

62 %
HTTPS

50 %
IPv6

7
Domains

10
Subdomains

9
IPs

2
Countries

542 kB
Transfer

1463 kB
Size

5
Cookies

34 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!