www.hgps.edu.hk
Open in
urlscan Pro
113.28.114.210
Malicious Activity!
Public Scan
URL:
http://www.hgps.edu.hk/modules/poll/secure/www.usaa.com/inet/ent_logon/Logon/security.php
Submission: On June 06 via automatic, source openphish
Submission: On June 06 via automatic, source openphish
Summary
This website contacted 3 IPs
in 1 countries
across 2 domains to perform 8 HTTP transactions.
The main IP is 113.28.114.210, located in
Hong Kong and
belongs to ERX-STAR HKT Limited, HK.
The main domain is www.hgps.edu.hk.
This is the only time www.hgps.edu.hk was scanned on urlscan.io!
This is the only time www.hgps.edu.hk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USAA (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 113.28.114.210 113.28.114.210 | 4515 (ERX-STAR ...) (ERX-STAR HKT Limited) | |
| 1 | () () | ||
| 8 | 3 |
1
113.28.114.210
(Hong Kong)
ASN4515 (ERX-STAR HKT Limited, HK)
PTR: mail.hgps.edu.hk
ASN4515 (ERX-STAR HKT Limited, HK)
PTR: mail.hgps.edu.hk
| www.hgps.edu.hk |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
hgps.edu.hk
www.hgps.edu.hk |
397 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 8 | 2 |
| Domain | Requested by | |
|---|---|---|
| 2 | www.hgps.edu.hk |
www.hgps.edu.hk
|
| 0 | localhost Failed |
www.hgps.edu.hk
|
| 8 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.usaa.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 3 frames:
Primary Page:
http://www.hgps.edu.hk/modules/poll/secure/www.usaa.com/inet/ent_logon/Logon/security.php
Frame ID: 278A10C07F6B401412DF0506FE59D22B
Requests: 24 HTTP requests in this frame
Frame:
data://truncated
Frame ID: 569A3B47578A5833719EA145819720E8
Requests: 1 HTTP requests in this frame
Frame:
blob://http://www.hgps.edu.hk/6f570edd-cb5a-432d-b655-0ca8e2507e26
Frame ID: FC31C739E2A41C542AE5FDD6AE5702FF
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
CentOS
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /CentOS/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
17 Outgoing links
These are links going to different origins than the main page.
URL: https://www.usaa.com/inet/ent_home/CpHome?action=INIT&wa_ref=pri_auth_nav_Icon
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/investments?wa_ref=pri_global_products_invest
Title: Investing
Title: Investing
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/bank-real-estate-mortgage-loans?wa_ref=pri_global_products_realestate
Title: Real Estate
Title: Real Estate
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/investments-retirement?wa_ref=pri_global_products_retire
Title: Retirement and IRAs
Title: Retirement and IRAs
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/insurance-health-insurance-main?amp;wa_ref=pri_global_products_health
Title: Health Insurance
Title: Health Insurance
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/shopping_and_discounts_main?wa_ref=pri_global_products_discounts
Title: Shopping & Discounts
Title: Shopping & Discounts
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/advice-about-protection?wa_ref=pri_global_lifeevents_disasterrecovery
Title: Disaster & Recovery
Title: Disaster & Recovery
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/advice_planners_and_calculators_main?wa_ref=pri_global_lifeevents_calculators
Title: Planners & Calculators
Title: Planners & Calculators
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pc_claims_ext/PcClaimsHome?action=INIT&wa_ref=pri_global_tools_claims_viewall
Title: View All Claims
Title: View All Claims
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/directToRep/directToRepPage/
Title: Get Connected (Opens Pop-up Layer)
Title: Get Connected (Opens Pop-up Layer)
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/ent_messagehub/MessageCenterMainPage/MessageCenterMainPage?action=INIT&wa_ref=pri_gnb_envelopeicon
Title: Inbox
Title: Inbox
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/ent_logoff/Logoff?action=INIT&wa_ref=pri_auth_nav_logoffs
Title: Log Off
Title: Log Off
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/global-community-bar-fb-redirect?wa_ref=global_socialbar_footer_facebook
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/global-community-bar-tw-redirect?wa_ref=global_socialbar_footer_twitter
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/global-community-bar-yt-redirect?wa_ref=global_socialbar_footer_youtube
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/usaa_social_main?wa_ref=global_socialbar_footer_more
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/security_online_information_gathering
Title: About Our Ads
Title: About Our Ads
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
security.php
www.hgps.edu.hk/modules/poll/secure/www.usaa.com/inet/ent_logon/Logon/ |
396 KB 397 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
27 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
11 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
228 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
229 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
347 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
598 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
386 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
438 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
496 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame 569A |
440 B 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
548 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET BLOB |
6f570edd-cb5a-432d-b655-0ca8e2507e26
http://www.hgps.edu.hk/ Frame FC31 |
29 B 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- localhost
- URL
- blob:http://localhost/4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
- Domain
- localhost
- URL
- blob:http://localhost/03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
- Domain
- localhost
- URL
- blob:http://localhost/03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
- Domain
- localhost
- URL
- blob:http://localhost/03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
- Domain
- localhost
- URL
- blob:http://localhost/4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
- Domain
- localhost
- URL
- blob:http://localhost/4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USAA (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| savepage_PageLoader function| validateForm0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
localhost
www.hgps.edu.hk
localhost
113.28.114.210
09fe494df49bb50492a87d2670d9839f3f4220f300b146809d36b7e805db52a3
0deb9be54a4aa9378715cb98c0249fb987a1f28ee587145962330b5cabb145a0
148407c00960f8321a6d638e8a8bbc3e1da42b1a248b2d1ffd7022d25c0faa2e
57f6b907c5b01109015edfa8462da6fc3df2c02d2b1dfba84d8617ffcb82f459
5f37758ffd7d456a020ad4400fbb49598ce23e634add3d6704ab69973bc823df
6920b95f2b38b405f9932005eb14a44556c32fec22efb5d7a58e22f959a13282
6e479fd2d8ce4cfddd29f9fb809ea5e1aa9b65ff472c39950b3874a265754de0
8787da31ff9af74162852c58126e6a8fad1838041ae1e47f460d62830f297ac0
ad5980cb9d5ad82571e49366d26c086e2c2bbe7efe6feb729c12f9594948ba21
c9f4a580494365cddc8105e91fd47b03befa8ff569bd10ed24458f3b4c56de04
d1886043ac668fcd2ccb7019ba9b35ef16f7d0c3db9d9dedf3862b036a4ae2d3
d317c2e6324cdd35249a3d5b6370b68d5b018fdddecc1dec0b9660f2affff0bd
d5943a74aff051f920e7f45b07f0aa23dd53d1f24b308a496b623a1475ef0424
d815893ea34e5805c4cfb5e497b666f690fa80a5153bb757437bf6bfd3abb47c
ddaa6ef7466b6e224c834f62c39b381044760a5fe06238ba09b3a0b1a5e6525c
e2e04a8e937f5b74a4c50cb7592a8e0bba54b40818d44e43ffd5c40c6b4fe72a
e71a48d99cc509ca0d2108ccfec7802c98f41a37b772c1ebb034374fa84909fa
e9a681648676dcb7d958f77bed911c7a8a30dabe8ef0265b5ee894205c8aef60
f212dbf3c06020a2e9e2a309ce0acc0c91f1f5a15bc66a9c4ecb01974123f095
fda9dc9b1feb432da051add9ca8ccdcdedfe460e5e1be4df5f3d17e0bde69c87