pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://worker-odd-rice-60ab.anniesusskind8.workers.dev/
Effective URL:
https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Submission: On January 24 via manual (January 24th 2024, 7:09:21 am UTC) from HU — Scanned from GB

Summary HTTP 37 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 10 IPs in 2 countries across 8 domains to perform 37 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev.
TLS certificate: Issued by E1 on December 9th 2023. Valid for: 3 months.

This is the only time pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USAA (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3037::6815:f59	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6812:223	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	184.31.88.185 184.31.88.185	16625 (AKAMAI-AS) (AKAMAI-AS)
7	23.37.36.242 23.37.36.242	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:25a... 2600:9000:25a2:200:7:2bfb:7c00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
1	3.74.101.164 3.74.101.164	16509 (AMAZON-02) (AMAZON-02)
5	2a02:26f0:350... 2a02:26f0:3500:18::1724:a28e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	64.185.227.156 64.185.227.156	18450 (WEBNX) (WEBNX)
37	10

1 2606:4700:3037::6815:f59 (United States)

ASN13335 (CLOUDFLARENET, US)

worker-odd-rice-60ab.anniesusskind8.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 184.31.88.185 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-88-185.deploy.static.akamaitechnologies.com

www.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 23.37.36.242 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-36-242.deploy.static.akamaitechnologies.com

tms.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
da.usaa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:25a2:200:7:2bfb:7c00:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.74.101.164 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-74-101-164.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:3500:18::1724:a28e (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p11.techlab-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.185.227.156 (New York, United States)

ASN18450 (WEBNX, US)
PTR: api.ipify.org

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	usaa.com 1 redirects www.usaa.com — Cisco Umbrella Rank: 43283 tms.usaa.com — Cisco Umbrella Rank: 35038 content.usaa.com Failed da.usaa.com — Cisco Umbrella Rank: 34856	327 KB
5	techlab-cdn.com p11.techlab-cdn.com — Cisco Umbrella Rank: 3589	64 KB
4	r2.dev pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev	123 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2768	222 B
1	agkn.com d.agkn.com — Cisco Umbrella Rank: 776	759 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 369	85 KB
1	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1194	673 B
1	workers.dev worker-odd-rice-60ab.anniesusskind8.workers.dev	2 KB
37	8

	Domain	Requested by
6	tms.usaa.com	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
5	p11.techlab-cdn.com	www.usaa.com
4	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev	worker-odd-rice-60ab.anniesusskind8.workers.dev pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
3	www.usaa.com	1 redirects pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
1	api.ipify.org	www.usaa.com
1	da.usaa.com	www.usaa.com
1	d.agkn.com	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
1	ajax.googleapis.com	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
1	tags.tiqcdn.com	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
1	worker-odd-rice-60ab.anniesusskind8.workers.dev
0	content.usaa.com Failed	pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
37	11

This site contains links to these domains. Also see Links.

Domain
www.usaa.com

Subject Issuer	Validity	Valid
anniesusskind8.workers.dev GTS CA 1P5	`2023-12-05` - `2024-03-04`	3 months	crt.sh
*.r2.dev E1	`2023-12-09` - `2024-03-08`	3 months	crt.sh
www.usaa.com DigiCert EV RSA CA G2	`2023-10-11` - `2024-05-20`	7 months	crt.sh
da.usaa.com DigiCert EV RSA CA G2	`2023-07-19` - `2024-08-18`	a year	crt.sh
tags.tiqcdn.com Amazon RSA 2048 M01	`2023-04-18` - `2024-05-17`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-02` - `2024-03-26`	3 months	crt.sh
*.agkn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2023-09-07` - `2024-09-29`	a year	crt.sh
p11.techlab-cdn.com R3	`2024-01-18` - `2024-04-17`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Frame ID: 4FD64071EC18E498A85C5F540A9D07F2
Requests: 34 HTTP requests in this frame

Frame: https://d.agkn.com/iframe/9297/?amcid=32262987562682621898658789104096920213&type=1000&che=0.6300761500650991
Frame ID: 42ADFCE1C83FCD0610749AA03EDAF4E3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Member Account Login | USAAUSAA logo. Redirects to USAA home. USAA logousaa-symbol-laurel

Page URL History Show full URLs

https://worker-odd-rice-60ab.anniesusskind8.workers.dev/ Page URL
https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Page URL

Detected technologies

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

37
Requests

59 %
HTTPS

56 %
IPv6

8
Domains

11
Subdomains

10
IPs

2
Countries

601 kB
Transfer

1470 kB
Size

5
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.usaa.com/
Title: USAA logo. Redirects to USAA home. USAA logo

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/wc/security_center?0&wa_ref=logon_jump_security_center
Title: Security Center

Search URL Search Domain Scan URL

URL: https://www.usaa.com/privacy
Title: Privacy Center

Search URL Search Domain Scan URL

URL: https://www.usaa.com/inet/pages/accessibility_at_usaa_main?wa_ref=pub_subglobal_footer_accessibility
Title: Accessibility at USAA

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://worker-odd-rice-60ab.anniesusskind8.workers.dev/ Page URL
https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js HTTP 302
https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js?akredirect=true

37 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 /
worker-odd-rice-60ab.anniesusskind8.workers.dev/ 3 KB
2 KB 165ms
50ms Document
text/html 2606:4700:3037::6815:f59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://worker-odd-rice-60ab.anniesusskind8.workers.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:f59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-ray: 84a673163fe135dc-LHR
content-encoding: br
content-type: text/html;charset=UTF-8
date: Wed, 24 Jan 2024 07:09:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=21V%2B5Xo6cZQCtji6rYsk2i2A7JRGB5ZaOkNr%2FMNrHJpihZ3STdR4YCmYmMEwqmtx1loWuql0Lulw8yDONlBvrcbCcdplwtea7Y%2BMiLoTMwtJY5kg0%2F5ZzjzsXx3xfZRzqON2jgqPm%2FU9q91PoL68EU3A84VGQiisDjB6Z1avLPF5kLeHeNd%2BI2bbGWG6QA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK Primary Request index.html Show response
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/ 16 KB
17 KB 3851ms
352ms Document
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Requested by: Host: worker-odd-rice-60ab.anniesusskind8.workers.dev
URL: https://worker-odd-rice-60ab.anniesusskind8.workers.dev/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83715cbbb065ced28d5098b14e7fe6b7b42d830a733f5813a71ec67cd22535e7

Request headers

Referer: https://worker-odd-rice-60ab.anniesusskind8.workers.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Accept-Ranges: bytes
CF-RAY: 84a6732c8ffd3699-LHR
Connection: keep-alive
Content-Length: 16872
Content-Type: text/html
Date: Wed, 24 Jan 2024 07:09:15 GMT
ETag: "300a48576e7f4bb1835ed1dacef6bd32"
Last-Modified: Fri, 19 Jan 2024 22:57:51 GMT
Server: cloudflare
Vary: Accept-Encoding

GET
H2 200 43b1988e1728f7041b7be65970c00a98968411a756c2e Show response
www.usaa.com/resources/ 153 KB
57 KB 268ms
68ms Script
application/javascript 184.31.88.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.31.88.185 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-31-88-185.deploy.static.akamaitechnologies.com

Software

USAA-Honesty /

Resource Hash

368a97b6ef5e5696f8a482804eb49982c121445d9bf5b80bf619e0d82fa371a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
content-md5: nZDKa/+ZxrKCSjOs2XHoug==
x-ref-id: 0.e5e22517.1706080156.1841fc91
server-timing: edge;desc=1841fc91
content-length: 57283
last-modified: Sat, 20 Jan 2024 03:37:12 GMT
server: USAA-Honesty
etag: 0x8DC1969169E7FD8
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
timing-allow-origin: *
expires: Wed, 24 Jan 2024 07:19:16 GMT

GET
H/1.1 200
OK style.css
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/style/ 106 KB
106 KB 145ms
144ms Stylesheet
text/plain 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/style/style.css
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89dc993c24812f699d75b2060b70703f66b895b92d01f944ed33739f17ffb978

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 24 Jan 2024 07:09:16 GMT
Last-Modified: Fri, 19 Jan 2024 22:57:55 GMT
Server: cloudflare
ETag: "d9a0ca73c773e9955b3e313410b2533c"
Vary: Accept-Encoding
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 84a6732eba313699-LHR
Content-Length: 108036

GET
H2 200 utag.js Show response
tms.usaa.com/nw/prod/ 300 KB
67 KB 270ms
77ms Script
application/x-javascript 23.37.36.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.js

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.36.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-36-242.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

8020ff7e1d48a869262f37b61f10ee360c3693d3060b712faf0d833e9699ec5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 18 Jan 2024 16:46:47 GMT
server: AkamaiNetStorage
etag: "5626fd08f4562e063cdb92e7020e64bd:1705596407.142036"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
expires: Wed, 24 Jan 2024 07:39:16 GMT

GET
H2 200 ent-unified-logon-web.js Show response
tags.tiqcdn.com/dle/usaa/nw/ 273 B
673 B 204ms
60ms Script
application/javascript 2600:9000:25a2:200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/dle/usaa/nw/ent-unified-logon-web.js
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25a2:200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 12823479e57e579d5eb7af45a060336db24bfb84bf0af53a1099d6ca016973f2

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:02:19 GMT
via: 1.1 179ba4c3ce59451c080c2ed7517bcb96.cloudfront.net (CloudFront)
last-modified: Tue, 24 Nov 2020 19:54:16 GMT
server: AmazonS3
x-amz-cf-pop: ZRH55-P1
age: 418
x-amz-server-side-encryption: AES256
etag: "1a6e4c1aade1d02a22faec181b827e84"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 273
x-amz-cf-id: 7tVkGvXZZGb3L2hTY-i3jpu77_WuHyQSNs8gFgXCWR0LXbOEAvdd2Q==

GET
H2 200 utag.318.js Show response
tms.usaa.com/nw/prod/ 490 KB
148 KB 732ms
539ms Script
application/x-javascript 23.37.36.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.318.js?utv=ut4.46.202312071647

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.36.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-36-242.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

364eb6f10f8e64c87b216f28b2ac3eef1baf0d37cc7d7a514f83eb723224fb2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 18 Jan 2024 16:46:43 GMT
server: AkamaiNetStorage
etag: "3cc194455cdb0cfe938b33be35cef200:1705596403.254942"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
expires: Wed, 24 Jan 2024 07:39:16 GMT

GET
H2 200 utag.233.js Show response
tms.usaa.com/nw/prod/ 140 KB
44 KB 600ms
408ms Script
application/x-javascript 23.37.36.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.233.js?utv=ut4.46.202312141522

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.36.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-36-242.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

d57d87878b12462132f3e78afab8011c18defd160aa8256869d0439e723f679e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 18 Jan 2024 16:46:41 GMT
server: AkamaiNetStorage
etag: "7eb67f2df722809c4d619d181e4ccd6b:1705596400.984698"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
expires: Wed, 24 Jan 2024 07:39:16 GMT

GET
H2 200 utag.480.js Show response
tms.usaa.com/nw/prod/ 20 KB
6 KB 711ms
519ms Script
application/x-javascript 23.37.36.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.480.js?utv=ut4.46.202312071647

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.36.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-36-242.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

7d60b7c5b0e4db0479795bdc7911d913e00f096d712dabac840f83195b6edaa6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 18 Jan 2024 16:46:42 GMT
server: AkamaiNetStorage
etag: "4a4d45e9a174566fd860af3d18f98223:1705596402.814372"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
content-length: 5936
expires: Wed, 24 Jan 2024 07:39:16 GMT

GET
H2 200 utag.327.js Show response
tms.usaa.com/nw/prod/ 4 KB
2 KB 758ms
565ms Script
application/x-javascript 23.37.36.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.327.js?utv=ut4.46.202312071647

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.36.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-36-242.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

f53d1d2636079288713b205f1eb88e5e301529d65697f3d80de5a4b6440b4890

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 18 Jan 2024 16:46:42 GMT
server: AkamaiNetStorage
etag: "3fb4a5110c68f6a66be8eb001933f385:1705596402.679088"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
content-length: 1613
expires: Wed, 24 Jan 2024 07:39:16 GMT

GET
H2 200 utag.495.js Show response
tms.usaa.com/nw/prod/ 4 KB
2 KB 589ms
397ms Script
application/x-javascript 23.37.36.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tms.usaa.com/nw/prod/utag.495.js?utv=ut4.46.202312071647

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.36.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-36-242.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

08a85a610a356820762bc5fa0f30fd84d6c4a3a9b79b95be00c9fc79e7d6533f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 18 Jan 2024 16:46:40 GMT
server: AkamaiNetStorage
etag: "975e7c1099095ae60c72ac2d5eedae5b:1705596400.098467"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1800
accept-ranges: bytes
content-length: 1877
expires: Wed, 24 Jan 2024 07:39:16 GMT

GET
H2

200

react!react-dom.min.js Show response
www.usaa.com/utils/externals/react!react-dom/17.0.2/
Redirect Chain

https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js
https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js?akredirect=true

0
0

684ms
684ms

Script
text/html

184.31.88.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js?akredirect=true
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: H2
Server: 184.31.88.185 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-88-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Redirect headers

date: Wed, 24 Jan 2024 07:09:16 GMT
strict-transport-security: max-age=31536000
server: USAA-Loyalty
location: https://www.usaa.com/utils/externals/react!react-dom/17.0.2/react!react-dom.min.js?akredirect=true
x-ref-id: 0.e5e22517.1706080156.1841fc90
cache-control: max-age=2592000
server-timing: edge;desc=1841fc90
content-length: 0
expires: Fri, 23 Feb 2024 07:09:16 GMT

GET
H/1.1 404
Not Found ent-unified-logon-web.daae48898ca3ca520b1d.js
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/my/logon/ 0
0 97ms
97ms Script
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/my/logon/ent-unified-logon-web.daae48898ca3ca520b1d.js
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 24 Jan 2024 07:09:16 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 84a6732ebc70414c-LHR
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

GET
H/1.1 404
Not Found 5PRVYfRE
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/8vKkY0CQQRVH/qD/QCN8X5Jjek/upaGXDXtLh/ER9YcQE/Q2t/ 0
0 429ms
341ms Script
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/8vKkY0CQQRVH/qD/QCN8X5Jjek/upaGXDXtLh/ER9YcQE/Q2t/5PRVYfRE
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 24 Jan 2024 07:09:16 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 84a6732f49226517-LHR
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 85 KB
85 KB 167ms
54ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 19:21:21 GMT
x-content-type-options: nosniff
age: 42475
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86659
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Jan 2025 19:21:21 GMT

GET
H/1.1 200 / Show response
d.agkn.com/iframe/9297/ Frame 42AD 223 B
759 B 231ms
60ms Document
text/html 3.74.101.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.agkn.com/iframe/9297/?amcid=32262987562682621898658789104096920213&type=1000&che=0.6300761500650991
Requested by: Host: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.74.101.164 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-74-101-164.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 52a1d0f52f460e327988c355867521b4de4af61472d94935afb22dd20cfea935

Request headers

Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 223
Content-Type: text/html;charset=UTF-8
Date: Wed, 24 Jan 2024 07:09:15 GMT
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: no-cache

GET C1B705B7AD8D5B4C6.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 9C7F15704715916A9.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET E83D71A074DF776F4.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET F68DD4439278D0467.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 12C383965421BC56F.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 9ECBC8FFB535D0532.woff2
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET
H2 200 65319_1825202430.js Show response
p11.techlab-cdn.com/e/ 54 KB
18 KB 322ms
135ms Fetch
application/javascript 2a02:26f0:3500:18::1724:a28e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p11.techlab-cdn.com/e/65319_1825202430.js
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:18::1724:a28e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 1762a6d546dfc49a32e2e4b2caefb01368b948b0d137b4e03447e18e3119c65a

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
last-modified: Mon, 04 Dec 2023 13:18:33 GMT
content-md5: rUBDMtkKPwbICzxwW6Zmug==
etag: 0x8DBF4CB84416B0B
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
timing-allow-origin: *
content-length: 18224
expires: Wed, 24 Jan 2024 07:19:16 GMT

GET
H2 200 65257_1825232097.js Show response
p11.techlab-cdn.com/e/ 14 KB
6 KB 316ms
130ms Fetch
application/javascript 2a02:26f0:3500:18::1724:a28e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p11.techlab-cdn.com/e/65257_1825232097.js
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:18::1724:a28e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 74a7a53097f5335e794968f4f7c27d089701fd635c8698c5f5fda7f30356cacb

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
last-modified: Thu, 01 Dec 2022 12:38:55 GMT
content-md5: 7rdGFe+/Y2zHt4sXxqkzxw==
etag: 0x8DAD39902829531
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
timing-allow-origin: *
content-length: 6061
expires: Wed, 24 Jan 2024 07:19:16 GMT

GET
H2 200 64885_1825202523.js Show response
p11.techlab-cdn.com/e/ 3 KB
2 KB 309ms
123ms Fetch
application/javascript 2a02:26f0:3500:18::1724:a28e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p11.techlab-cdn.com/e/64885_1825202523.js
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:18::1724:a28e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 422aa4e7ba5ff626a830dbbee358cb5055122a03b5c36b5f7608e1b34999e529

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
last-modified: Sun, 24 Apr 2022 12:00:07 GMT
content-md5: DnvBZTKTbXGPNtxH2P6zMg==
etag: "0x8DA25E9F9A41165"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
accept-ranges: bytes
timing-allow-origin: *
content-length: 1470
expires: Wed, 24 Jan 2024 07:19:16 GMT

GET
H2 200 65226_747628217.js Show response
p11.techlab-cdn.com/e/ 70 KB
33 KB 247ms
60ms Fetch
application/javascript 2a02:26f0:3500:18::1724:a28e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p11.techlab-cdn.com/e/65226_747628217.js
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:18::1724:a28e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 4e5abd4a0506bb0c5426fddde67167e2f86cdad465d7fb77ce459988d26964ca

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
last-modified: Thu, 07 Dec 2023 21:28:41 GMT
content-md5: FfPxnOXyJHEeTjF3kZAIQQ==
etag: 0x8DBF76B7C0E97C7
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
timing-allow-origin: *
content-length: 33072
expires: Wed, 24 Jan 2024 07:19:16 GMT

GET
H2 200 64854_747627194.js Show response
p11.techlab-cdn.com/e/ 10 KB
5 KB 311ms
125ms Fetch
application/javascript 2a02:26f0:3500:18::1724:a28e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p11.techlab-cdn.com/e/64854_747627194.js
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:18::1724:a28e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d9a7a0785730dddd6dadb5ba12373a5c88821432af4b2668325864d31831aa4f

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
content-encoding: gzip
last-modified: Tue, 28 Nov 2023 13:47:46 GMT
content-md5: rA6gfvMJAI9fB69GIkQrtQ==
etag: 0x8DBF0189A789B64
vary: Accept-Encoding
access-control-allow-methods: GET, POST, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=600
timing-allow-origin: *
content-length: 4627
expires: Wed, 24 Jan 2024 07:19:16 GMT

GET F68DD4439278D0467.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 12C383965421BC56F.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 9ECBC8FFB535D0532.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET C1B705B7AD8D5B4C6.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET E83D71A074DF776F4.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET 9C7F15704715916A9.woff
content.usaa.com/mcontent/static_assets/Fonts/ 0
0

GET
H2 200 id Show response
da.usaa.com/ 2 B
291 B 123ms
115ms XHR
application/x-javascript 23.37.36.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://da.usaa.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=47977B2A53A852210A490D45%40AdobeOrg&mid=58776907428417967778307489775433013955&d_coppa=true&ts=1706080156570

Requested by

Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.37.36.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-37-36-242.deploy.static.akamaitechnologies.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 24 Jan 2024 07:09:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
server: jag
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 2
x-xss-protection: 1; mode=block

GET 5f9f46ee-acd7-43b4-be91-883a8b31a48b
https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/ Frame 0
0

GET
H/1.1 200
OK / Show response
api.ipify.org/ 22 B
222 B 349ms
110ms XHR
application/json 64.185.227.156
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: www.usaa.com
URL: https://www.usaa.com/resources/43b1988e1728f7041b7be65970c00a98968411a756c2e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 64.185.227.156 New York, United States, ASN18450 (WEBNX, US),
Reverse DNS: api.ipify.org
Software: nginx/1.25.1 /
Resource Hash: c0198ce329041bced9b0291d5e0ca0675cdf0a92a032faa0607ab87fedc47c22

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 24 Jan 2024 07:09:17 GMT
Server: nginx/1.25.1
Connection: keep-alive
Content-Length: 22
Vary: Origin
Content-Type: application/json

GET 34e915fc-313e-402a-9360-c42ff8116fb5
https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/ Frame 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff2

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff

Domain: content.usaa.com
URL: https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff

Domain: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: blob:https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/5f9f46ee-acd7-43b4-be91-883a8b31a48b

Domain: pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
URL: blob:https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/34e915fc-313e-402a-9360-c42ff8116fb5

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USAA (Banking)

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.agkn.com/	1970-01-21 02:40:16	Name: ab Value: 0001%3AH9zDZylGaiQTaXwLruvqpXoTGXgkUe8i
.agkn.com/	1970-01-21 02:40:16	Name: u Value: C\|0CAAtQ3QcLUN0HAAAAAAAATNdCAAAAA
.pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/	1969-12-31 23:59:59	Name: PIM-SESSION-ID Value: YIuMkLzUlpHZpCNO
.pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/	1969-12-31 23:59:59	Name: AMCVS_47977B2A53A852210A490D45%40AdobeOrg Value: 1
.pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/	1970-01-21 03:30:40	Name: AMCV_47977B2A53A852210A490D45%40AdobeOrg Value: 1585540135%7CMCMID%7C58776907428417967778307489775433013955%7CMCAID%7CNONE%7CMCOPTOUT-1706087356s%7CNONE%7CvVersion%7C4.4.0

26 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/my/logon/ent-unified-logon-web.daae48898ca3ca520b1d.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/8vKkY0CQQRVH/qD/QCN8X5Jjek/upaGXDXtLh/ER9YcQE/Q2t/5PRVYfRE Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff2' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/F68DD4439278D0467.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/12C383965421BC56F.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/9ECBC8FFB535D0532.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/C1B705B7AD8D5B4C6.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/E83D71A074DF776F4.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev/index.html Message: Access to font at 'https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff' from origin 'https://pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://content.usaa.com/mcontent/static_assets/Fonts/9C7F15704715916A9.woff Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
content.usaa.com
d.agkn.com
da.usaa.com
p11.techlab-cdn.com
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
tags.tiqcdn.com
tms.usaa.com
worker-odd-rice-60ab.anniesusskind8.workers.dev
www.usaa.com
content.usaa.com
pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev
184.31.88.185
23.37.36.242
2600:9000:25a2:200:7:2bfb:7c00:93a1
2606:4700:3037::6815:f59
2606:4700::6812:223
2a00:1450:4001:80b::200a
2a02:26f0:3500:18::1724:a28e
3.74.101.164
64.185.227.156
08a85a610a356820762bc5fa0f30fd84d6c4a3a9b79b95be00c9fc79e7d6533f
12823479e57e579d5eb7af45a060336db24bfb84bf0af53a1099d6ca016973f2
1762a6d546dfc49a32e2e4b2caefb01368b948b0d137b4e03447e18e3119c65a
364eb6f10f8e64c87b216f28b2ac3eef1baf0d37cc7d7a514f83eb723224fb2c
368a97b6ef5e5696f8a482804eb49982c121445d9bf5b80bf619e0d82fa371a7
422aa4e7ba5ff626a830dbbee358cb5055122a03b5c36b5f7608e1b34999e529
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4e5abd4a0506bb0c5426fddde67167e2f86cdad465d7fb77ce459988d26964ca
52a1d0f52f460e327988c355867521b4de4af61472d94935afb22dd20cfea935
74a7a53097f5335e794968f4f7c27d089701fd635c8698c5f5fda7f30356cacb
7d60b7c5b0e4db0479795bdc7911d913e00f096d712dabac840f83195b6edaa6
8020ff7e1d48a869262f37b61f10ee360c3693d3060b712faf0d833e9699ec5b
83715cbbb065ced28d5098b14e7fe6b7b42d830a733f5813a71ec67cd22535e7
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
89dc993c24812f699d75b2060b70703f66b895b92d01f944ed33739f17ffb978
c0198ce329041bced9b0291d5e0ca0675cdf0a92a032faa0607ab87fedc47c22
d57d87878b12462132f3e78afab8011c18defd160aa8256869d0439e723f679e
d9a7a0785730dddd6dadb5ba12373a5c88821432af4b2668325864d31831aa4f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f53d1d2636079288713b205f1eb88e5e301529d65697f3d80de5a4b6440b4890

pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev Open in urlscan Pro 2606:4700::6812:223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

37 Requests

59 %HTTPS

56 %IPv6

8 Domains

11 Subdomains

10 IPs

2 Countries

601 kBTransfer

1470 kBSize

5 Cookies

4 Outgoing links

Page URL History

Redirected requests

37 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

38 JavaScript Global Variables

5 Cookies

26 Console Messages

Indicators

pub-8ef151d2555e453a9fbd3629a18d5c8f.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

37
Requests

59 %
HTTPS

56 %
IPv6

8
Domains

11
Subdomains

10
IPs

2
Countries

601 kB
Transfer

1470 kB
Size

5
Cookies

37 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!