www.hgps.edu.hk
Open in
urlscan Pro
113.28.114.210
Malicious Activity!
Public Scan
URL:
http://www.hgps.edu.hk/modules/poll/secure/www.usaa.com/inet/ent_logon/Logon/pin.php
Submission: On June 06 via automatic, source openphish
Submission: On June 06 via automatic, source openphish
Summary
This website contacted 3 IPs
in 1 countries
across 1 domains to perform 4 HTTP transactions.
The main IP is 113.28.114.210, located in
Hong Kong and
belongs to ERX-STAR HKT Limited, HK.
The main domain is www.hgps.edu.hk.
This is the only time www.hgps.edu.hk was scanned on urlscan.io!
This is the only time www.hgps.edu.hk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USAA (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 113.28.114.210 113.28.114.210 | 4515 (ERX-STAR ...) (ERX-STAR HKT Limited) | |
| 1 | () () | ||
| 4 | 3 |
1
113.28.114.210
(Hong Kong)
ASN4515 (ERX-STAR HKT Limited, HK)
PTR: mail.hgps.edu.hk
ASN4515 (ERX-STAR HKT Limited, HK)
PTR: mail.hgps.edu.hk
| www.hgps.edu.hk |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
hgps.edu.hk
www.hgps.edu.hk |
386 KB |
| 4 | 1 |
| Domain | Requested by | |
|---|---|---|
| 2 | www.hgps.edu.hk |
www.hgps.edu.hk
|
| 4 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.usaa.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 3 frames:
Primary Page:
http://www.hgps.edu.hk/modules/poll/secure/www.usaa.com/inet/ent_logon/Logon/pin.php
Frame ID: 1CB27E31C86734A09807EA3D65F4C55F
Requests: 20 HTTP requests in this frame
Frame:
data://truncated
Frame ID: F5077F9160B4935441285F8A4BF23205
Requests: 2 HTTP requests in this frame
Frame:
data://truncated
Frame ID: 5DDBE741E4DECAD7BD13D8CDDDAA2045
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
CentOS
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /CentOS/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
17 Outgoing links
These are links going to different origins than the main page.
URL: https://www.usaa.com/inet/ent_home/CpHome?action=INIT&wa_ref=pri_auth_nav_Icon
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/investments?wa_ref=pri_global_products_invest
Title: Investing
Title: Investing
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/bank-real-estate-mortgage-loans?wa_ref=pri_global_products_realestate
Title: Real Estate
Title: Real Estate
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/investments-retirement?wa_ref=pri_global_products_retire
Title: Retirement and IRAs
Title: Retirement and IRAs
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/insurance-health-insurance-main?amp;wa_ref=pri_global_products_health
Title: Health Insurance
Title: Health Insurance
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/shopping_and_discounts_main?wa_ref=pri_global_products_discounts
Title: Shopping & Discounts
Title: Shopping & Discounts
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/advice-about-protection?wa_ref=pri_global_lifeevents_disasterrecovery
Title: Disaster & Recovery
Title: Disaster & Recovery
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/advice_planners_and_calculators_main?wa_ref=pri_global_lifeevents_calculators
Title: Planners & Calculators
Title: Planners & Calculators
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pc_claims_ext/PcClaimsHome?action=INIT&wa_ref=pri_global_tools_claims_viewall
Title: View All Claims
Title: View All Claims
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/directToRep/directToRepPage/
Title: Get Connected (Opens Pop-up Layer)
Title: Get Connected (Opens Pop-up Layer)
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/ent_messagehub/MessageCenterMainPage/MessageCenterMainPage?action=INIT&wa_ref=pri_gnb_envelopeicon
Title: Inbox
Title: Inbox
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/ent_logoff/Logoff?action=INIT&wa_ref=pri_auth_nav_logoffs
Title: Log Off
Title: Log Off
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/global-community-bar-fb-redirect?wa_ref=global_socialbar_footer_facebook
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/global-community-bar-tw-redirect?wa_ref=global_socialbar_footer_twitter
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/global-community-bar-yt-redirect?wa_ref=global_socialbar_footer_youtube
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/usaa_social_main?wa_ref=global_socialbar_footer_more
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/security_online_information_gathering
Title: About Our Ads
Title: About Our Ads
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
pin.php
www.hgps.edu.hk/modules/poll/secure/www.usaa.com/inet/ent_logon/Logon/ |
385 KB 386 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
27 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame F507 |
262 B 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
11 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
228 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
229 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
598 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
386 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
438 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
347 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
496 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame 5DDB |
440 B 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET BLOB |
eaea474d-5640-49b8-8ba7-b262d2752e4c
http://www.hgps.edu.hk/ |
56 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET BLOB |
1d88f360-6b81-48d5-8702-a464ab3719be
http://www.hgps.edu.hk/ |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
548 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET BLOB |
46ce273a-a8db-4085-93cb-e2f75142a8c1
http://www.hgps.edu.hk/ Frame F507 |
262 B 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USAA (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| savepage_PageLoader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.hgps.edu.hk
113.28.114.210
09fe494df49bb50492a87d2670d9839f3f4220f300b146809d36b7e805db52a3
0deb9be54a4aa9378715cb98c0249fb987a1f28ee587145962330b5cabb145a0
148407c00960f8321a6d638e8a8bbc3e1da42b1a248b2d1ffd7022d25c0faa2e
2182511fcc93e1e3df3980343df4591db147251ce7f94f7034868a1b71e24087
522a5fe0b1921acbaa0925b2a50fa141b0719797d5c552ffc150415c7c44d23b
5f2b1213e027d2bbf5d39e53721245ab48199031a35b6e991f0cf434f05bcab5
5f37758ffd7d456a020ad4400fbb49598ce23e634add3d6704ab69973bc823df
6920b95f2b38b405f9932005eb14a44556c32fec22efb5d7a58e22f959a13282
6e479fd2d8ce4cfddd29f9fb809ea5e1aa9b65ff472c39950b3874a265754de0
70cc16695978690e74938cae7f3a5f0de6ee23b1837bddca169316c7001eecd7
8787da31ff9af74162852c58126e6a8fad1838041ae1e47f460d62830f297ac0
ad5980cb9d5ad82571e49366d26c086e2c2bbe7efe6feb729c12f9594948ba21
c9f4a580494365cddc8105e91fd47b03befa8ff569bd10ed24458f3b4c56de04
d1886043ac668fcd2ccb7019ba9b35ef16f7d0c3db9d9dedf3862b036a4ae2d3
d317c2e6324cdd35249a3d5b6370b68d5b018fdddecc1dec0b9660f2affff0bd
d5943a74aff051f920e7f45b07f0aa23dd53d1f24b308a496b623a1475ef0424
d815893ea34e5805c4cfb5e497b666f690fa80a5153bb757437bf6bfd3abb47c
ddaa6ef7466b6e224c834f62c39b381044760a5fe06238ba09b3a0b1a5e6525c
e2e04a8e937f5b74a4c50cb7592a8e0bba54b40818d44e43ffd5c40c6b4fe72a
e71a48d99cc509ca0d2108ccfec7802c98f41a37b772c1ebb034374fa84909fa
e9a681648676dcb7d958f77bed911c7a8a30dabe8ef0265b5ee894205c8aef60
fda9dc9b1feb432da051add9ca8ccdcdedfe460e5e1be4df5f3d17e0bde69c87