mail.usaa-update-meta-info.duckdns.org
Open in
urlscan Pro
162.240.150.198
Malicious Activity!
Public Scan
URL:
https://mail.usaa-update-meta-info.duckdns.org/
Submission: On January 03 via api from US — Scanned from US
Submission: On January 03 via api from US — Scanned from US
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 13 HTTP transactions.
The main IP is 162.240.150.198, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is mail.usaa-update-meta-info.duckdns.org.
TLS certificate: Issued by R3 on January 3rd 2024. Valid for: 3 months.
This is the only time mail.usaa-update-meta-info.duckdns.org was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 3rd 2024. Valid for: 3 months.
This is the only time mail.usaa-update-meta-info.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USAA (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 162.240.150.198 162.240.150.198 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 13 | 2 |
11
162.240.150.198
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-11230208.apet.org.br
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-11230208.apet.org.br
| mail.usaa-update-meta-info.duckdns.org |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
duckdns.org
mail.usaa-update-meta-info.duckdns.org |
360 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 13 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | mail.usaa-update-meta-info.duckdns.org |
mail.usaa-update-meta-info.duckdns.org
|
| 0 | bbpokcagpggnekcmamgdieebhpkjmljm Failed |
mail.usaa-update-meta-info.duckdns.org
|
| 13 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.usaa-update-meta-data.duckdns.org R3 |
2024-01-03 - 2024-04-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mail.usaa-update-meta-info.duckdns.org/
Frame ID: FFAEBBB0B7C6133411CF7956DABA5961
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Member Account Login | USAAUSAA logo. Redirects to USAA home. USAA logousaa-symbol-laurelDetected technologies
React
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <[^>]+data-react
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
mail.usaa-update-meta-info.duckdns.org/ |
83 KB 35 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ent-unified-logon-web.css
mail.usaa-update-meta-info.duckdns.org/assets/css/ |
104 KB 104 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
fonts.css
bbpokcagpggnekcmamgdieebhpkjmljm/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.7.1.min.js
mail.usaa-update-meta-info.duckdns.org/assets/js/ |
85 KB 86 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
fonts.css
bbpokcagpggnekcmamgdieebhpkjmljm/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.mask.min.js
mail.usaa-update-meta-info.duckdns.org/assets/js/ |
8 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.js
mail.usaa-update-meta-info.duckdns.org/assets/js/ |
9 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
C1B705B7AD8D5B4C6.woff2
mail.usaa-update-meta-info.duckdns.org/assets/fonts/ |
22 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
9C7F15704715916A9.woff2
mail.usaa-update-meta-info.duckdns.org/assets/fonts/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
E83D71A074DF776F4.woff2
mail.usaa-update-meta-info.duckdns.org/assets/fonts/ |
21 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
F68DD4439278D0467.woff2
mail.usaa-update-meta-info.duckdns.org/assets/fonts/ |
22 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
12C383965421BC56F.woff2
mail.usaa-update-meta-info.duckdns.org/assets/fonts/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
9ECBC8FFB535D0532.woff2
mail.usaa-update-meta-info.duckdns.org/assets/fonts/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- bbpokcagpggnekcmamgdieebhpkjmljm
- URL
- chrome-extension://bbpokcagpggnekcmamgdieebhpkjmljm/css/fonts.css
- Domain
- bbpokcagpggnekcmamgdieebhpkjmljm
- URL
- chrome-extension://bbpokcagpggnekcmamgdieebhpkjmljm/css/fonts.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USAA (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| USAA function| $ function| jQuery object| $jscomp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bbpokcagpggnekcmamgdieebhpkjmljm
mail.usaa-update-meta-info.duckdns.org
bbpokcagpggnekcmamgdieebhpkjmljm
162.240.150.198
008889d286feafdf1773721c82309aeef1573bc92096f12e43674ddaae27b1c6
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
3e5be0cc080184b53dd700c6bc6b899c48cedb58e4f282aee5926d5950149008
8ca92c098205eebe75921badb282e0219fba6b69f74f71a06afc6e4521462ecf
947dad01228bb6787ad0218540575dfafe48c76c0623fcb492b6d0b0cfc62e0b
9aefe402f281990f1e7f334b9d5f5f9641d37359ed3cc0c58cd7530cb5704936
9ea54106530de63a9c33d3eb5a43d7dd0051c1e876ee8be5b49b73601eb10f1b
b47c74b16a02f8df070e4bd91b1b542ba2765624e8ec56a59305a91559a83682
d0193e9e3b24aee9322f87e7bfe45fd81f3d8e7b14d1299bfbaadc568f85d4e8
dbcf49bfa4184ed509854e05cd53df0426b5ea1856f6f4aad1f93b2d355d7e1c
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a