www.hgps.edu.hk
Open in
urlscan Pro
113.28.114.210
Malicious Activity!
Public Scan
URL:
http://www.hgps.edu.hk/modules/poll/secure/www.usaa.com/inet/ent_logon/Logon/confirm.php
Submission: On June 06 via automatic, source openphish
Submission: On June 06 via automatic, source openphish
Summary
This website contacted 3 IPs
in 1 countries
across 2 domains to perform 8 HTTP transactions.
The main IP is 113.28.114.210, located in
Hong Kong and
belongs to ERX-STAR HKT Limited, HK.
The main domain is www.hgps.edu.hk.
This is the only time www.hgps.edu.hk was scanned on urlscan.io!
This is the only time www.hgps.edu.hk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USAA (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 113.28.114.210 113.28.114.210 | 4515 (ERX-STAR ...) (ERX-STAR HKT Limited) | |
| 1 | () () | ||
| 8 | 3 |
1
113.28.114.210
(Hong Kong)
ASN4515 (ERX-STAR HKT Limited, HK)
PTR: mail.hgps.edu.hk
ASN4515 (ERX-STAR HKT Limited, HK)
PTR: mail.hgps.edu.hk
| www.hgps.edu.hk |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
hgps.edu.hk
www.hgps.edu.hk |
389 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 8 | 2 |
| Domain | Requested by | |
|---|---|---|
| 2 | www.hgps.edu.hk |
www.hgps.edu.hk
|
| 0 | localhost Failed |
www.hgps.edu.hk
|
| 8 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.usaa.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 3 frames:
Primary Page:
http://www.hgps.edu.hk/modules/poll/secure/www.usaa.com/inet/ent_logon/Logon/confirm.php
Frame ID: 8F888658A85057AA22F93D7CE24C3B17
Requests: 24 HTTP requests in this frame
Frame:
data://truncated
Frame ID: 258D71D5A93CA609FD1642FFE5541484
Requests: 1 HTTP requests in this frame
Frame:
blob://http://www.hgps.edu.hk/55146b92-d51f-4172-bbfd-9443eaa14b9a
Frame ID: 77A5FB6A3CFE12F34338A0559ECCB960
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
CentOS
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /CentOS/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
16 Outgoing links
These are links going to different origins than the main page.
URL: https://www.usaa.com/inet/ent_home/CpHome?action=INIT&wa_ref=pri_auth_nav_Icon
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/investments?wa_ref=pri_global_products_invest
Title: Investing
Title: Investing
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/bank-real-estate-mortgage-loans?wa_ref=pri_global_products_realestate
Title: Real Estate
Title: Real Estate
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/investments-retirement?wa_ref=pri_global_products_retire
Title: Retirement and IRAs
Title: Retirement and IRAs
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/insurance-health-insurance-main?amp;wa_ref=pri_global_products_health
Title: Health Insurance
Title: Health Insurance
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/shopping_and_discounts_main?wa_ref=pri_global_products_discounts
Title: Shopping & Discounts
Title: Shopping & Discounts
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/advice-about-protection?wa_ref=pri_global_lifeevents_disasterrecovery
Title: Disaster & Recovery
Title: Disaster & Recovery
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/wc/advice_planners_and_calculators_main?wa_ref=pri_global_lifeevents_calculators
Title: Planners & Calculators
Title: Planners & Calculators
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pc_claims_ext/PcClaimsHome?action=INIT&wa_ref=pri_global_tools_claims_viewall
Title: View All Claims
Title: View All Claims
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/directToRep/directToRepPage/
Title: Get Connected (Opens Pop-up Layer)
Title: Get Connected (Opens Pop-up Layer)
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/ent_logoff/Logoff?action=INIT&wa_ref=pri_auth_nav_logoffs
Title: Log Off
Title: Log Off
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/global-community-bar-fb-redirect?wa_ref=global_socialbar_footer_facebook
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/global-community-bar-tw-redirect?wa_ref=global_socialbar_footer_twitter
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/global-community-bar-yt-redirect?wa_ref=global_socialbar_footer_youtube
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/usaa_social_main?wa_ref=global_socialbar_footer_more
Title:
Title:
Search URL Search Domain Scan URL
URL: https://www.usaa.com/inet/pages/security_online_information_gathering
Title: About Our Ads
Title: About Our Ads
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
confirm.php
www.hgps.edu.hk/modules/poll/secure/www.usaa.com/inet/ent_logon/Logon/ |
389 KB 389 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
27 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
11 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
228 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
229 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
347 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
598 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
386 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
438 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame 258D |
440 B 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
496 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
http://localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
548 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET BLOB |
55146b92-d51f-4172-bbfd-9443eaa14b9a
http://www.hgps.edu.hk/ Frame 77A5 |
29 B 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- localhost
- URL
- blob:http://localhost/4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
- Domain
- localhost
- URL
- blob:http://localhost/4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
- Domain
- localhost
- URL
- blob:http://localhost/03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
- Domain
- localhost
- URL
- blob:http://localhost/03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
- Domain
- localhost
- URL
- blob:http://localhost/03a5d267-b0dd-4f7b-a4b6-ccb488e60f2a
- Domain
- localhost
- URL
- blob:http://localhost/4620656a-d42a-42b6-b2e2-b8bc9aa91b8a
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USAA (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| savepage_PageLoader function| validateForm0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
localhost
www.hgps.edu.hk
localhost
113.28.114.210
09fe494df49bb50492a87d2670d9839f3f4220f300b146809d36b7e805db52a3
0deb9be54a4aa9378715cb98c0249fb987a1f28ee587145962330b5cabb145a0
148407c00960f8321a6d638e8a8bbc3e1da42b1a248b2d1ffd7022d25c0faa2e
3f59097c74654a1ad8dc3e7192c8d1d7fd4c09c723b61d3b285954935d94ad0f
5f37758ffd7d456a020ad4400fbb49598ce23e634add3d6704ab69973bc823df
6920b95f2b38b405f9932005eb14a44556c32fec22efb5d7a58e22f959a13282
6e479fd2d8ce4cfddd29f9fb809ea5e1aa9b65ff472c39950b3874a265754de0
8787da31ff9af74162852c58126e6a8fad1838041ae1e47f460d62830f297ac0
ad5980cb9d5ad82571e49366d26c086e2c2bbe7efe6feb729c12f9594948ba21
c9f4a580494365cddc8105e91fd47b03befa8ff569bd10ed24458f3b4c56de04
d1886043ac668fcd2ccb7019ba9b35ef16f7d0c3db9d9dedf3862b036a4ae2d3
d317c2e6324cdd35249a3d5b6370b68d5b018fdddecc1dec0b9660f2affff0bd
d5943a74aff051f920e7f45b07f0aa23dd53d1f24b308a496b623a1475ef0424
d815893ea34e5805c4cfb5e497b666f690fa80a5153bb757437bf6bfd3abb47c
ddaa6ef7466b6e224c834f62c39b381044760a5fe06238ba09b3a0b1a5e6525c
e2e04a8e937f5b74a4c50cb7592a8e0bba54b40818d44e43ffd5c40c6b4fe72a
e71a48d99cc509ca0d2108ccfec7802c98f41a37b772c1ebb034374fa84909fa
e9a681648676dcb7d958f77bed911c7a8a30dabe8ef0265b5ee894205c8aef60
f74734926a457cad485fecaa39c34581950ec1e472aae017b6a3743949310b0f
fda9dc9b1feb432da051add9ca8ccdcdedfe460e5e1be4df5f3d17e0bde69c87