www.afcbe.dd-dns.de - urlscan.io

Summary

This website contacted 5 IPs in 1 countries across 4 domains to perform 4 HTTP transactions. The main IP is 45.42.200.36, located in Los Angeles, United States and belongs to AS40676, US. The main domain is www.afcbe.dd-dns.de.
TLS certificate: Issued by R3 on July 28th 2022. Valid for: 3 months.

This is the only time www.afcbe.dd-dns.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: America First Credit Union (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	23.21.31.78 23.21.31.78	14618 (AMAZON-AES) (AMAZON-AES)
1	45.42.200.36 45.42.200.36	40676 (AS40676) (AS40676)
1	216.51.43.116 216.51.43.116	17150 (AFCU) (AFCU)
1	206.81.136.154 206.81.136.154	17150 (AFCU) (AFCU)
1	23.3.115.229 23.3.115.229	16625 (AKAMAI-AS) (AKAMAI-AS)
4	5

1 23.21.31.78 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-21-31-78.compute-1.amazonaws.com

bit.do	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.42.200.36 (Los Angeles, United States)

ASN40676 (AS40676, US)
PTR: easinging.store

www.afcbe.dd-dns.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.51.43.116 (South Jordan, United States)

ASN17150 (AFCU, US)

secure.americafirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.81.136.154 (Ogden, United States)

ASN17150 (AFCU, US)

www.americafirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.3.115.229 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-3-115-229.deploy.static.akamaitechnologies.com

public.cobrowse.oraclecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	americafirst.com secure.americafirst.com — Cisco Umbrella Rank: 275685 www.americafirst.com — Cisco Umbrella Rank: 251817	64 KB
1	oraclecloud.com public.cobrowse.oraclecloud.com — Cisco Umbrella Rank: 10150	12 KB
1	dd-dns.de www.afcbe.dd-dns.de	9 KB
1	bit.do 1 redirects bit.do — Cisco Umbrella Rank: 250954	281 B
4	4

	Domain	Requested by
1	public.cobrowse.oraclecloud.com	www.afcbe.dd-dns.de
1	www.americafirst.com	www.afcbe.dd-dns.de
1	secure.americafirst.com	www.afcbe.dd-dns.de
1	www.afcbe.dd-dns.de
1	bit.do	1 redirects
4	5

This site contains links to these domains. Also see Links.

Domain
webaccess45.americafirst.com
www.americafirst.com
portal.hud.gov
www.ncua.gov

Subject Issuer	Validity	Valid
afcbe.dd-dns.de R3	`2022-07-28` - `2022-10-26`	3 months	crt.sh
secure.americafirst.com Sectigo RSA Organization Validation Secure Server CA	`2021-10-25` - `2022-10-25`	a year	crt.sh
www.americafirst.com Sectigo RSA Extended Validation Secure Server CA	`2022-01-27` - `2023-01-27`	a year	crt.sh
*.cobrowse.oraclecloud.com DigiCert SHA2 Secure Server CA	`2021-11-06` - `2022-11-08`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.afcbe.dd-dns.de/AFIN/indoor.html
Frame ID: F749985520BD6798AAEB1C52500B7434
Requests: 5 HTTP requests in this frame

Frame: https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=iygc1h43ow&version=20190514
Frame ID: B9F527FF770084FA2E8D3974C058DBB2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://bit.do/fU3MP HTTP 301
https://www.afcbe.dd-dns.de/AFIN/indoor.html Page URL

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

5
IPs

1
Countries

84 kB
Transfer

133 kB
Size

0
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://webaccess45.americafirst.com/auth/Enrollment
Title: Enroll now

Search URL Search Domain Scan URL

URL: https://webaccess45.americafirst.com/auth/ForgottenCredentials/Id
Title: Forgot user ID

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/contact/
Title: Contact us

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/disclosures/membership-agreement.cfm
Title: terms

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/contact/branches.html
Title: branch locator

Search URL Search Domain Scan URL

URL: http://portal.hud.gov/hudportal/HUD?src=/program_offices/fair_housing_equal_opp

Search URL Search Domain Scan URL

URL: https://www.ncua.gov/services/pages/share-insurance.aspx

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/disclosures/membership-agreement.cfm#privacyPolicy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/documents/marketing-email-opt-out.pdf
Title: Email Opt Out Procedure

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bit.do/fU3MP HTTP 301
https://www.afcbe.dd-dns.de/AFIN/indoor.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request indoor.html Show response
www.afcbe.dd-dns.de/AFIN/
Redirect Chain

http://bit.do/fU3MP
https://www.afcbe.dd-dns.de/AFIN/indoor.html

22 KB
9 KB

516ms
69ms

Document
text/html

45.42.200.36
AS40676

General

Check archive.org

Show headers Download Go to

Full URL: https://www.afcbe.dd-dns.de/AFIN/indoor.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.42.200.36 Los Angeles, United States, ASN40676 (AS40676, US),
Reverse DNS: easinging.store
Software: nginx /
Resource Hash: 26bf2de9fe147c4bd3d853636e6a381e54ddc353c228e9df642c6c522a1544da

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=315360000
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 28 Jul 2022 15:13:26 GMT
ETag: W/"62e1e299-593e"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Keep-Alive: timeout=60
Last-Modified: Thu, 28 Jul 2022 01:12:57 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 324
Content-Type: text/html; charset=iso-8859-1
Date: Thu, 28 Jul 2022 15:13:26 GMT
Keep-Alive: timeout=5, max=100
Location: https://www.afcbe.dd-dns.de/AFIN/indoor.html
Server: Apache/2.4.52 (Ubuntu)

GET
H/1.1 200 logo-desktop-inverse.a3a99f3a.png
secure.americafirst.com/img/ 9 KB
9 KB 421ms
74ms Image
image/png 216.51.43.116
AFCU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.americafirst.com/img/logo-desktop-inverse.a3a99f3a.png

Requested by

Host: www.afcbe.dd-dns.de
URL: https://www.afcbe.dd-dns.de/AFIN/indoor.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

216.51.43.116 South Jordan, United States, ASN17150 (AFCU, US),

Reverse DNS

Software

Fake Name / Fake Name

Resource Hash

c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.afcbe.dd-dns.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 28 Jul 2022 15:13:26 GMT
X-Content-Type-Options: nosniff
X-Powered-By: Fake Name
X-OneAgent-JS-Injection: true
Connection: keep-alive
Content-Length: 8898
X-Xss-Protection: 1; mode=block
Referrer-Policy: STRICT-ORIGIN
Last-Modified: Wed, 18 May 2022 02:55:54 GMT
Server: Fake Name
ETag: W/"8898-1652842554000"
Expect-CT: "enforce,max-age=30"
Content-Type: image/png
Permissions-Policy: geolocation=(self "https://FAKE URL.com")
Content-Security-Policy: frame-ancestors 'self'
Accept-Ranges: bytes
Keep-Alive: timeout=60

GET
H/1.1 200
OK eagle-inverse.png
www.americafirst.com/content/dam/general/ 54 KB
55 KB 608ms
75ms Image
image/png 206.81.136.154
AFCU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.americafirst.com/content/dam/general/eagle-inverse.png

Requested by

Host: www.afcbe.dd-dns.de
URL: https://www.afcbe.dd-dns.de/AFIN/indoor.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

206.81.136.154 Ogden, United States, ASN17150 (AFCU, US),

Reverse DNS

Software

Apache /

Resource Hash

4c2f9e3884701acbb2bcb1d909abb00fb7f336644ca3b295ad3bb9fd192bf6b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.americafirst.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://apps.americafirst.com

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.afcbe.dd-dns.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 28 Jul 2022 15:13:27 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Server: Apache
Content-Security-Policy: frame-ancestors https://*.americafirst.com;
X-Frame-Options: ALLOW-FROM https://apps.americafirst.com
Content-Type: image/png
Cache-Control: max-age=2592000
Content-Disposition: inline
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: X-Forwarded-For
Content-Length: 55354
Keep-Alive: timeout=5, max=90
Expires: Sat, 27 Aug 2022 15:13:27 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ll_storage_html5.html Show response
public.cobrowse.oraclecloud.com/rely/storage/ Frame B9F5 43 KB
12 KB 257ms
12ms Document
text/html 23.3.115.229
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=iygc1h43ow&version=20190514
Requested by: Host: www.afcbe.dd-dns.de
URL: https://www.afcbe.dd-dns.de/AFIN/indoor.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.3.115.229 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-3-115-229.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d4637eb830c4e16d44715277642270f0088ff631f1f338dbf377403b87d13f6d

Request headers

Referer: https://www.afcbe.dd-dns.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 11698
content-type: text/html
date: Thu, 28 Jul 2022 15:13:26 GMT
etag: "b7b7e70ac037b592aef8c274d8e66a71:1634875896.03281"
last-modified: Thu, 21 Oct 2021 23:11:35 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: America First Credit Union (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.do
public.cobrowse.oraclecloud.com
secure.americafirst.com
www.afcbe.dd-dns.de
www.americafirst.com
206.81.136.154
216.51.43.116
23.21.31.78
23.3.115.229
45.42.200.36
26bf2de9fe147c4bd3d853636e6a381e54ddc353c228e9df642c6c522a1544da
4c2f9e3884701acbb2bcb1d909abb00fb7f336644ca3b295ad3bb9fd192bf6b8
a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821
c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54
d4637eb830c4e16d44715277642270f0088ff631f1f338dbf377403b87d13f6d
df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b

www.afcbe.dd-dns.de Open in urlscan Pro 45.42.200.36 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

5 IPs

1 Countries

84 kBTransfer

133 kBSize

0 Cookies

9 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

www.afcbe.dd-dns.de Open in urlscan Pro
45.42.200.36 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

5
IPs

1
Countries

84 kB
Transfer

133 kB
Size

0
Cookies

4 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!