www.americafirst3notice.my-vigor.de
Open in
urlscan Pro
209.182.103.173
Malicious Activity!
Public Scan
Submission: On May 25 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on May 23rd 2022. Valid for: 3 months.
This is the only time www.americafirst3notice.my-vigor.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: America First Credit Union (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 209.182.103.173 209.182.103.173 | 213035 (AS-SERVER...) (AS-SERVERION Serverion B.V.) | |
1 | 216.51.43.116 216.51.43.116 | 17150 (AFCU) (AFCU) | |
1 | 206.81.136.154 206.81.136.154 | 209 (CENTURYLI...) (CENTURYLINK-US-LEGACY-QWEST) | |
1 | 96.16.137.22 96.16.137.22 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 2a02:26f0:6c0... 2a02:26f0:6c00::210:ba61 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
6 | 6 |
ASN213035 (AS-SERVERION Serverion B.V., NL)
PTR: road.vivaespananear.org.uk
www.americafirst3notice.my-vigor.de |
ASN209 (CENTURYLINK-US-LEGACY-QWEST, US)
www.americafirst.com |
ASN16625 (AKAMAI-AS, US)
PTR: a96-16-137-22.deploy.static.akamaitechnologies.com
public.cobrowse.oraclecloud.com |
ASN20940 (AKAMAI-ASN1, NL)
ds-aksb-a.akamaihd.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
akamaihd.net
ds-aksb-a.akamaihd.net — Cisco Umbrella Rank: 5080 |
5 KB |
2 |
americafirst.com
secure.americafirst.com — Cisco Umbrella Rank: 324387 www.americafirst.com — Cisco Umbrella Rank: 326465 |
64 KB |
1 |
oraclecloud.com
public.cobrowse.oraclecloud.com — Cisco Umbrella Rank: 11521 |
12 KB |
1 |
my-vigor.de
www.americafirst3notice.my-vigor.de |
9 KB |
6 | 4 |
Domain | Requested by | |
---|---|---|
2 | ds-aksb-a.akamaihd.net |
public.cobrowse.oraclecloud.com
www.americafirst3notice.my-vigor.de |
1 | public.cobrowse.oraclecloud.com |
www.americafirst3notice.my-vigor.de
|
1 | www.americafirst.com |
www.americafirst3notice.my-vigor.de
|
1 | secure.americafirst.com |
www.americafirst3notice.my-vigor.de
|
1 | www.americafirst3notice.my-vigor.de | |
6 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
webaccess45.americafirst.com |
www.americafirst.com |
portal.hud.gov |
www.ncua.gov |
Subject Issuer | Validity | Valid | |
---|---|---|---|
americafirst3notice.my-vigor.de R3 |
2022-05-23 - 2022-08-21 |
3 months | crt.sh |
secure.americafirst.com Sectigo RSA Organization Validation Secure Server CA |
2021-10-25 - 2022-10-25 |
a year | crt.sh |
www.americafirst.com Sectigo RSA Extended Validation Secure Server CA |
2022-01-27 - 2023-01-27 |
a year | crt.sh |
*.cobrowse.oraclecloud.com DigiCert SHA2 Secure Server CA |
2021-11-06 - 2022-11-08 |
a year | crt.sh |
a248.e.akamai.net DigiCert SHA2 Secure Server CA |
2021-07-15 - 2022-07-20 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.americafirst3notice.my-vigor.de/verify.html
Frame ID: 986C5FA808EA77DB8D04A3C4AB7D4C03
Requests: 5 HTTP requests in this frame
Frame:
https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=iygc1h43ow&version=20190514
Frame ID: FF7DDDA0A1093624D7B51994B7CFF318
Requests: 3 HTTP requests in this frame
9 Outgoing links
These are links going to different origins than the main page.
Title: Enroll now
Search URL Search Domain Scan URL
Title: Forgot user ID
Search URL Search Domain Scan URL
Title: Contact us
Search URL Search Domain Scan URL
Title: terms
Search URL Search Domain Scan URL
Title: branch locator
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Email Opt Out Procedure
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
verify.html
www.americafirst3notice.my-vigor.de/ |
26 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-desktop-inverse.a3a99f3a.png
secure.americafirst.com/img/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eagle-inverse.png
www.americafirst.com/content/dam/general/ |
54 KB 55 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ll_storage_html5.html
public.cobrowse.oraclecloud.com/rely/storage/ Frame FF7D |
44 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aksb.min.js
ds-aksb-a.akamaihd.net/ Frame FF7D |
13 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b
ds-aksb-a.akamaihd.net/2/407454/ Frame FF7D |
0 269 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: America First Credit Union (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ds-aksb-a.akamaihd.net
public.cobrowse.oraclecloud.com
secure.americafirst.com
www.americafirst.com
www.americafirst3notice.my-vigor.de
206.81.136.154
209.182.103.173
216.51.43.116
2a02:26f0:6c00::210:ba61
96.16.137.22
0f2689e78dd5c3d9810d6d5fa6a842d0ee999a677fe9ddd976a97f7cf5a89f23
4c2f9e3884701acbb2bcb1d909abb00fb7f336644ca3b295ad3bb9fd192bf6b8
5265c18df01bee06a070408bb72042b8a269e0f0a8bd372072e2fc55457ed123
7f06def529e0076b37f65c60085a6b1c65f1bbab0b1f87c72c188018b5094966
a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821
c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54
df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855