www.ginger.my-wan.de

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 185.161.69.202, located in Los Angeles, United States and belongs to DEDIPATH-LLC, US. The main domain is www.ginger.my-wan.de.
TLS certificate: Issued by R3 on March 14th 2022. Valid for: 3 months.

This is the only time www.ginger.my-wan.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: America First Credit Union (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	185.161.69.202 185.161.69.202	35913 (DEDIPATH-LLC) (DEDIPATH-LLC)
1	216.51.43.116 216.51.43.116	17150 (AFCU) (AFCU)
1	206.81.136.154 206.81.136.154	17150 (AFCU) (AFCU)
1	104.89.17.113 104.89.17.113	16625 (AKAMAI-AS) (AKAMAI-AS)
4	5

1 185.161.69.202 (Los Angeles, United States)

ASN35913 (DEDIPATH-LLC, US)

www.ginger.my-wan.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.51.43.116 (Sandy, United States)

ASN17150 (AFCU, US)

secure.americafirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.81.136.154 (Ogden, United States)

ASN17150 (AFCU, US)

www.americafirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.89.17.113 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-89-17-113.deploy.static.akamaitechnologies.com

public.cobrowse.oraclecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	americafirst.com secure.americafirst.com — Cisco Umbrella Rank: 302244 www.americafirst.com — Cisco Umbrella Rank: 280396	64 KB
1	oraclecloud.com public.cobrowse.oraclecloud.com — Cisco Umbrella Rank: 10101	12 KB
1	my-wan.de www.ginger.my-wan.de	9 KB
4	3

	Domain	Requested by
1	public.cobrowse.oraclecloud.com	www.ginger.my-wan.de
1	www.americafirst.com	www.ginger.my-wan.de
1	secure.americafirst.com	www.ginger.my-wan.de
1	www.ginger.my-wan.de
4	4

This site contains links to these domains. Also see Links.

Domain
webaccess45.americafirst.com
www.americafirst.com
portal.hud.gov
www.ncua.gov

Subject Issuer	Validity	Valid
ginger.my-wan.de R3	`2022-03-14` - `2022-06-12`	3 months	crt.sh
secure.americafirst.com Sectigo RSA Organization Validation Secure Server CA	`2021-10-25` - `2022-10-25`	a year	crt.sh
www.americafirst.com Sectigo RSA Extended Validation Secure Server CA	`2022-01-27` - `2023-01-27`	a year	crt.sh
*.cobrowse.oraclecloud.com DigiCert SHA2 Secure Server CA	`2021-11-06` - `2022-11-08`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.ginger.my-wan.de/AFFCU/index.html
Frame ID: F467087657891CD2729E5E85CA6CE245
Requests: 5 HTTP requests in this frame

Frame: https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=iygc1h43ow&version=20190514
Frame ID: 36D8286CFED37D0176D4E4AF69B94AE4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

84 kB
Transfer

133 kB
Size

0
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://webaccess45.americafirst.com/auth/Enrollment
Title: Enroll now

Search URL Search Domain Scan URL

URL: https://webaccess45.americafirst.com/auth/ForgottenCredentials/Id
Title: Forgot user ID

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/contact/
Title: Contact us

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/disclosures/membership-agreement.cfm
Title: terms

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/contact/branches.html
Title: branch locator

Search URL Search Domain Scan URL

URL: http://portal.hud.gov/hudportal/HUD?src=/program_offices/fair_housing_equal_opp

Search URL Search Domain Scan URL

URL: https://www.ncua.gov/services/pages/share-insurance.aspx

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/disclosures/membership-agreement.cfm#privacyPolicy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/documents/marketing-email-opt-out.pdf
Title: Email Opt Out Procedure

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.html Show response
www.ginger.my-wan.de/AFFCU/ 22 KB
9 KB 379ms
124ms Document
text/html 185.161.69.202
DEDIPATH-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.ginger.my-wan.de/AFFCU/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.161.69.202 Los Angeles, United States, ASN35913 (DEDIPATH-LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: ffc31ffa00d25b1f6fc66aaa4aecee9dbfcc4cf17ca324a4330305339fb17d08

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx
Date: Tue, 15 Mar 2022 16:58:32 GMT
Content-Type: text/html
Last-Modified: Mon, 14 Mar 2022 21:56:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"622fba1f-593e"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

GET
H/1.1 200 logo-desktop-inverse.a3a99f3a.png
secure.americafirst.com/img/ 9 KB
9 KB 746ms
150ms Image
image/png 216.51.43.116
AFCU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.americafirst.com/img/logo-desktop-inverse.a3a99f3a.png
Requested by: Host: www.ginger.my-wan.de
URL: https://www.ginger.my-wan.de/AFFCU/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 216.51.43.116 Sandy, United States, ASN17150 (AFCU, US),
Reverse DNS
Software: /
Resource Hash: c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.ginger.my-wan.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 15 Mar 2022 16:58:32 GMT
Via: NS-CACHE-10.0: 155
Last-Modified: Thu, 17 Feb 2022 18:11:00 GMT
Age: 2
ETag: W/"8898-1645121460000"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 8898

GET
H/1.1 200
OK eagle-inverse.png
www.americafirst.com/content/dam/general/ 54 KB
55 KB 1315ms
148ms Image
image/png 206.81.136.154
AFCU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.americafirst.com/content/dam/general/eagle-inverse.png

Requested by

Host: www.ginger.my-wan.de
URL: https://www.ginger.my-wan.de/AFFCU/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

206.81.136.154 Ogden, United States, ASN17150 (AFCU, US),

Reverse DNS

Software

Apache /

Resource Hash

4c2f9e3884701acbb2bcb1d909abb00fb7f336644ca3b295ad3bb9fd192bf6b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.americafirst.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://apps.americafirst.com

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.ginger.my-wan.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 15 Mar 2022 16:58:33 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Server: Apache
Content-Security-Policy: frame-ancestors https://*.americafirst.com;
X-Frame-Options: ALLOW-FROM https://apps.americafirst.com
Content-Type: image/png
Cache-Control: max-age=2592000
Content-Disposition: inline
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: X-Forwarded-For
Content-Length: 55354
Keep-Alive: timeout=5, max=87
Expires: Thu, 14 Apr 2022 16:58:33 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ll_storage_html5.html Show response
public.cobrowse.oraclecloud.com/rely/storage/ Frame 36D8 43 KB
12 KB 171ms
9ms Document
text/html 104.89.17.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=iygc1h43ow&version=20190514
Requested by: Host: www.ginger.my-wan.de
URL: https://www.ginger.my-wan.de/AFFCU/index.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.17.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-17-113.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d4637eb830c4e16d44715277642270f0088ff631f1f338dbf377403b87d13f6d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.ginger.my-wan.de/

Response headers

accept-ranges: bytes
content-type: text/html
etag: "b7b7e70ac037b592aef8c274d8e66a71:1634875896.03281"
last-modified: Thu, 21 Oct 2021 23:11:35 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
date: Tue, 15 Mar 2022 16:58:32 GMT
content-length: 11698

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: America First Credit Union (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

public.cobrowse.oraclecloud.com
secure.americafirst.com
www.americafirst.com
www.ginger.my-wan.de
104.89.17.113
185.161.69.202
206.81.136.154
216.51.43.116
4c2f9e3884701acbb2bcb1d909abb00fb7f336644ca3b295ad3bb9fd192bf6b8
a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821
c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54
d4637eb830c4e16d44715277642270f0088ff631f1f338dbf377403b87d13f6d
df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b
ffc31ffa00d25b1f6fc66aaa4aecee9dbfcc4cf17ca324a4330305339fb17d08

www.ginger.my-wan.de Open in urlscan Pro 185.161.69.202 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

5 IPs

2 Countries

84 kBTransfer

133 kBSize

0 Cookies

9 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

www.ginger.my-wan.de Open in urlscan Pro
185.161.69.202 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

84 kB
Transfer

133 kB
Size

0
Cookies

4 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!