accountque.com Open in urlscan Pro
2606:4700:3036::ac43:9275 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://accountque.com/
Submission: On October 09 via automatic, source openphish (October 9th 2022, 1:15:32 am UTC) — Scanned from DE

Summary HTTP 14 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3036::ac43:9275, located in United States and belongs to CLOUDFLARENET, US. The main domain is accountque.com.
TLS certificate: Issued by E1 on October 7th 2022. Valid for: 3 months.

This is the only time accountque.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: America First Credit Union (Banking)

Domain & IP information

	IP Address	AS Autonomous System
7	2606:4700:303... 2606:4700:3036::ac43:9275	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	216.51.43.116 216.51.43.116	2828 (XO-AS15) (XO-AS15)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
14	7

7 2606:4700:3036::ac43:9275 (United States)

ASN13335 (CLOUDFLARENET, US)

accountque.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.51.43.116 (South Jordan, United States)

ASN2828 (XO-AS15, US)

secure.americafirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	accountque.com accountque.com	141 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1229 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3315	28 KB
2	americafirst.com secure.americafirst.com — Cisco Umbrella Rank: 403006
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 485	30 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 977	24 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 358	7 KB
14	6

	Domain	Requested by
7	accountque.com	accountque.com
2	secure.americafirst.com	accountque.com
1	stackpath.bootstrapcdn.com	accountque.com
1	ajax.googleapis.com	accountque.com
1	code.jquery.com	accountque.com
1	maxcdn.bootstrapcdn.com	accountque.com
1	cdnjs.cloudflare.com	accountque.com
14	7

This site contains links to these domains. Also see Links.

Domain
www.americafirst.com
secure.americafirst.com
portal.hud.gov
www.ncua.gov

Subject Issuer	Validity	Valid
*.accountque.com E1	`2022-10-07` - `2023-01-05`	3 months	crt.sh
secure.americafirst.com Sectigo RSA Organization Validation Secure Server CA	`2022-09-26` - `2023-09-26`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://accountque.com/
Frame ID: 2AA3B14A3028F84C4AE89A1748897D4D
Requests: 15 HTTP requests in this frame

Frame: https://accountque.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1665273600
Frame ID: 6810D3F36C8AFA6DA19770D37E91E26A
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

America First Credit Union

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Popper (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/popper\.js/([0-9.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

83 %
IPv6

6
Domains

7
Subdomains

7
IPs

3
Countries

230 kB
Transfer

1103 kB
Size

1
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.americafirst.com/

Search URL Search Domain Scan URL

URL: https://secure.americafirst.com/#/enroll
Title: Enroll Now

Search URL Search Domain Scan URL

URL: https://secure.americafirst.com/#/forgot-password
Title: Forgot Password

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/contact/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/disclosures/membership-agreement.cfm
Title: terms

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/contact/branches.html
Title: branch locator

Search URL Search Domain Scan URL

URL: https://portal.hud.gov/hudportal/HUD?src=/program_offices/fair_housing_equal_opp

Search URL Search Domain Scan URL

URL: https://www.ncua.gov/support-services/share-insurance-fund

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/documents/membership-agreement.pdf#privacyPolicy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/documents/marketing-email-opt-out.pdf
Title: Email Opt Out Procedure

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/content/dam/pdfs/FTEU%20Fraud%20Alerts.pdf
Title: Fraud Alert Text/SMS Notification Terms and Conditions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
accountque.com/ 51 KB
17 KB 349ms
210ms Document
text/html 2606:4700:3036::ac43:9275
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://accountque.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:9275 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ae960123891cb837474c676d38d2ac15ad3f8f29284fada810750a069d83cd5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 757343e6dc58bc04-FRA
content-encoding: br
content-type: text/html
date: Sun, 09 Oct 2022 01:15:27 GMT
last-modified: Thu, 07 Apr 2022 21:41:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4hn7gF4laB4O0rxANnFajrZJVbRuqMnraNIQgpTXDgX9Ueqt%2BuT%2Bjrf6XyKV7Fw2Y01MgakFg7o1KkBwWm%2BojmptvgABhS6d2K%2FaEvVrWWynRS3rXZEDX2XMbVSqd05UQdLAZe2xeTaEC16L%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 app.76ff82e5.css
accountque.com/css/ 2 KB
1 KB 19ms
15ms Stylesheet
text/css 2606:4700:3036::ac43:9275
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://accountque.com/css/app.76ff82e5.css
Requested by: Host: accountque.com
URL: https://accountque.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:9275 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb71657ae52709339e1106b2962beb033e36cafeba218e25689f8ed27db01e20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accountque.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 01:15:27 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 23 Mar 2022 15:13:16 GMT
server: cloudflare
age: 3268
cf-polished: origSize=2555
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KELCjDS49vONxhmesMbMzFs417acfVGbMVfrbvcDzwfCpeknUQMChDFwPdkT2Va5Urn1ICfg2ynKUrYilqlDxMXctOokuYM2RhFSrlaBY4o%2BxTE%2F8T6wZZOT50Z3gjBGDuhgk3lkiLwKrbP59Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 757343e83d8fbc04-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 chunk-vendors.eab46e62.css
accountque.com/css/ 700 KB
91 KB 24ms
22ms Stylesheet
text/css 2606:4700:3036::ac43:9275
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://accountque.com/css/chunk-vendors.eab46e62.css
Requested by: Host: accountque.com
URL: https://accountque.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:9275 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dadacc217f8abe02576e41bee8577c1f3ae23c5281cf25ab7e557d426ec62a06

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accountque.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 01:15:27 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 23 Mar 2022 15:13:16 GMT
server: cloudflare
age: 3268
cf-polished: origSize=717225
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T1OpyZ0l4EALs1KJkK4DgYE6l5%2BCEG63sKCxK0qGW2FGw62W7HHEh932hHs2W3E6eCZvKNy1J8DAJPztoBTMUSX8%2Ba7Anipx8B2UzXmgNAlLIZCZZXF0MxnbXnFkRvPB2rGobXFS4SP8lWMrqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 757343e83d90bc04-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 404 app.48c40f3c.js
secure.americafirst.com/js/ 0
0 1849ms
146ms Script
text/html 216.51.43.116
XO-AS15

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.americafirst.com/js/app.48c40f3c.js
Requested by: Host: accountque.com
URL: https://accountque.com/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 216.51.43.116 South Jordan, United States, ASN2828 (XO-AS15, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accountque.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H/1.1 404 chunk-vendors.662cf618.js
secure.americafirst.com/js/ 0
0 1850ms
147ms Script
text/html 216.51.43.116
XO-AS15

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.americafirst.com/js/chunk-vendors.662cf618.js
Requested by: Host: accountque.com
URL: https://accountque.com/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 216.51.43.116 South Jordan, United States, ASN2828 (XO-AS15, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accountque.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 83b34f00b6612015c941c3865d2c047ae5ce567f13530491ac4ed773b13b1bd3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 logo-desktop-inverse.a3a99f3a.png
accountque.com/images/ 9 KB
9 KB 206ms
206ms Image
image/png 2606:4700:3036::ac43:9275
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accountque.com/images/logo-desktop-inverse.a3a99f3a.png
Requested by: Host: accountque.com
URL: https://accountque.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:9275 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accountque.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 01:15:27 GMT
cf-cache-status: MISS
last-modified: Wed, 23 Mar 2022 15:13:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G63XUSLOlGyTfiIpdLvUftE932%2Bf%2FrkeOivN75pAZfn3nbXVWuMj4cIa%2F0BDeWUhOBaMSS0uRC3Y7Zlm4AYrSofWeE%2B4%2FycBu0zQAZIJXw2ZXRzAtMTFhUJja%2BVlod9ui3tePN1QtdP3HrqW3g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757343e8ccbb9be6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8898

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 986dae282bc4d35f7234bbf7c3eafd4b4bb990b89143be1f5c8a8aa4a04ee2b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
7 KB 799ms
14ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: accountque.com
URL: https://accountque.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accountque.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 01:15:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 176909
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6157
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-4af4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I3oAwJKt6K1FhSoiAB5Ybh5sckyh1W0VjjuiDOhce48rammcP%2BqadqTQGG6rDGHDvfReWEs9PLuduERdtc6gZ6iq9WpxYqxwY24kNsVmJR0A790OcW1KsN6WIIvMt5JzaS3Ygj5CeD%2Bu762kyvF7hppR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 757343ee3b97bb71-FRA
expires: Fri, 29 Sep 2023 01:15:28 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
14 KB 823ms
37ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Host: accountque.com
URL: https://accountque.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accountque.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 01:15:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 601
age: 22180821
cdn-cachedat: 08/04/2021 00:04:37
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-proxyver: 1.0
cdn-requestpullcode: 200
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 1a094ec5f566140ad8ed25d8ea736316
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 757343ee4fa49b3d-FRA
cdn-requestpullsuccess: True

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 796ms
9ms Script
application/javascript 2001:4de0:ac18::1:a:3a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: accountque.com
URL: https://accountque.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accountque.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 01:15:28 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-10fdd"
vary: Accept-Encoding
x-hw: 1665278128.dop202.fr8.t,1665278128.cds272.fr8.hn,1665278128.cds257.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 23856

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 794ms
7ms Script
text/javascript 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: accountque.com
URL: https://accountque.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accountque.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sat, 08 Oct 2022 20:11:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18239
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Oct 2023 20:11:29 GMT

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 50 KB
15 KB 802ms
15ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Requested by

Host: accountque.com
URL: https://accountque.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accountque.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 01:15:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 674, 718, 718
age: 22180823
cdn-cachedat: 2021-06-08 05:11:08
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
server: cloudflare
cdn-requestpullcode: 200
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: d57b249fbc897a386cb949167a1340aa
timing-allow-origin: *
cdn-requestcountrycode: US
cf-ray: 757343ee4a38bbd1-FRA
cdn-requestpullsuccess: True

GET
H3 200 invisible.js Show response
accountque.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 6810 40 KB
14 KB 16ms
16ms Script
application/javascript 2606:4700:3036::ac43:9275
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://accountque.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1665273600
Requested by: Host: accountque.com
URL: https://accountque.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:9275 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a546a19a746388b7976a8c2a7b12407e2087d9a8351d04093ef4f36f0b4151e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 01:15:28 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gsh5%2BTE%2FxZzaP2r42P1nIPiUSwPGVeFU8P8BBMIQ%2B8prKCjFsAbzgQaHakS0E9YzM2skpK37LL4JJdZMEQDxqR%2BqzMO4KXWrOAzfMrWcyD9Nb1%2BL3won2tq6uobDGhryeoZDbyWtybKBlHDteQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 757343eebba49be6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 pica.js
accountque.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame 6810 21 KB
8 KB 15ms
14ms Other
application/javascript 2606:4700:3036::ac43:9275
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://accountque.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:9275 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 195673c4f84ac7fc45b3f111f9890917e81d9d68975c927a68635246957fd649

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 01:15:28 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LNFG8xdZYMzKuB%2F4Y%2Be%2F8UDxshn%2FTb8nSz5%2FJmMjtzhOtDvkvtlg2P2ty5CKqCng%2FbHTrC1iPnKoXe9woA1xSxJxhtlGFe0YVibhaVo3P%2FnnixjZL%2FT%2FGLIm2Sh%2F0qvp06RonB3szgZUa0mE6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 757343ef0c1e9be6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 200 757343e6dc58bc04 Show response
accountque.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 6810 2 B
658 B 29ms
28ms XHR
text/plain 2606:4700:3036::ac43:9275
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://accountque.com/cdn-cgi/challenge-platform/h/g/cv/result/757343e6dc58bc04
Requested by: Host: accountque.com
URL: https://accountque.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1665273600
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:9275 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 09 Oct 2022 01:15:28 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7uxKrxpGLc93aH%2F0PNOSYzw2GFX4iiY7J3zReIEYoZUOqLlk5iMXnLLYO7vtPEjB%2BSZDOmKZD1zb0Z10CWWy%2BqxWx09mgdtXw6Z3hykZc6M23UnTOIl5z8VBQzuvueQK2LnvmyUXtedVFkbfmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 757343f1cf409be6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: America First Credit Union (Banking)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.accountque.com/	1970-01-20 06:34:39	Name: __cf_bm Value: Ar5Ju2D.nC0DVYP2RS.5dWouHYHC9zxCpYOYxMoBdTk-1665278128-0-Ad4KlRmi2iVvLzpS0ddPqZ8bHN8Evg2yo1dd/GQKkyIdPT2IUyNn516gdiX8XAc9V6iS+qeBnu5M0ZMeJild0ZodIHbY65IYV0Wtaeg59DfMNc9AOCEJNfOSos05x7zElg==

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://secure.americafirst.com/js/app.48c40f3c.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://secure.americafirst.com/js/chunk-vendors.662cf618.js Message: Failed to load resource: the server responded with a status of 404 ()
javascript	warning	URL: https://accountque.com/ Message: The resource https://secure.americafirst.com/js/app.48c40f3c.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://accountque.com/ Message: The resource https://secure.americafirst.com/js/chunk-vendors.662cf618.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accountque.com
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
maxcdn.bootstrapcdn.com
secure.americafirst.com
stackpath.bootstrapcdn.com
2001:4de0:ac18::1:a:3a
216.51.43.116
2606:4700:3036::ac43:9275
2606:4700::6811:180e
2606:4700::6812:acf
2a00:1450:4001:82b::200a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0a546a19a746388b7976a8c2a7b12407e2087d9a8351d04093ef4f36f0b4151e
195673c4f84ac7fc45b3f111f9890917e81d9d68975c927a68635246957fd649
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
4ae960123891cb837474c676d38d2ac15ad3f8f29284fada810750a069d83cd5
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
83b34f00b6612015c941c3865d2c047ae5ce567f13530491ac4ed773b13b1bd3
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
986dae282bc4d35f7234bbf7c3eafd4b4bb990b89143be1f5c8a8aa4a04ee2b4
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821
bb71657ae52709339e1106b2962beb033e36cafeba218e25689f8ed27db01e20
c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54
dadacc217f8abe02576e41bee8577c1f3ae23c5281cf25ab7e557d426ec62a06
df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

accountque.com Open in urlscan Pro 2606:4700:3036::ac43:9275 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

83 %IPv6

6 Domains

7 Subdomains

7 IPs

3 Countries

230 kBTransfer

1103 kBSize

1 Cookies

11 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

accountque.com Open in urlscan Pro
2606:4700:3036::ac43:9275 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

83 %
IPv6

6
Domains

7
Subdomains

7
IPs

3
Countries

230 kB
Transfer

1103 kB
Size

1
Cookies

14 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!