www.knock.dd-dns.de - urlscan.io

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 64.112.61.50, located in Las Vegas, United States and belongs to FIBERHUB, US. The main domain is www.knock.dd-dns.de.
TLS certificate: Issued by R3 on May 26th 2022. Valid for: 3 months.

This is the only time www.knock.dd-dns.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: America First Credit Union (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	64.112.61.50 64.112.61.50	53340 (FIBERHUB) (FIBERHUB)
1	216.51.43.116 216.51.43.116	2828 (XO-AS15) (XO-AS15)
1	206.81.136.154 206.81.136.154	17150 (AFCU) (AFCU)
1	96.16.137.22 96.16.137.22	16625 (AKAMAI-AS) (AKAMAI-AS)
4	5

1 64.112.61.50 (Las Vegas, United States)

ASN53340 (FIBERHUB, US)
PTR: o93mqwb.albertamountainenterprises.com

www.knock.dd-dns.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.51.43.116 (South Jordan, United States)

ASN2828 (XO-AS15, US)

secure.americafirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.81.136.154 (Ogden, United States)

ASN17150 (AFCU, US)

www.americafirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.16.137.22 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-137-22.deploy.static.akamaitechnologies.com

public.cobrowse.oraclecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	americafirst.com secure.americafirst.com — Cisco Umbrella Rank: 304575 www.americafirst.com — Cisco Umbrella Rank: 318556	64 KB
1	oraclecloud.com public.cobrowse.oraclecloud.com — Cisco Umbrella Rank: 10587	12 KB
1	dd-dns.de www.knock.dd-dns.de	9 KB
4	3

	Domain	Requested by
1	public.cobrowse.oraclecloud.com	www.knock.dd-dns.de
1	www.americafirst.com	www.knock.dd-dns.de
1	secure.americafirst.com	www.knock.dd-dns.de
1	www.knock.dd-dns.de
4	4

This site contains links to these domains. Also see Links.

Domain
webaccess45.americafirst.com
www.americafirst.com
portal.hud.gov
www.ncua.gov

Subject Issuer	Validity	Valid
knock.dd-dns.de R3	`2022-05-26` - `2022-08-24`	3 months	crt.sh
secure.americafirst.com Sectigo RSA Organization Validation Secure Server CA	`2021-10-25` - `2022-10-25`	a year	crt.sh
www.americafirst.com Sectigo RSA Extended Validation Secure Server CA	`2022-01-27` - `2023-01-27`	a year	crt.sh
*.cobrowse.oraclecloud.com DigiCert SHA2 Secure Server CA	`2021-11-06` - `2022-11-08`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.knock.dd-dns.de/Afc22/indie.html
Frame ID: E069DAB6D61FC43D7435BB5B8474630B
Requests: 5 HTTP requests in this frame

Frame: https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=iygc1h43ow&version=20190514
Frame ID: 85A2D5467988A90DCE102256E24F708A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

84 kB
Transfer

133 kB
Size

0
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://webaccess45.americafirst.com/auth/Enrollment
Title: Enroll now

Search URL Search Domain Scan URL

URL: https://webaccess45.americafirst.com/auth/ForgottenCredentials/Id
Title: Forgot user ID

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/contact/
Title: Contact us

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/disclosures/membership-agreement.cfm
Title: terms

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/contact/branches.html
Title: branch locator

Search URL Search Domain Scan URL

URL: http://portal.hud.gov/hudportal/HUD?src=/program_offices/fair_housing_equal_opp

Search URL Search Domain Scan URL

URL: https://www.ncua.gov/services/pages/share-insurance.aspx

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/disclosures/membership-agreement.cfm#privacyPolicy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/documents/marketing-email-opt-out.pdf
Title: Email Opt Out Procedure

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request indie.html Show response
www.knock.dd-dns.de/Afc22/ 22 KB
9 KB 574ms
143ms Document
text/html 64.112.61.50
FIBERHUB

General

Check archive.org

Show headers Download Go to

Full URL: https://www.knock.dd-dns.de/Afc22/indie.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.112.61.50 Las Vegas, United States, ASN53340 (FIBERHUB, US),
Reverse DNS: o93mqwb.albertamountainenterprises.com
Software: nginx /
Resource Hash: 12e78b647baf7d2093ac23136877625baf24c2c64bbf2193bbde75f35c64c5e2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=315360000
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Fri, 27 May 2022 01:21:07 GMT
ETag: W/"628f9250-593e"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Keep-Alive: timeout=60
Last-Modified: Thu, 26 May 2022 14:44:32 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200 logo-desktop-inverse.a3a99f3a.png
secure.americafirst.com/img/ 9 KB
9 KB 1096ms
163ms Image
image/png 216.51.43.116
XO-AS15

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.americafirst.com/img/logo-desktop-inverse.a3a99f3a.png
Requested by: Host: www.knock.dd-dns.de
URL: https://www.knock.dd-dns.de/Afc22/indie.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 216.51.43.116 South Jordan, United States, ASN2828 (XO-AS15, US),
Reverse DNS
Software: /
Resource Hash: c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.knock.dd-dns.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 27 May 2022 01:21:07 GMT
Via: NS-CACHE-10.0: 155
Last-Modified: Wed, 18 May 2022 02:55:54 GMT
Age: 2
ETag: W/"8898-1652842554000"
Content-Type: image/png
X-OneAgent-JS-Injection: true
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 8898

GET
H/1.1 200
OK eagle-inverse.png
www.americafirst.com/content/dam/general/ 54 KB
55 KB 1716ms
165ms Image
image/png 206.81.136.154
AFCU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.americafirst.com/content/dam/general/eagle-inverse.png

Requested by

Host: www.knock.dd-dns.de
URL: https://www.knock.dd-dns.de/Afc22/indie.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

206.81.136.154 Ogden, United States, ASN17150 (AFCU, US),

Reverse DNS

Software

Apache /

Resource Hash

4c2f9e3884701acbb2bcb1d909abb00fb7f336644ca3b295ad3bb9fd192bf6b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.americafirst.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://apps.americafirst.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.knock.dd-dns.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 27 May 2022 01:21:08 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Server: Apache
Content-Security-Policy: frame-ancestors https://*.americafirst.com;
X-Frame-Options: ALLOW-FROM https://apps.americafirst.com
Content-Type: image/png
Cache-Control: max-age=2592000
Content-Disposition: inline
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: X-Forwarded-For
Content-Length: 55354
Keep-Alive: timeout=5, max=88
Expires: Sun, 26 Jun 2022 01:21:08 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ll_storage_html5.html Show response
public.cobrowse.oraclecloud.com/rely/storage/ Frame 85A2 43 KB
12 KB 51ms
11ms Document
text/html 96.16.137.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=iygc1h43ow&version=20190514
Requested by: Host: www.knock.dd-dns.de
URL: https://www.knock.dd-dns.de/Afc22/indie.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.16.137.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-137-22.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d4637eb830c4e16d44715277642270f0088ff631f1f338dbf377403b87d13f6d

Request headers

Referer: https://www.knock.dd-dns.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 11698
content-type: text/html
date: Fri, 27 May 2022 01:21:07 GMT
etag: "b7b7e70ac037b592aef8c274d8e66a71:1634875896.03281"
last-modified: Thu, 21 Oct 2021 23:11:35 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: America First Credit Union (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

public.cobrowse.oraclecloud.com
secure.americafirst.com
www.americafirst.com
www.knock.dd-dns.de
206.81.136.154
216.51.43.116
64.112.61.50
96.16.137.22
12e78b647baf7d2093ac23136877625baf24c2c64bbf2193bbde75f35c64c5e2
4c2f9e3884701acbb2bcb1d909abb00fb7f336644ca3b295ad3bb9fd192bf6b8
a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821
c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54
d4637eb830c4e16d44715277642270f0088ff631f1f338dbf377403b87d13f6d
df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b

www.knock.dd-dns.de Open in urlscan Pro 64.112.61.50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

5 IPs

2 Countries

84 kBTransfer

133 kBSize

0 Cookies

9 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

www.knock.dd-dns.de Open in urlscan Pro
64.112.61.50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

84 kB
Transfer

133 kB
Size

0
Cookies

4 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!