urlscan.io logo urlscan.io
SecurityTrails logo

walthamforestvvc.com Open in urlscan Pro
64.72.205.249  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://walthamforestvvc.com/auth-revise-loading-authenticate-emberscu/
Submission Tags: @phish_report
Submission: On November 04 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 64.72.205.249, located in Dallas, United States and belongs to FREAKHOSTING, GB. The main domain is walthamforestvvc.com.
TLS certificate: Issued by E6 on October 13th 2024. Valid for: 3 months.
This is the only time walthamforestvvc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Embers Credit Union (Financial)

Domain & IP information

IP Address AS Autonomous System
1 64.72.205.249 215703 (FREAKHOSTING)
1 104.17.24.14 13335 (CLOUDFLAR...)
3 34.49.228.39 396982 (GOOGLE-CL...)
5 3
Apex Domain
Subdomains		 Transfer
3 embers.org
my.embers.org
174 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220
6 KB
1 walthamforestvvc.com
walthamforestvvc.com
2 KB
5 3
Domain Requested by
3 my.embers.org walthamforestvvc.com
1 cdnjs.cloudflare.com walthamforestvvc.com
1 walthamforestvvc.com
5 3

This site contains no links.

Subject Issuer Validity Valid
walthamforestvvc.com
E6		 2024-10-13 -
2025-01-11		 3 months crt.sh
cdnjs.cloudflare.com
WE1		 2024-09-28 -
2024-12-27		 3 months crt.sh
my.embers.org
GeoTrust TLS RSA CA G1		 2024-03-01 -
2025-03-01		 a year crt.sh

This page contains 1 frames:

Primary Page: https://walthamforestvvc.com/auth-revise-loading-authenticate-emberscu/
Frame ID: BE4D26D89C2F6F353989612213DE882F
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login ยท Embers CU

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

182 kB
Transfer

208 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
walthamforestvvc.com/auth-revise-loading-authenticate-emberscu/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://walthamforestvvc.com/auth-revise-loading-authenticate-emberscu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.72.205.249 Dallas, United States, ASN215703 (FREAKHOSTING, GB),
Reverse DNS
walthamforestvvc.com
Software
LiteSpeed /
Resource Hash
ce030e9826b9ae51f7b52fe9d4323aa3ef0a5747324e56183fe39533a980afa0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
1456
content-type
text/html
date
Mon, 04 Nov 2024 21:25:30 GMT
etag
"1080-6723a3f7-32f6;br"
last-modified
Thu, 31 Oct 2024 15:36:23 GMT
server
LiteSpeed
vary
Accept-Encoding
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: walthamforestvvc.com
URL: https://walthamforestvvc.com/auth-revise-loading-authenticate-emberscu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://walthamforestvvc.com/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03e5f-7918"
age
1102899
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RWiXzJksk6x078VPLesRBC30NReF5b2P70ChkiAamLuShuaJ2i38ZaepHsg8uBxBltPlKreye8uhBxShkn2wgsjvVJ2YxNsLqFRwIOxUOJlIMQbuoXOmHiJw08lsC6WbkyVH3YfL"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sat, 25 Oct 2025 21:25:30 GMT
alt-svc
h3=":443"; ma=86400
date
Mon, 04 Nov 2024 21:25:30 GMT
content-type
text/css; charset=utf-8
last-modified
Mon, 04 May 2020 16:10:07 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8dd7ad536d9b4c8a-HEL
accept-ranges
bytes
access-control-allow-origin
*
content-length
5631
server
cloudflare
embers-cu-logo-85f993f1.png
my.embers.org/images/fi-assets/embers-cu/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://my.embers.org/images/fi-assets/embers-cu/embers-cu-logo-85f993f1.png
Requested by
Host: walthamforestvvc.com
URL: https://walthamforestvvc.com/auth-revise-loading-authenticate-emberscu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.49.228.39 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
39.228.49.34.bc.googleusercontent.com
Software
/
Resource Hash
e66e280ad9c5858dac72a5e40853a0951580b43e7d655850e7e46a7d33b6ae7e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://walthamforestvvc.com/

Response headers

x-b3-spanid
0000000000000000
strict-transport-security
max-age=31536000; includeSubDomains
x-request-id
f100610c96db10f30b70f252e86a3ffa
cache-control
public, max-age=31536000, immutable
x-b3-sampled
1
via
1.1 google
accept-ranges
bytes
x-b3-traceid
00000000000000000000000000000000
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14489
date
Mon, 04 Nov 2024 21:25:30 GMT
content-type
image/png
embers-cu-background-landscape-612ade59.png
my.embers.org/images/fi-assets/embers-cu/ 		127 KB
127 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://my.embers.org/images/fi-assets/embers-cu/embers-cu-background-landscape-612ade59.png
Requested by
Host: walthamforestvvc.com
URL: https://walthamforestvvc.com/auth-revise-loading-authenticate-emberscu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.49.228.39 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
39.228.49.34.bc.googleusercontent.com
Software
/
Resource Hash
f6a2e83c7dce97ee1266432ee2caae94c114c4afda5c893729399143e739a7e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://walthamforestvvc.com/

Response headers

x-b3-spanid
0000000000000000
strict-transport-security
max-age=31536000; includeSubDomains
x-request-id
fcbe73171dce82ed9dd7c216f6a60040
cache-control
public, max-age=31536000, immutable
x-b3-sampled
1
via
1.1 google
accept-ranges
bytes
x-b3-traceid
00000000000000000000000000000000
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
129717
date
Mon, 04 Nov 2024 21:25:30 GMT
content-type
image/png
embers-cu-favicon-f0c153a7.ico
my.embers.org/images/fi-assets/embers-cu/ 		33 KB
33 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://my.embers.org/images/fi-assets/embers-cu/embers-cu-favicon-f0c153a7.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.49.228.39 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
39.228.49.34.bc.googleusercontent.com
Software
/
Resource Hash
2c298940db108045d44bc59a64c8cd9f11915e09ceb107b6216b10184bbaaa87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://walthamforestvvc.com/

Response headers

x-b3-spanid
0000000000000000
strict-transport-security
max-age=31536000; includeSubDomains
x-request-id
c3063f1c6940fde6c50593c7014d27f4
cache-control
public, max-age=31536000, immutable
x-b3-sampled
1
via
1.1 google
accept-ranges
bytes
x-b3-traceid
00000000000000000000000000000000
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33310
date
Mon, 04 Nov 2024 21:25:31 GMT
content-type
image/x-icon

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Embers Credit Union (Financial)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies