amfrst.com Open in urlscan Pro
173.248.144.185 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://amfrst.com/
Submission Tags: @ecarlesi threat phishing Search All
Submission: On November 30 via api (November 30th 2023, 7:46:16 am UTC) from IT — Scanned from IT

Summary HTTP 27 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 27 HTTP transactions. The main IP is 173.248.144.185, located in United States and belongs to WEHOSTWEBSITES-COM, US. The main domain is amfrst.com.
TLS certificate: Issued by R3 on November 29th 2023. Valid for: 3 months.

This is the only time amfrst.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: America's First Federal Credit Union (Financial)

Domain & IP information

	IP Address	AS Autonomous System
23	173.248.144.185 173.248.144.185	30475 (WEHOSTWEB...) (WEHOSTWEBSITES-COM)
1	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
1	143.204.210.101 143.204.210.101	16509 (AMAZON-02) (AMAZON-02)
2	185.199.109.153 185.199.109.153	54113 (FASTLY) (FASTLY)
27	4

23 173.248.144.185 (United States)

ASN30475 (WEHOSTWEBSITES-COM, US)
PTR: 173-248-144-185.static.x5x-noc.ru

amfrst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.210.101 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-210-101.fra53.r.cloudfront.net

js.pusher.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.199.109.153 (San Francisco, United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-109-153.github.com

bigcoke233.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	amfrst.com amfrst.com	1 MB
2	github.io bigcoke233.github.io	2 KB
1	pusher.com js.pusher.com — Cisco Umbrella Rank: 15569	19 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 735	31 KB
27	4

	Domain	Requested by
23	amfrst.com	amfrst.com
2	bigcoke233.github.io	amfrst.com
1	js.pusher.com	amfrst.com
1	code.jquery.com	amfrst.com
27	4

This site contains no links.

Subject Issuer	Validity	Valid
amfrst.com R3	`2023-11-29` - `2024-02-27`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
js.pusher.com Amazon RSA 2048 M01	`2023-04-13` - `2024-05-11`	a year	crt.sh
*.github.io DigiCert TLS RSA SHA256 2020 CA1	`2023-02-21` - `2024-03-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://amfrst.com/
Frame ID: 0B7FCC541FFF6F71E8E5F4DC2336A6BB
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

AmFirst

Detected technologies

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+foundation[^>"]+css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

27
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

1435 kB
Transfer

2536 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
amfrst.com/ 29 KB
6 KB 1580ms
1229ms Document
text/html 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx / PHP/7.4.33
Resource Hash: 537883f1cc4dad143fb40840fc3ee1619e0227beaa5c48a965493110fa56bb66

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 5583
content-type: text/html; charset=UTF-8
date: Thu, 30 Nov 2023 07:46:10 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
vary: Accept-Encoding,User-Agent
x-powered-by: PHP/7.4.33

GET
H2 200 css
amfrst.com/css/ 6 KB
7 KB 284ms
281ms Stylesheet
application/octet-stream 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: b97591ae9d9b8a6ce140ac303660bf389d94e9e3ef6ef1c7790ad335b9e7ffe1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
accept-ranges: bytes
etag: "6563b146-1982"
content-length: 6530
content-type: application/octet-stream

GET
H2 200 font-icons.css
amfrst.com/css/ 120 KB
10 KB 157ms
155ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/font-icons.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: b25e2e9de5f01056f1d82b6e8b116ef1977263cd062e5a07e1231e54f9bf7f2e

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
etag: W/"6563b148-1e13a"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 yui-reset.min.css
amfrst.com/css/ 795 B
647 B 285ms
282ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/yui-reset.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: d627ca33e5363a78d00f6d54764f62a4bf75dc50df96ca2e981f94727c7578fc

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
x-accel-version: 0.01
etag: "31b-60b146fd8e200-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 440

GET
H2 200 jquery-ui.min.css
amfrst.com/css/ 31 KB
9 KB 288ms
285ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/jquery-ui.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: d529f2bbe9a7a1e8e64728ff9b6b98b4c4728d0c96a4c9ac771af426b3b220f1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-7a60"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 jquery.daterangepicker.min.css
amfrst.com/css/ 3 KB
1008 B 415ms
413ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/jquery.daterangepicker.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 3a51222482c740ce1726a88edfce871671f7ca57d1b1c0a5c43985779f5ee3c9

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-a4f"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 ext-all.min.css
amfrst.com/css/ 123 KB
23 KB 413ms
411ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/ext-all.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 239c86b52ad53354a9251ab74cf5e01a45d53a91232c0d0f0b890f28e5401d9f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
etag: W/"6563b148-1ecc9"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 base.min.css
amfrst.com/css/ 197 KB
41 KB 419ms
417ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/base.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: c16be91f5b4b750522a8ff4c1c51bc615611efeede8f489dcdd73ee25e2268c0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:46 GMT
server: nginx
etag: W/"6563b14a-313d6"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 grid.min.css
amfrst.com/css/ 6 KB
2 KB 428ms
425ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/grid.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: a43eacfa8a85add113f9ffddbc088919e1719b92b0cf2f8b5233e8d8c4a5a28a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-1864"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 sidebar.min.css
amfrst.com/css/ 3 KB
1 KB 428ms
426ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/sidebar.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 892ca9b21215cb57c26966816d3b5317063921e0120da9eb61b98519cc86def0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
etag: W/"6563b148-ac4"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 iris.shim.desktop.min.css
amfrst.com/css/ 675 B
579 B 429ms
427ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris.shim.desktop.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: dc101eb9f7f9a6f31d2a51a942b2dc3ef82a2ece92c1cbe658cf4cf5c7af688d

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
x-accel-version: 0.01
etag: "2a3-60b146fd8e200-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 373

GET
H2 200 iris.min.css
amfrst.com/css/ 105 KB
20 KB 544ms
542ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 98cb49b101fa72f746242b95b143fba8c96e0ac6fda9ba909c31a049eb40f3a3

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-1a2ba"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 iris-foundation.min.css
amfrst.com/css/ 50 KB
8 KB 547ms
545ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris-foundation.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: e784e6e521174a0667d07a04ff85a965da2eea5ae35e661bad546cc6288c943a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-c878"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 iris-components.shim.desktop.min.css
amfrst.com/css/ 1 KB
708 B 547ms
545ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris-components.shim.desktop.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 6e4c530ffdd490a612029d32a352d4686764773420f1da3a4cccc43f6d1faa42

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-50e"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 iris-foundation(1).min.css
amfrst.com/css/ 51 KB
8 KB 547ms
545ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris-foundation(1).min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: a6a5a41a8c1efa9c117ae2de8a6e8413738eba9509898c8fdf8d72ac28bfb558

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:46 GMT
server: nginx
etag: W/"6563b14a-cba8"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 iris-components.min.css
amfrst.com/css/ 355 KB
61 KB 547ms
546ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris-components.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 5ca7b0a45d403a9d7d0e89aea96162e1024517e23eb8b5f43d0515ac9ce50635

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-58cdb"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 isotope.min.css
amfrst.com/css/ 24 KB
4 KB 547ms
546ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/isotope.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 2638914c44a2856df681c9c7d70d58aabfc2fcd0605198dcf87a490255aa8342

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-6064"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 theme.desktop.min.css
amfrst.com/css/ 56 KB
10 KB 547ms
546ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/theme.desktop.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 2f5b5775a522bcb83690e28e55e32e8569584e5596b26577c9f5f3b09eef627b

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
etag: W/"6563b148-e066"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 fi.desktop.min.css
amfrst.com/css/ 51 KB
12 KB 548ms
546ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/fi.desktop.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 3c1c5be424a13a0921ca4141d2ea18339e5fad64c395f38665f7fb54904e306a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
etag: W/"6563b148-ccb6"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 Logo.png
amfrst.com/css/ 1 MB
1 MB 548ms
547ms Image
image/png 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://amfrst.com/css/Logo.png
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 45e597939bbae1b35678935906d9ed5fc5e6bf095c030297eeca42b7484e7c29

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
accept-ranges: bytes
etag: "6563b148-100000"
content-length: 1048576
content-type: image/png

GET
H2 200 HvEsomv.gif
amfrst.com/css/ 79 KB
79 KB 548ms
547ms Image
image/gif 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://amfrst.com/css/HvEsomv.gif
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 8004dee0278c2b84da9bb5557186174fa1fdefeb899929293873ec5f966895f1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
last-modified: Sun, 26 Nov 2023 20:57:46 GMT
server: nginx
accept-ranges: bytes
etag: "6563b14a-13b5b"
content-length: 80731
content-type: image/gif

GET
H2 200 jquery-3.6.1.min.js Show response
code.jquery.com/ 88 KB
31 KB 53ms
16ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.1.min.js
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:10 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1946857
x-cache: HIT, HIT
content-length: 30957
x-served-by: cache-lga13629-LGA, cache-lin2290033-LIN
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1701330371.729885,VS0,VE0
etag: W/"28feccc0-15e40"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 7, 329838

GET
H2 200 pusher.min.js Show response
js.pusher.com/7.2/ 69 KB
19 KB 100ms
33ms Script
application/javascript 143.204.210.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.pusher.com/7.2/pusher.min.js
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.210.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-210-101.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b39f0b274992d4d7c19b5ce5b56e9020dd1666ad1ee7fc4a378d26679efc6029

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 10:21:15 GMT
content-encoding: gzip
via: 1.1 1f5757b46371746e677236d4fc67d364.cloudfront.net (CloudFront)
last-modified: Fri, 15 Jul 2022 13:45:32 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 1286696
etag: W/"99f7f95a02d32c6b8587afa7e7440d3f"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
x-cache: Hit from cloudfront
cache-control: max-age=2592000
x-amz-cf-id: gSf7F-1OBJbo79GlVCYRY_2XATDSIGR8Y9B5cPCZFfouTwGzyG1Dhg==

GET
H2 200 toaster.js Show response
bigcoke233.github.io/toaster.js/ 2 KB
1 KB 162ms
120ms Script
application/javascript 185.199.109.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://bigcoke233.github.io/toaster.js/toaster.js

Requested by

Host: amfrst.com
URL: https://amfrst.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.153 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-153.github.com

Software

GitHub.com /

Resource Hash

5bf1c27da29b3a047e4bee623f68633c0ed99f09add721bed4430097cdbfe3ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-fastly-request-id: 640e5f83d6a57b66a8996974238160e7429d83c2
strict-transport-security: max-age=31556952
content-encoding: gzip
via: 1.1 varnish
date: Thu, 30 Nov 2023 07:46:10 GMT
age: 0
x-cache: MISS
x-cache-hits: 0
x-proxy-cache: MISS
content-length: 679
x-served-by: cache-lin2290024-LIN
last-modified: Tue, 23 Aug 2022 05:46:50 GMT
server: GitHub.com
x-github-request-id: EA20:69C8:1D54E59:1DCF6D7:65683DC2
x-timer: S1701330371.735491,VS0,VE104
etag: W/"630469ca-740"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
expires: Thu, 30 Nov 2023 07:56:10 GMT

GET
H2 200 toaster.css
bigcoke233.github.io/toaster.js/ 3 KB
980 B 165ms
123ms Stylesheet
text/css 185.199.109.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://bigcoke233.github.io/toaster.js/toaster.css

Requested by

Host: amfrst.com
URL: https://amfrst.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.153 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-153.github.com

Software

GitHub.com /

Resource Hash

49a6845433fa80ce610243532dcca24ed7e67dcb60d73ab35a7d8c271698b91d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-fastly-request-id: 78868e1a3f34bd325dc1083a0f9c1eb04d4eeb1b
strict-transport-security: max-age=31556952
content-encoding: gzip
via: 1.1 varnish
date: Thu, 30 Nov 2023 07:46:10 GMT
age: 0
x-cache: MISS
x-cache-hits: 0
x-proxy-cache: MISS
content-length: 802
x-served-by: cache-lin2290024-LIN
last-modified: Tue, 23 Aug 2022 05:46:50 GMT
server: GitHub.com
x-github-request-id: 5C3E:5F95:296FDAB:2A1D6F0:65683DC2
x-timer: S1701330371.735567,VS0,VE107
etag: W/"630469ca-a45"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-origin-cache: HIT
expires: Thu, 30 Nov 2023 07:56:10 GMT

GET
H2 200 print.min.css
amfrst.com/css/ 8 KB
2 KB 371ms
371ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/print.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 7884e0ce43de8695fc479fc021172bd28358c88237bf9ed33a9b8d2c70b3e3d8

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:11 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-1e09"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 Alkami.woff2
amfrst.com/css/ 52 KB
52 KB 244ms
244ms Font
font/woff2 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/Alkami.woff2
Requested by: Host: amfrst.com
URL: https://amfrst.com/css/font-icons.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: f5f4b674046a09ea54af03379ce0e2a5b3eb3bbe4bdec81d8e3068c5b43fcf28

Request headers

Referer: https://amfrst.com/css/font-icons.css
Origin: https://amfrst.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:46:11 GMT
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
accept-ranges: bytes
etag: "6563b148-ce08"
content-length: 52744
content-type: font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: America's First Federal Credit Union (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amfrst.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8i0gpj7vpgfsd8f0feo6rs5kqm

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amfrst.com
bigcoke233.github.io
code.jquery.com
js.pusher.com
143.204.210.101
151.101.66.137
173.248.144.185
185.199.109.153
239c86b52ad53354a9251ab74cf5e01a45d53a91232c0d0f0b890f28e5401d9f
2638914c44a2856df681c9c7d70d58aabfc2fcd0605198dcf87a490255aa8342
2f5b5775a522bcb83690e28e55e32e8569584e5596b26577c9f5f3b09eef627b
3a51222482c740ce1726a88edfce871671f7ca57d1b1c0a5c43985779f5ee3c9
3c1c5be424a13a0921ca4141d2ea18339e5fad64c395f38665f7fb54904e306a
45e597939bbae1b35678935906d9ed5fc5e6bf095c030297eeca42b7484e7c29
49a6845433fa80ce610243532dcca24ed7e67dcb60d73ab35a7d8c271698b91d
537883f1cc4dad143fb40840fc3ee1619e0227beaa5c48a965493110fa56bb66
5bf1c27da29b3a047e4bee623f68633c0ed99f09add721bed4430097cdbfe3ad
5ca7b0a45d403a9d7d0e89aea96162e1024517e23eb8b5f43d0515ac9ce50635
6e4c530ffdd490a612029d32a352d4686764773420f1da3a4cccc43f6d1faa42
7884e0ce43de8695fc479fc021172bd28358c88237bf9ed33a9b8d2c70b3e3d8
8004dee0278c2b84da9bb5557186174fa1fdefeb899929293873ec5f966895f1
892ca9b21215cb57c26966816d3b5317063921e0120da9eb61b98519cc86def0
98cb49b101fa72f746242b95b143fba8c96e0ac6fda9ba909c31a049eb40f3a3
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a43eacfa8a85add113f9ffddbc088919e1719b92b0cf2f8b5233e8d8c4a5a28a
a6a5a41a8c1efa9c117ae2de8a6e8413738eba9509898c8fdf8d72ac28bfb558
b25e2e9de5f01056f1d82b6e8b116ef1977263cd062e5a07e1231e54f9bf7f2e
b39f0b274992d4d7c19b5ce5b56e9020dd1666ad1ee7fc4a378d26679efc6029
b97591ae9d9b8a6ce140ac303660bf389d94e9e3ef6ef1c7790ad335b9e7ffe1
c16be91f5b4b750522a8ff4c1c51bc615611efeede8f489dcdd73ee25e2268c0
d529f2bbe9a7a1e8e64728ff9b6b98b4c4728d0c96a4c9ac771af426b3b220f1
d627ca33e5363a78d00f6d54764f62a4bf75dc50df96ca2e981f94727c7578fc
dc101eb9f7f9a6f31d2a51a942b2dc3ef82a2ece92c1cbe658cf4cf5c7af688d
e784e6e521174a0667d07a04ff85a965da2eea5ae35e661bad546cc6288c943a
f5f4b674046a09ea54af03379ce0e2a5b3eb3bbe4bdec81d8e3068c5b43fcf28

amfrst.com Open in urlscan Pro 173.248.144.185 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

27 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

1435 kBTransfer

2536 kBSize

1 Cookies

0 Outgoing links

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

amfrst.com Open in urlscan Pro
173.248.144.185 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

1435 kB
Transfer

2536 kB
Size

1
Cookies

27 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!