americafirstcu.s3.fr-par.scw.cloud

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 2001:bc8:10::8, located in France and belongs to Online SAS, FR. The main domain is americafirstcu.s3.fr-par.scw.cloud.
TLS certificate: Issued by R3 on May 26th 2023. Valid for: 3 months.

This is the only time americafirstcu.s3.fr-par.scw.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: America First Credit Union (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	2001:bc8:10::8 2001:bc8:10::8	12876 (Online SAS) (Online SAS)
1	192.229.221.25 192.229.221.25	15133 (EDGECAST) (EDGECAST)
1	2600:9000:220... 2600:9000:2204:d000:1e:10d6:de40:93a1	16509 (AMAZON-02) (AMAZON-02)
3	3

1 2001:bc8:10::8 (France)

ASN12876 (Online SAS, FR)

americafirstcu.s3.fr-par.scw.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.221.25 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2204:d000:1e:10d6:de40:93a1 (United States)

ASN16509 (AMAZON-02, US)

hubspot.mx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	mx.com hubspot.mx.com	47 KB
1	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 2334	14 KB
1	scw.cloud americafirstcu.s3.fr-par.scw.cloud	13 KB
3	3

	Domain	Requested by
1	hubspot.mx.com	americafirstcu.s3.fr-par.scw.cloud
1	www.paypalobjects.com	americafirstcu.s3.fr-par.scw.cloud
1	americafirstcu.s3.fr-par.scw.cloud
3	3

This site contains no links.

Subject Issuer	Validity	Valid
s3.fr-par.scw.cloud R3	`2023-05-26` - `2023-08-24`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2022-11-09` - `2023-12-10`	a year	crt.sh
cdn.mx.com Amazon RSA 2048 M01	`2023-03-26` - `2024-04-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://americafirstcu.s3.fr-par.scw.cloud/AmeriaFirstCreditUnionAmerifirtcuonlineorgAMERICAFIRSTcustomerverificationpageAFCUAmericaFirstCreditUnionLogIn.html
Frame ID: 542C4F67E2117DF343A354FB1D3D0CCA
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

America First Credit Union

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

Page Statistics

3
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

75 kB
Transfer

136 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request AmeriaFirstCreditUnionAmerifirtcuonlineorgAMERICAFIRSTcustomerverificationpageAFCUAmericaFirstCreditUnionLogIn.html Show response
americafirstcu.s3.fr-par.scw.cloud/ 13 KB
13 KB 164ms
68ms Document
text/html 2001:bc8:10::8
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://americafirstcu.s3.fr-par.scw.cloud/AmeriaFirstCreditUnionAmerifirtcuonlineorgAMERICAFIRSTcustomerverificationpageAFCUAmericaFirstCreditUnionLogIn.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:bc8:10::8 , France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: /
Resource Hash: b45d294f4ef81c79387b53d0b4d714c5c59ee18e0f60ef6d0e38ad1f6d2d4ccf

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

accept-ranges: bytes
content-length: 13442
content-type: text/html
date: Tue, 08 Aug 2023 11:14:20 GMT
etag: "df51dada24662e0fec474055d6050fa1"
last-modified: Sun, 06 Aug 2023 21:10:41 GMT
x-amz-id-2: tx38029678186f489fbf02d-0064d2238c
x-amz-request-id: tx38029678186f489fbf02d-0064d2238c
x-amz-version-id: 1691356241370911

GET
H2 200 contextualLogin.css
www.paypalobjects.com/web/res/e3a/65c5f2465e43c2598eadb20766d07/css/ 76 KB
14 KB 101ms
21ms Stylesheet
text/css 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/e3a/65c5f2465e43c2598eadb20766d07/css/contextualLogin.css

Requested by

Host: americafirstcu.s3.fr-par.scw.cloud
URL: https://americafirstcu.s3.fr-par.scw.cloud/AmeriaFirstCreditUnionAmerifirtcuonlineorgAMERICAFIRSTcustomerverificationpageAFCUAmericaFirstCreditUnionLogIn.html

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (paa/6F06) /

Resource Hash

1d54636adccbd69d6fd62863a1ee72ef855b01808cec683e7bac9df009e37b7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://americafirstcu.s3.fr-par.scw.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 08 Aug 2023 11:14:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: HIT
paypal-debug-id: 6448764606716
dc: ccg11-origin-www-1.paypal.com
content-length: 13525
last-modified: Fri, 09 Nov 2018 15:41:31 GMT
server: ECAcc (paa/6F06)
traceparent: 00-00000000000000000006448764606716-abafdcec965a58f0-01
etag: W/"5be5aaab-12e07"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, s-maxage=31536000
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-headers: x-csrf-token
expires: Wed, 07 Aug 2024 11:14:20 GMT

GET
H2 200 AFCU%20logo-1.jpg
hubspot.mx.com/hubfs/ 47 KB
47 KB 128ms
25ms Image
image/jpeg 2600:9000:2204:d000:1e:10d6:de40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hubspot.mx.com/hubfs/AFCU%20logo-1.jpg
Requested by: Host: americafirstcu.s3.fr-par.scw.cloud
URL: https://americafirstcu.s3.fr-par.scw.cloud/AmeriaFirstCreditUnionAmerifirtcuonlineorgAMERICAFIRSTcustomerverificationpageAFCUAmericaFirstCreditUnionLogIn.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d000:1e:10d6:de40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0daa202182a9b4261b8c702f61662eee4e94e1cb3bfcaaabe11e74f3587c1836

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://americafirstcu.s3.fr-par.scw.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 23:08:17 GMT
via: 1.1 e7150584c93f85e64aa53364c55a16c6.cloudfront.net (CloudFront)
last-modified: Mon, 22 Jun 2020 22:20:04 GMT
server: AmazonS3
x-amz-cf-pop: AMS50-C1
age: 43564
etag: "23b1e872c970c5d5f2b5877a7e145aec"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 48167
x-amz-cf-id: xXp5B5A_XAtzmubneUJFAtuxfyLvQlxpiwUCkreqXWOJYyvfSk1AuQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: America First Credit Union (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

americafirstcu.s3.fr-par.scw.cloud
hubspot.mx.com
www.paypalobjects.com
192.229.221.25
2001:bc8:10::8
2600:9000:2204:d000:1e:10d6:de40:93a1
0daa202182a9b4261b8c702f61662eee4e94e1cb3bfcaaabe11e74f3587c1836
1d54636adccbd69d6fd62863a1ee72ef855b01808cec683e7bac9df009e37b7c
b45d294f4ef81c79387b53d0b4d714c5c59ee18e0f60ef6d0e38ad1f6d2d4ccf

americafirstcu.s3.fr-par.scw.cloud Open in urlscan Pro 2001:bc8:10::8 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

75 kBTransfer

136 kBSize

0 Cookies

0 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

americafirstcu.s3.fr-par.scw.cloud Open in urlscan Pro
2001:bc8:10::8 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

75 kB
Transfer

136 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!