amfrst.com Open in urlscan Pro
173.248.144.185 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://amfrst.com/
Effective URL:
https://amfrst.com/
Submission Tags: @ecarlesi threat phishing Search All
Submission: On November 30 via api (November 30th 2023, 8:41:12 am UTC) from IT — Scanned from IT

Summary HTTP 27 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 27 HTTP transactions. The main IP is 173.248.144.185, located in United States and belongs to WEHOSTWEBSITES-COM, US. The main domain is amfrst.com.
TLS certificate: Issued by R3 on November 29th 2023. Valid for: 3 months.

This is the only time amfrst.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: America's First Federal Credit Union (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 24	173.248.144.185 173.248.144.185	30475 (WEHOSTWEB...) (WEHOSTWEBSITES-COM)
1	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
1	143.204.210.101 143.204.210.101	16509 (AMAZON-02) (AMAZON-02)
2	185.199.110.153 185.199.110.153	54113 (FASTLY) (FASTLY)
27	4

24 173.248.144.185 (United States) 1 redirects

ASN30475 (WEHOSTWEBSITES-COM, US)
PTR: 173-248-144-185.static.x5x-noc.ru

amfrst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.210.101 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-210-101.fra53.r.cloudfront.net

js.pusher.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.199.110.153 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-110-153.github.com

bigcoke233.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	amfrst.com 1 redirects amfrst.com	1 MB
2	github.io bigcoke233.github.io	2 KB
1	pusher.com js.pusher.com — Cisco Umbrella Rank: 15569	19 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 735	31 KB
27	4

	Domain	Requested by
24	amfrst.com	1 redirects amfrst.com
2	bigcoke233.github.io	amfrst.com
1	js.pusher.com	amfrst.com
1	code.jquery.com	amfrst.com
27	4

This site contains no links.

Subject Issuer	Validity	Valid
amfrst.com R3	`2023-11-29` - `2024-02-27`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
js.pusher.com Amazon RSA 2048 M01	`2023-04-13` - `2024-05-11`	a year	crt.sh
*.github.io DigiCert TLS RSA SHA256 2020 CA1	`2023-02-21` - `2024-03-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://amfrst.com/
Frame ID: E2EF3AE1580D6CC326C52DD122E07B3C
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

AmFirst

Page URL History Show full URLs

http://amfrst.com/ HTTP 301
https://amfrst.com/ Page URL

Detected technologies

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+foundation[^>"]+css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

27
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

1435 kB
Transfer

2536 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://amfrst.com/ HTTP 301
https://amfrst.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
amfrst.com/
Redirect Chain

http://amfrst.com/
https://amfrst.com/

29 KB
6 KB

1522ms
1227ms

Document
text/html

173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx / PHP/7.4.33
Resource Hash: 537883f1cc4dad143fb40840fc3ee1619e0227beaa5c48a965493110fa56bb66

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 5583
content-type: text/html; charset=UTF-8
date: Thu, 30 Nov 2023 08:41:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
vary: Accept-Encoding,User-Agent
x-powered-by: PHP/7.4.33

Redirect headers

Connection: keep-alive
Content-Length: 162
Content-Type: text/html
Date: Thu, 30 Nov 2023 08:41:06 GMT
Location: https://amfrst.com/
Server: nginx

GET
H2 200 css
amfrst.com/css/ 6 KB
7 KB 156ms
152ms Stylesheet
application/octet-stream 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: b97591ae9d9b8a6ce140ac303660bf389d94e9e3ef6ef1c7790ad335b9e7ffe1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
accept-ranges: bytes
etag: "6563b146-1982"
content-length: 6530
content-type: application/octet-stream

GET
H2 200 font-icons.css
amfrst.com/css/ 120 KB
10 KB 285ms
281ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/font-icons.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: b25e2e9de5f01056f1d82b6e8b116ef1977263cd062e5a07e1231e54f9bf7f2e

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
etag: W/"6563b148-1e13a"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 yui-reset.min.css
amfrst.com/css/ 795 B
647 B 157ms
154ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/yui-reset.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: d627ca33e5363a78d00f6d54764f62a4bf75dc50df96ca2e981f94727c7578fc

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
x-accel-version: 0.01
etag: "31b-60b146fd8e200-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 440

GET
H2 200 jquery-ui.min.css
amfrst.com/css/ 31 KB
9 KB 288ms
285ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/jquery-ui.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: d529f2bbe9a7a1e8e64728ff9b6b98b4c4728d0c96a4c9ac771af426b3b220f1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-7a60"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 jquery.daterangepicker.min.css
amfrst.com/css/ 3 KB
1008 B 289ms
286ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/jquery.daterangepicker.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 3a51222482c740ce1726a88edfce871671f7ca57d1b1c0a5c43985779f5ee3c9

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-a4f"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 ext-all.min.css
amfrst.com/css/ 123 KB
23 KB 294ms
291ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/ext-all.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 239c86b52ad53354a9251ab74cf5e01a45d53a91232c0d0f0b890f28e5401d9f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
etag: W/"6563b148-1ecc9"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 base.min.css
amfrst.com/css/ 197 KB
41 KB 419ms
416ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/base.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: c16be91f5b4b750522a8ff4c1c51bc615611efeede8f489dcdd73ee25e2268c0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:46 GMT
server: nginx
etag: W/"6563b14a-313d6"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 grid.min.css
amfrst.com/css/ 6 KB
2 KB 415ms
412ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/grid.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: a43eacfa8a85add113f9ffddbc088919e1719b92b0cf2f8b5233e8d8c4a5a28a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-1864"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 sidebar.min.css
amfrst.com/css/ 3 KB
1 KB 426ms
423ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/sidebar.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 892ca9b21215cb57c26966816d3b5317063921e0120da9eb61b98519cc86def0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
etag: W/"6563b148-ac4"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 iris.shim.desktop.min.css
amfrst.com/css/ 675 B
579 B 427ms
424ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris.shim.desktop.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: dc101eb9f7f9a6f31d2a51a942b2dc3ef82a2ece92c1cbe658cf4cf5c7af688d

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
x-accel-version: 0.01
etag: "2a3-60b146fd8e200-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 373

GET
H2 200 iris.min.css
amfrst.com/css/ 105 KB
20 KB 430ms
428ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 98cb49b101fa72f746242b95b143fba8c96e0ac6fda9ba909c31a049eb40f3a3

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-1a2ba"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 iris-foundation.min.css
amfrst.com/css/ 50 KB
8 KB 428ms
426ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris-foundation.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: e784e6e521174a0667d07a04ff85a965da2eea5ae35e661bad546cc6288c943a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-c878"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 iris-components.shim.desktop.min.css
amfrst.com/css/ 1 KB
708 B 430ms
428ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris-components.shim.desktop.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 6e4c530ffdd490a612029d32a352d4686764773420f1da3a4cccc43f6d1faa42

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-50e"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 iris-foundation(1).min.css
amfrst.com/css/ 51 KB
8 KB 431ms
428ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris-foundation(1).min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: a6a5a41a8c1efa9c117ae2de8a6e8413738eba9509898c8fdf8d72ac28bfb558

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:46 GMT
server: nginx
etag: W/"6563b14a-cba8"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 iris-components.min.css
amfrst.com/css/ 355 KB
61 KB 431ms
429ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/iris-components.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 5ca7b0a45d403a9d7d0e89aea96162e1024517e23eb8b5f43d0515ac9ce50635

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-58cdb"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 isotope.min.css
amfrst.com/css/ 24 KB
4 KB 431ms
429ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/isotope.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 2638914c44a2856df681c9c7d70d58aabfc2fcd0605198dcf87a490255aa8342

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-6064"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 theme.desktop.min.css
amfrst.com/css/ 56 KB
10 KB 431ms
429ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/theme.desktop.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 2f5b5775a522bcb83690e28e55e32e8569584e5596b26577c9f5f3b09eef627b

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
etag: W/"6563b148-e066"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 fi.desktop.min.css
amfrst.com/css/ 51 KB
12 KB 432ms
430ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/fi.desktop.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 3c1c5be424a13a0921ca4141d2ea18339e5fad64c395f38665f7fb54904e306a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
etag: W/"6563b148-ccb6"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 Logo.png
amfrst.com/css/ 1 MB
1 MB 432ms
430ms Image
image/png 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://amfrst.com/css/Logo.png
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 45e597939bbae1b35678935906d9ed5fc5e6bf095c030297eeca42b7484e7c29

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
accept-ranges: bytes
etag: "6563b148-100000"
content-length: 1048576
content-type: image/png

GET
H2 200 HvEsomv.gif
amfrst.com/css/ 79 KB
79 KB 432ms
430ms Image
image/gif 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://amfrst.com/css/HvEsomv.gif
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 8004dee0278c2b84da9bb5557186174fa1fdefeb899929293873ec5f966895f1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
last-modified: Sun, 26 Nov 2023 20:57:46 GMT
server: nginx
accept-ranges: bytes
etag: "6563b14a-13b5b"
content-length: 80731
content-type: image/gif

GET
H2 200 jquery-3.6.1.min.js Show response
code.jquery.com/ 88 KB
31 KB 53ms
17ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.1.min.js
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:07 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1950154
x-cache: HIT, HIT
content-length: 30957
x-served-by: cache-lga13629-LGA, cache-lin2290026-LIN
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1701333668.994090,VS0,VE0
etag: W/"28feccc0-15e40"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 7, 1810

GET
H2 200 pusher.min.js Show response
js.pusher.com/7.2/ 69 KB
19 KB 140ms
34ms Script
application/javascript 143.204.210.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.pusher.com/7.2/pusher.min.js
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.210.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-210-101.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b39f0b274992d4d7c19b5ce5b56e9020dd1666ad1ee7fc4a378d26679efc6029

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 10:21:15 GMT
content-encoding: gzip
via: 1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront)
last-modified: Fri, 15 Jul 2022 13:45:32 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 1289994
etag: W/"99f7f95a02d32c6b8587afa7e7440d3f"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
x-cache: Hit from cloudfront
cache-control: max-age=2592000
x-amz-cf-id: aaLbDwnLWGitTKl5U2JeRNvWMXU184FfnyPG0Zq-OiVxR_RylnQKbA==

GET
H2 200 toaster.js Show response
bigcoke233.github.io/toaster.js/ 2 KB
850 B 163ms
126ms Script
application/javascript 185.199.110.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://bigcoke233.github.io/toaster.js/toaster.js

Requested by

Host: amfrst.com
URL: https://amfrst.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.110.153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-110-153.github.com

Software

GitHub.com /

Resource Hash

5bf1c27da29b3a047e4bee623f68633c0ed99f09add721bed4430097cdbfe3ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-fastly-request-id: 2a225fba0a82b6c5ce6c08d76155eefe1683dfce
strict-transport-security: max-age=31556952
content-encoding: gzip
via: 1.1 varnish
date: Thu, 30 Nov 2023 08:41:08 GMT
age: 0
x-cache: HIT
x-cache-hits: 1
x-proxy-cache: MISS
content-length: 679
x-served-by: cache-lin2290025-LIN
last-modified: Tue, 23 Aug 2022 05:46:50 GMT
server: GitHub.com
x-github-request-id: EA20:69C8:1D54E59:1DCF6D7:65683DC2
x-timer: S1701333668.995050,VS0,VE109
etag: W/"630469ca-740"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
expires: Thu, 30 Nov 2023 07:56:10 GMT

GET
H2 200 toaster.css
bigcoke233.github.io/toaster.js/ 3 KB
1 KB 162ms
125ms Stylesheet
text/css 185.199.110.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://bigcoke233.github.io/toaster.js/toaster.css

Requested by

Host: amfrst.com
URL: https://amfrst.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.110.153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-110-153.github.com

Software

GitHub.com /

Resource Hash

49a6845433fa80ce610243532dcca24ed7e67dcb60d73ab35a7d8c271698b91d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-fastly-request-id: f7aa0e237394887141c698168f7f1cad23b5aefa
strict-transport-security: max-age=31556952
content-encoding: gzip
via: 1.1 varnish
date: Thu, 30 Nov 2023 08:41:08 GMT
age: 0
x-cache: HIT
x-cache-hits: 1
x-proxy-cache: MISS
content-length: 802
x-served-by: cache-lin2290025-LIN
last-modified: Tue, 23 Aug 2022 05:46:50 GMT
server: GitHub.com
x-github-request-id: 5C3E:5F95:296FDAB:2A1D6F0:65683DC2
x-timer: S1701333668.995033,VS0,VE108
etag: W/"630469ca-a45"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-origin-cache: HIT
expires: Thu, 30 Nov 2023 07:56:10 GMT

GET
H2 200 print.min.css
amfrst.com/css/ 8 KB
2 KB 368ms
368ms Stylesheet
text/css 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/print.min.css
Requested by: Host: amfrst.com
URL: https://amfrst.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: 7884e0ce43de8695fc479fc021172bd28358c88237bf9ed33a9b8d2c70b3e3d8

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://amfrst.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
content-encoding: gzip
last-modified: Sun, 26 Nov 2023 20:57:42 GMT
server: nginx
etag: W/"6563b146-1e09"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 Alkami.woff2
amfrst.com/css/ 52 KB
52 KB 333ms
333ms Font
font/woff2 173.248.144.185
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://amfrst.com/css/Alkami.woff2
Requested by: Host: amfrst.com
URL: https://amfrst.com/css/font-icons.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.248.144.185 , United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS: 173-248-144-185.static.x5x-noc.ru
Software: nginx /
Resource Hash: f5f4b674046a09ea54af03379ce0e2a5b3eb3bbe4bdec81d8e3068c5b43fcf28

Request headers

Referer: https://amfrst.com/css/font-icons.css
Origin: https://amfrst.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:41:08 GMT
last-modified: Sun, 26 Nov 2023 20:57:44 GMT
server: nginx
accept-ranges: bytes
etag: "6563b148-ce08"
content-length: 52744
content-type: font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: America's First Federal Credit Union (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amfrst.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8iddqit9ce3o2v1208ptk9aa5t

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amfrst.com
bigcoke233.github.io
code.jquery.com
js.pusher.com
143.204.210.101
151.101.66.137
173.248.144.185
185.199.110.153
239c86b52ad53354a9251ab74cf5e01a45d53a91232c0d0f0b890f28e5401d9f
2638914c44a2856df681c9c7d70d58aabfc2fcd0605198dcf87a490255aa8342
2f5b5775a522bcb83690e28e55e32e8569584e5596b26577c9f5f3b09eef627b
3a51222482c740ce1726a88edfce871671f7ca57d1b1c0a5c43985779f5ee3c9
3c1c5be424a13a0921ca4141d2ea18339e5fad64c395f38665f7fb54904e306a
45e597939bbae1b35678935906d9ed5fc5e6bf095c030297eeca42b7484e7c29
49a6845433fa80ce610243532dcca24ed7e67dcb60d73ab35a7d8c271698b91d
537883f1cc4dad143fb40840fc3ee1619e0227beaa5c48a965493110fa56bb66
5bf1c27da29b3a047e4bee623f68633c0ed99f09add721bed4430097cdbfe3ad
5ca7b0a45d403a9d7d0e89aea96162e1024517e23eb8b5f43d0515ac9ce50635
6e4c530ffdd490a612029d32a352d4686764773420f1da3a4cccc43f6d1faa42
7884e0ce43de8695fc479fc021172bd28358c88237bf9ed33a9b8d2c70b3e3d8
8004dee0278c2b84da9bb5557186174fa1fdefeb899929293873ec5f966895f1
892ca9b21215cb57c26966816d3b5317063921e0120da9eb61b98519cc86def0
98cb49b101fa72f746242b95b143fba8c96e0ac6fda9ba909c31a049eb40f3a3
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a43eacfa8a85add113f9ffddbc088919e1719b92b0cf2f8b5233e8d8c4a5a28a
a6a5a41a8c1efa9c117ae2de8a6e8413738eba9509898c8fdf8d72ac28bfb558
b25e2e9de5f01056f1d82b6e8b116ef1977263cd062e5a07e1231e54f9bf7f2e
b39f0b274992d4d7c19b5ce5b56e9020dd1666ad1ee7fc4a378d26679efc6029
b97591ae9d9b8a6ce140ac303660bf389d94e9e3ef6ef1c7790ad335b9e7ffe1
c16be91f5b4b750522a8ff4c1c51bc615611efeede8f489dcdd73ee25e2268c0
d529f2bbe9a7a1e8e64728ff9b6b98b4c4728d0c96a4c9ac771af426b3b220f1
d627ca33e5363a78d00f6d54764f62a4bf75dc50df96ca2e981f94727c7578fc
dc101eb9f7f9a6f31d2a51a942b2dc3ef82a2ece92c1cbe658cf4cf5c7af688d
e784e6e521174a0667d07a04ff85a965da2eea5ae35e661bad546cc6288c943a
f5f4b674046a09ea54af03379ce0e2a5b3eb3bbe4bdec81d8e3068c5b43fcf28

amfrst.com Open in urlscan Pro 173.248.144.185 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

27 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

1435 kBTransfer

2536 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

amfrst.com Open in urlscan Pro
173.248.144.185 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

1435 kB
Transfer

2536 kB
Size

1
Cookies

27 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!