seecustomerutah.dray-dns.de

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 193.7.200.166, located in Denver, United States and belongs to WEHOSTWEBSITES-COM, US. The main domain is seecustomerutah.dray-dns.de.
TLS certificate: Issued by R3 on July 18th 2022. Valid for: 3 months.

This is the only time seecustomerutah.dray-dns.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: America First Credit Union (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	193.7.200.166 193.7.200.166	30475 (WEHOSTWEB...) (WEHOSTWEBSITES-COM)
1	216.51.43.116 216.51.43.116	2828 (XO-AS15) (XO-AS15)
1	206.81.136.154 206.81.136.154	17150 (AFCU) (AFCU)
1	104.89.17.113 104.89.17.113	16625 (AKAMAI-AS) (AKAMAI-AS)
4	5

1 193.7.200.166 (Denver, United States)

ASN30475 (WEHOSTWEBSITES-COM, US)

seecustomerutah.dray-dns.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.51.43.116 (South Jordan, United States)

ASN2828 (XO-AS15, US)

secure.americafirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.81.136.154 (Ogden, United States)

ASN17150 (AFCU, US)

www.americafirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.89.17.113 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-89-17-113.deploy.static.akamaitechnologies.com

public.cobrowse.oraclecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	americafirst.com secure.americafirst.com — Cisco Umbrella Rank: 230959 www.americafirst.com — Cisco Umbrella Rank: 179881	64 KB
1	oraclecloud.com public.cobrowse.oraclecloud.com — Cisco Umbrella Rank: 11691	12 KB
1	dray-dns.de seecustomerutah.dray-dns.de	9 KB
4	3

	Domain	Requested by
1	public.cobrowse.oraclecloud.com	seecustomerutah.dray-dns.de
1	www.americafirst.com	seecustomerutah.dray-dns.de
1	secure.americafirst.com	seecustomerutah.dray-dns.de
1	seecustomerutah.dray-dns.de
4	4

This site contains links to these domains. Also see Links.

Domain
webaccess45.americafirst.com
www.americafirst.com
portal.hud.gov
www.ncua.gov

Subject Issuer	Validity	Valid
seecustomerutah.dray-dns.de R3	`2022-07-18` - `2022-10-16`	3 months	crt.sh
secure.americafirst.com Sectigo RSA Organization Validation Secure Server CA	`2021-10-25` - `2022-10-25`	a year	crt.sh
www.americafirst.com Sectigo RSA Extended Validation Secure Server CA	`2022-01-27` - `2023-01-27`	a year	crt.sh
*.cobrowse.oraclecloud.com DigiCert SHA2 Secure Server CA	`2021-11-06` - `2022-11-08`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://seecustomerutah.dray-dns.de/
Frame ID: 240A527D7140E68BE0376C208A7362AC
Requests: 5 HTTP requests in this frame

Frame: https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=iygc1h43ow&version=20190514
Frame ID: 6E0BD9C48390D413FFA3CEA051E8851F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

84 kB
Transfer

133 kB
Size

0
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://webaccess45.americafirst.com/auth/Enrollment
Title: Enroll now

Search URL Search Domain Scan URL

URL: https://webaccess45.americafirst.com/auth/ForgottenCredentials/Id
Title: Forgot user ID

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/contact/
Title: Contact us

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/disclosures/membership-agreement.cfm
Title: terms

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/contact/branches.html
Title: branch locator

Search URL Search Domain Scan URL

URL: http://portal.hud.gov/hudportal/HUD?src=/program_offices/fair_housing_equal_opp

Search URL Search Domain Scan URL

URL: https://www.ncua.gov/services/pages/share-insurance.aspx

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/about/disclosures/membership-agreement.cfm#privacyPolicy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.americafirst.com/documents/marketing-email-opt-out.pdf
Title: Email Opt Out Procedure

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
seecustomerutah.dray-dns.de/ 22 KB
9 KB 506ms
156ms Document
text/html 193.7.200.166
WEHOSTWEBSITES-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://seecustomerutah.dray-dns.de/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 193.7.200.166 Denver, United States, ASN30475 (WEHOSTWEBSITES-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 39e59cb7c60e534c44c9630c831a47c056d35eafcfe14e8cafb0213ae1abb3b1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 8477
Content-Type: text/html
Date: Mon, 18 Jul 2022 19:25:11 GMT
ETag: "593e-5e4176f7e4b60-gzip"
Keep-Alive: timeout=60
Last-Modified: Mon, 18 Jul 2022 17:09:49 GMT
Server: nginx
Vary: Accept-Encoding

GET
H/1.1 200 logo-desktop-inverse.a3a99f3a.png
secure.americafirst.com/img/ 9 KB
9 KB 955ms
168ms Image
image/png 216.51.43.116
XO-AS15

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.americafirst.com/img/logo-desktop-inverse.a3a99f3a.png
Requested by: Host: seecustomerutah.dray-dns.de
URL: https://seecustomerutah.dray-dns.de/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 216.51.43.116 South Jordan, United States, ASN2828 (XO-AS15, US),
Reverse DNS
Software: /
Resource Hash: c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://seecustomerutah.dray-dns.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 18 Jul 2022 19:25:11 GMT
Via: NS-CACHE-10.0: 155
Last-Modified: Wed, 18 May 2022 02:55:54 GMT
Age: 2
ETag: W/"8898-1652842554000"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 8898

GET
H/1.1 200
OK eagle-inverse.png
www.americafirst.com/content/dam/general/ 54 KB
55 KB 1803ms
167ms Image
image/png 206.81.136.154
AFCU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.americafirst.com/content/dam/general/eagle-inverse.png

Requested by

Host: seecustomerutah.dray-dns.de
URL: https://seecustomerutah.dray-dns.de/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

206.81.136.154 Ogden, United States, ASN17150 (AFCU, US),

Reverse DNS

Software

Apache /

Resource Hash

4c2f9e3884701acbb2bcb1d909abb00fb7f336644ca3b295ad3bb9fd192bf6b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.americafirst.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://apps.americafirst.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://seecustomerutah.dray-dns.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 18 Jul 2022 19:25:12 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Server: Apache
Content-Security-Policy: frame-ancestors https://*.americafirst.com;
X-Frame-Options: ALLOW-FROM https://apps.americafirst.com
Content-Type: image/png
Cache-Control: max-age=2592000
Content-Disposition: inline
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: X-Forwarded-For
Content-Length: 55354
Keep-Alive: timeout=5, max=99
Expires: Wed, 17 Aug 2022 19:25:12 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ll_storage_html5.html Show response
public.cobrowse.oraclecloud.com/rely/storage/ Frame 6E0B 43 KB
12 KB 233ms
39ms Document
text/html 104.89.17.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=iygc1h43ow&version=20190514
Requested by: Host: seecustomerutah.dray-dns.de
URL: https://seecustomerutah.dray-dns.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.17.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-17-113.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d4637eb830c4e16d44715277642270f0088ff631f1f338dbf377403b87d13f6d

Request headers

Referer: https://seecustomerutah.dray-dns.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 11698
content-type: text/html
date: Mon, 18 Jul 2022 19:25:11 GMT
etag: "b7b7e70ac037b592aef8c274d8e66a71:1634875896.03281"
last-modified: Thu, 21 Oct 2021 23:11:35 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: America First Credit Union (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

public.cobrowse.oraclecloud.com
secure.americafirst.com
seecustomerutah.dray-dns.de
www.americafirst.com
104.89.17.113
193.7.200.166
206.81.136.154
216.51.43.116
39e59cb7c60e534c44c9630c831a47c056d35eafcfe14e8cafb0213ae1abb3b1
4c2f9e3884701acbb2bcb1d909abb00fb7f336644ca3b295ad3bb9fd192bf6b8
a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821
c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54
d4637eb830c4e16d44715277642270f0088ff631f1f338dbf377403b87d13f6d
df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b

seecustomerutah.dray-dns.de Open in urlscan Pro 193.7.200.166 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

5 IPs

2 Countries

84 kBTransfer

133 kBSize

0 Cookies

9 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

seecustomerutah.dray-dns.de Open in urlscan Pro
193.7.200.166 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

84 kB
Transfer

133 kB
Size

0
Cookies

4 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!