effectinginterior.ro Open in urlscan Pro
89.42.218.10  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.html Show response effectinginterior.ro/.well-known/afcu_re6/	4 KB 2 KB	218ms 48ms	Document text/html	89.42.218.10 ROMARG HOSTING
General Check archive.org Show headers Download Go to Full URL https://effectinginterior.ro/.well-known/afcu_re6/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.42.218.10 , Romania, ASN205275 (ROMARG HOSTING, RO), Reverse DNS server-0390.whmpanels.com Software LiteSpeed / Resource Hash e55859e708e056a5d8d3005cd4b15e26ce600276e772ab271981d08a00a952f4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-length 1299 content-type text/html date Mon, 29 Apr 2024 06:25:52 GMT last-modified Tue, 23 Apr 2024 02:37:32 GMT server LiteSpeed vary Accept-Encoding x-content-type-options nosniff x-xss-protection 1; mode=block
GET H3	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/	87 KB 28 KB	66ms 39ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: effectinginterior.ro URL: https://effectinginterior.ro/.well-known/afcu_re6/index.html Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://effectinginterior.ro/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 29 Apr 2024 06:25:54 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 379938 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27958 last-modified Mon, 04 May 2020 23:01:39 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb09ed3-15d84" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EGRlsaGI58zVenf8GtAttAtfHiSZEMsG3EIJRivKAjfWk%2BvR0GjzmT%2FyH3cdWEMjJZFL4EHPXfzfnAuH3I22YG9xSTmRmWrA23%2FKWUnBU5BQ4dLpWXq9nOJzaJC7Fm%2F9wvGp30%2Fx"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 87bd37a8bc2e3a61-FRA expires Sat, 19 Apr 2025 06:25:54 GMT
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	70ms 22ms	Script application/javascript	2a04:4e42:600::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: effectinginterior.ro URL: https://effectinginterior.ro/.well-known/afcu_re6/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://effectinginterior.ro/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 29 Apr 2024 06:25:54 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 228135 x-cache HIT, HIT content-length 30875 x-served-by cache-lga21931-LGA, cache-fra-etou8220091-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1714371954.056210,VS0,VE0 etag W/"28feccc0-15d9d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 1, 97844
GET H2	200	logo-desktop-inverse.a3a99f3a.png secure.americafirst.com/img/	9 KB 9 KB	561ms 210ms	Image image/png	172.64.147.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://secure.americafirst.com/img/logo-desktop-inverse.a3a99f3a.png Requested by Host: effectinginterior.ro URL: https://effectinginterior.ro/.well-known/afcu_re6/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.147.148 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://effectinginterior.ro/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 29 Apr 2024 06:25:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT x-oneagent-js-injection true server-timing dtRpid;desc="1857736772", dtSInfo;desc="0" content-length 8898 last-modified Thu, 11 Apr 2024 09:28:22 GMT server cloudflare etag W/"8898-1712827702000" vary Accept-Encoding content-type image/png cache-control public, max-age=14400 accept-ranges bytes cf-ray 87bd37aabe814504-TXL expires Mon, 29 Apr 2024 10:25:54 GMT
GET H2	200	favicon.ico secure.americafirst.com/	1 KB 740 B	678ms 678ms	Other image/x-icon	172.64.147.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://secure.americafirst.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.147.148 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0534a1a2f971f20a153479d5e01ad4051a8af96221bb5f7c80ff06a759d1ea2e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://effectinginterior.ro/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 29 Apr 2024 06:25:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT last-modified Thu, 11 Apr 2024 09:28:22 GMT server cloudflare content-encoding gzip etag W/"1150-1712827702000" vary Accept-Encoding content-type image/x-icon x-oneagent-js-injection true cache-control public, max-age=14400 server-timing dtRpid;desc="-2073732229", dtSInfo;desc="0" cf-ray 87bd37ac198c4504-TXL expires Mon, 29 Apr 2024 10:25:55 GMT
GET H2	200	favicon.ico secure.americafirst.com/	1 KB 0	0ms 0ms	Other image/x-icon	172.64.147.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://secure.americafirst.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.147.148 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0534a1a2f971f20a153479d5e01ad4051a8af96221bb5f7c80ff06a759d1ea2e Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://effectinginterior.ro/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 29 Apr 2024 06:25:55 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Thu, 11 Apr 2024 09:28:22 GMT server cloudflare etag W/"1150-1712827702000" vary Accept-Encoding content-type image/x-icon x-oneagent-js-injection true cache-control public, max-age=14400 server-timing dtRpid;desc="-2073732229", dtSInfo;desc="0" cf-ray 87bd37ac198c4504-TXL expires Mon, 29 Apr 2024 10:25:55 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: America First Credit Union (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| _0x32d0 function| _0x386aac function| _0x5a0b function| setCookie

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.americafirst.com/	1970-01-20 20:12:53	Name: __cf_bm Value: 2_wsKeohLQ_XQATgbsE3wYzz54J9VRDJtwDk.n8.ntg-1714371954-1.0.1.1-lS1arc1qEAk3xczwXRzgbBEiSi3SICXHTWbi4JJhWcHEhUBTmM9qSgr9vREyCZGgdboHOm6.feBDUtV0KUCYtg

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://effectinginterior.ro/.well-known/afcu_re6/index.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://effectinginterior.ro/.well-known/afcu_re6/index.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
code.jquery.com
effectinginterior.ro
secure.americafirst.com
104.17.25.14
172.64.147.148
2a04:4e42:600::649
89.42.218.10
0534a1a2f971f20a153479d5e01ad4051a8af96221bb5f7c80ff06a759d1ea2e
c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54
e55859e708e056a5d8d3005cd4b15e26ce600276e772ab271981d08a00a952f4
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e