Summary

America First Credit Union is a federally chartered credit union headquartered in Riverdale, Utah, United States. As of January 2020, America First was the sixth largest credit union in the United States in terms of total membership and ninth largest credit union in assets in the U.S.

During our PreCrime internet scout of 15 July 2022 we identified suspicious markers across multiple vectors. One of those was this website spoof that could be targeting unsuspecting bank clients.

The Attack

Under review af-cubank[.]online site seems to be a threat to americafirst[.]com

The website’s visual signature includes screenshots, font styles, images, page layouts, logos, etc. Thus, a simple visual scan cannot identify the fresh phishing websites and generates a high false-negative rate (phishing to benign).

The similarities are very clear as the both websites have the same logo, color scheme and the same formatting. Someone can easily think that AF-CU is America’s First Credit Union.

Reasons to think this is associated with AmericaFirst

• Both websites have the same logo.
• Both websites have the same formatting.
• Both websites have the same color scheme.
• Someone can think AF-CU is America’s First Credit Union.

Technical Breakdown

Website Analysis of af-cubank.online – Threat Intelligence Platform

IP, Web, SSL, Malware, WHOIS, MX, and NS analysis on af-cubank.online

Threat Intelligence Platform

Website Analysis of af-cubank.online – Threat Intelligence Platform

• The SSL certificate was obtained recently (2022-07-13).
• The mail server is in various blacklists – mostly mail servers get blacklisted because of spamming. Blocking mail servers allows other mail servers to check if an email from an IP address might have possibly been flagged for sending spam in the past.

Also, af-cubank[.]online domain has the IP address “199.188.200.223”.

Our extensive observation engine has an early detection and fast classification on this alert. Therefore, when looking for any other domains related to this IP, there are many of them and they’re related to trading, banks, and crypto. All of them including af-cubank[.]online are registered with NAMECHEAP INC which is different than the registrar on the official domain.

https://securitytrails.com/list/ip/199.188.200.223

1. thetechnologybase.com
2. letsmeditate.co
3. ndgames.store
4. fashionblogpage.com
5. afastcompany.com
6. sixfigurevisibilityandimpact.com
7. upheavalarts.com
8. xairforce.com
9. treetab.co
10. badcanton.ch
11. club-des-chefs-des-chefs.com
12. basketball-training.org.ua
13. gashhuds.com
14. rachelmonosov.com
15. www.thetechnologybase.com
16. musemaster.net
17. faizeislam.net
18. heritage.fullbellyfoodgroup.com
19. moore.com
20. heritagerestaurant.fullbellyfoodgroup.com
21. alhamdislamictutor.com
22. oakandhearth.com
23. shorteez.xyz
24. cddvdlabelmaker.com
25. couponsaustralia.net
26. envato.musemaster.net
27. webmail.knewport7.fun
28. whm.taste-me.co.uk
29. mail.hexfour.com
30. autoconfig.dressnu.net
31. cpanel.omprakash.co.uk
32. webdisk.bethelmortgagesolutions.com
33. ftp.geocachables.com
34. cpcalendars.goldfitnessprime.com
35. cpanel.jobaxy.xyz
36. www.leslye.nephilanet.com
37. www.idiomas.arequipavalley.com
38. webmail.hometrackcouriers.com
39. ftp.paribhraman.in
40. www.stufforhumans.com.au
41. management.vikatservices.tech
42. ftp.azuwapharmacy-bd.com
43. autoconfig.fabianalopes.com
44. webmail.harwig.com
45. ftp.rattiotech.com
46. mail.vromonguru.com
47. cpanel.1702london.com
48. cpcalendars.mock-api.addisapps.com
49. webmail.kishagame.anybop.host
50. webdisk.beef-jerky-recipes.com

Graph

Also the IP has a history of having traffic which is related to malicious APK files.
https://www.virustotal.com/gui/sign-in/graph

How Bfore.Ai is protecting our customers

At Bfore.Ai, we work daily to ensure these phishing attacks get stopped before even reaching their targets. We are here to make your internet journey safer than it has ever been.

With more than 30K new malicious indicators per day we got you covered no matter where the attack comes from. Only 0.05% false positive rate, stop wasting time in false alerts chasing. By launching our PreCrime and PreEmpt technologies, we measure our anticipation from an attack starting, faster than attackers.

Accepting that the only defense is good detection, is accepting to be forever a victim. We believe in prevention more than response. Visit our website for more information !

Bfore.Ai’s recommendations

Every day, adversarial tactics become more collaborative, technologically advanced, and rapid – and at this rate, you simply can’t afford to wait for the next attack before you react. Here are some recommendations from our team :

• Pay close attention to the URL
• Check connection security indicators (the lock)
• Read emails carefully
• Look for trust seals

Appendix

This document and its contents do not constitute, and are not a substitute for, legal advice. The outcome of a Security Risk Assessment should be utilized to ensure that diligent measures are taken to lower the risk of potential weaknesses be exploited to compromise data.

Although the Services and this report may provide data that Client can use in its compliance efforts, Client (not Bfore.Ai) is ultimately responsible for assessing and meeting Client’s own compliance responsibilities. This report does not constitute a guarantee or assurance of Client’s compliance with any law, regulation or standard.

Prevent the next Cyber Threat

Bfore.AI patented AI technology combined with hyperscale observation infrastructure and modern APIs augment our customers security postures with Predictions.

Discover Predictive Cyber-Security

Book a live demo with our specialist to discover how Bfore.AI helps organization fight cyber threats with their patented technology.