urlscan.io logo urlscan.io
SecurityTrails logo

videoasa.americommerce.com Open in urlscan Pro
2606:4700::6810:295d  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://yg2.ir/3nEIN
Effective URL: https://videoasa.americommerce.com/facebooks.html
Submission: On February 08 via manual from SI — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 5 domains to perform 10 HTTP transactions. The main IP is 2606:4700::6810:295d, located in United States and belongs to CLOUDFLARENET, US. The main domain is videoasa.americommerce.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 5th 2021. Valid for: a year.
This is the only time videoasa.americommerce.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 1 164.132.13.91 16276 (OVH)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 4 66.29.143.229 22612 (NAMECHEAP...)
6 2a03:2880:f01... 32934 (FACEBOOK)
1 67.202.114.214 32748 (STEADFAST)
10 4
1    164.132.13.91 (France)

ASN16276 (OVH, FR)
PTR: ip91.ip-164-132-13.eu
yg2.ir
1    2606:4700::6810:295d (United States)

ASN13335 (CLOUDFLARENET, US)
videoasa.americommerce.com
4    66.29.143.229 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server1.ninja909.com
teamads.xyz
6    2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
static.xx.fbcdn.net
1    67.202.114.214 (United States)

ASN32748 (STEADFAST, US)
PTR: amung.us
whos.amung.us
Apex Domain
Subdomains		 Transfer
6 fbcdn.net
static.xx.fbcdn.net — Cisco Umbrella Rank: 639
5 KB
4 teamads.xyz
teamads.xyz
45 KB
1 amung.us
whos.amung.us — Cisco Umbrella Rank: 12727
28 B
1 americommerce.com
videoasa.americommerce.com
581 B
1 yg2.ir
yg2.ir
601 B
10 5
Domain Requested by
6 static.xx.fbcdn.net teamads.xyz
4 teamads.xyz 2 redirects videoasa.americommerce.com
1 whos.amung.us
1 videoasa.americommerce.com
1 yg2.ir 1 redirects
10 5

This site contains no links.

Subject Issuer Validity Valid
americommerce.com
Cloudflare Inc ECC CA-3		 2021-05-05 -
2022-05-04		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-11-18 -
2022-02-16		 3 months crt.sh
whos.amung.us
Sectigo RSA Domain Validation Secure Server CA		 2020-05-21 -
2022-05-21		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://videoasa.americommerce.com/facebooks.html
Frame ID: 0524E0884625E8703CC145F2B5658FCE
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Facebook - Sign in or sign up

Page URL History Show full URLs

  1. http://yg2.ir/3nEIN HTTP 301
    https://videoasa.americommerce.com/facebooks.html Page URL

Page Statistics

10
Requests

80 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

50 kB
Transfer

49 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://yg2.ir/3nEIN HTTP 301
    https://videoasa.americommerce.com/facebooks.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://teamads.xyz/fbs?api=1&lan=facebooknew&ht=2 HTTP 301
  • https://teamads.xyz/fbs/?api=1&lan=facebooknew&ht=2
Request Chain 4
  • https://teamads.xyz/fbs/location HTTP 301
  • https://teamads.xyz/fbs/location/

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request facebooks.html
videoasa.americommerce.com/
Redirect Chain
  • http://yg2.ir/3nEIN
  • https://videoasa.americommerce.com/facebooks.html
110 B
581 B 		Document
General
Check archive.org
Download Go to
Full URL
https://videoasa.americommerce.com/facebooks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:295d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c9c2e49b33faaf8b13138032ec5179d84bf5fe7fafc8416c23fd683c45c5c6f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
fr-FR,fr;q=0.9

Response headers

date
Tue, 08 Feb 2022 21:00:23 GMT
content-type
text/html
content-length
214
cache-control
public
content-encoding
gzip
expires
Wed, 09 Feb 2022 21:00:23 GMT
last-modified
Tue, 18 Jan 2022 14:42:21 GMT
accept-ranges
bytes
etag
"1D80C79994D8480"
vary
Accept-Encoding
p3p
CP="We do not have a P3P policy. Learn why here: https://www.americommerce.com"
x-route-server
101
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6da7c983efad403d-CDG

Redirect headers

Connection
Keep-Alive
X-Powered-By
PHP/5.6.40
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Location
https://videoasa.americommerce.com/facebooks.html#6876912
Vary
Accept-Encoding,User-Agent
Content-Type
text/html; charset=UTF-8
Content-Length
20
Content-Encoding
gzip
Date
Tue, 08 Feb 2022 21:00:22 GMT
/
teamads.xyz/fbs/
Redirect Chain
  • https://teamads.xyz/fbs?api=1&lan=facebooknew&ht=2
  • https://teamads.xyz/fbs/?api=1&lan=facebooknew&ht=2
43 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://teamads.xyz/fbs/?api=1&lan=facebooknew&ht=2
Requested by
Host: videoasa.americommerce.com
URL: https://videoasa.americommerce.com/facebooks.html
Protocol
HTTP/1.1
Server
66.29.143.229 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server1.ninja909.com
Software
Apache /
Resource Hash
ff69b154a45ab6b556eae8841c4bbc2db4286e1c36ba01a053289db9f352a6df

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://videoasa.americommerce.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 08 Feb 2022 21:00:24 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

Location
https://teamads.xyz/fbs/?api=1&lan=facebooknew&ht=2
Date
Tue, 08 Feb 2022 21:00:23 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
267
Content-Type
text/html; charset=iso-8859-1
tbmm-v7ExV2.css
static.xx.fbcdn.net/rsrc.php/v3/ym/l/0,cross/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/ym/l/0,cross/tbmm-v7ExV2.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: teamads.xyz
URL: https://teamads.xyz/fbs?api=1&lan=facebooknew&ht=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://videoasa.americommerce.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers
kl88ihvTqaW.css
static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/kl88ihvTqaW.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: teamads.xyz
URL: https://teamads.xyz/fbs?api=1&lan=facebooknew&ht=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://videoasa.americommerce.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers
Zk78-DQhWlO.css
static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/Zk78-DQhWlO.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: teamads.xyz
URL: https://teamads.xyz/fbs?api=1&lan=facebooknew&ht=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://videoasa.americommerce.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers
/
teamads.xyz/fbs/location/
Redirect Chain
  • https://teamads.xyz/fbs/location
  • https://teamads.xyz/fbs/location/
1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://teamads.xyz/fbs/location/
Protocol
HTTP/1.1
Server
66.29.143.229 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server1.ninja909.com
Software
Apache /
Resource Hash
1ab267dd85e11f67ad2889891a03828c60b20b11c7eed80b3c899bd3f32353d7

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://videoasa.americommerce.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Tue, 08 Feb 2022 21:00:24 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Transfer-Encoding
chunked
Content-Type
application/javascript

Redirect headers

Location
https://teamads.xyz/fbs/location/
Date
Tue, 08 Feb 2022 21:00:24 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
241
Content-Type
text/html; charset=iso-8859-1
dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
Security Headers
Name Value
Content-Security-Policy default-src data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://videoasa.americommerce.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy
default-src data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding
br
x-content-type-options
nosniff
content-md5
NiMA5zHIsmaYxSYEaw9fHg==
document-policy
force-load-at-top
content-security-policy-report-only
default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.xx.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
1027
x-xss-protection
0
x-fb-debug
hloL7zRbNwLC7wE/1Jku2tFKsw+aPnlln1quiMPcbxUmQx4dnFKiIDW4FSHdveCZ4APndoKtzOyRiKOOSsfXkg==
x-fb-trip-id
686109401
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
date
Tue, 08 Feb 2022 21:00:24 GMT
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
x-fb-rlafr
0
timing-allow-origin
*
expires
Thu, 02 Feb 2023 21:13:04 GMT
/
whos.amung.us/pingjs/ 		28 B
28 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://whos.amung.us/pingjs/?k=lonelywolf&t=%26%23128058%3B%20TEAM%20%26%23128058%3B%20WOLF%20%26%23128058%3B&x=https://www.lobo.com//watch?v=lonelywolf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.202.114.214 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
amung.us
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://videoasa.americommerce.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 08 Feb 2022 21:00:24 GMT
content-encoding
gzip
content-type
text/javascript;charset=UTF-8
5NR43BsYs8o.png
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/5NR43BsYs8o.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9615b777212478a41835e410c9897cd544b98c5473b7b73cbec777f1db2d5404
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://videoasa.americommerce.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 08 Feb 2022 21:00:24 GMT
x-content-type-options
nosniff
content-md5
zS7nNbuF+qoavNDFbgWDdA==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
1307
x-fb-rlafr
0
x-fb-debug
M3VuQ0G/dqoI6IO/K76u8bsq3Tfb/0d3eZxMEswKnTLQhiMMsmvN0pqmn3v1giwAr7sRyeJ5jQnCFfU+cZPvKw==
x-fb-trip-id
686109401
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Thu, 26 Jan 2023 03:48:48 GMT
lqbz1hqlAFx.png
static.xx.fbcdn.net/rsrc.php/v3/yo/r/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yo/r/lqbz1hqlAFx.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0fd58536eb089f2060e86f14e60ef83f68169fbe34d95f8cdc2ad60abe4bb8c9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://videoasa.americommerce.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 08 Feb 2022 21:00:24 GMT
x-content-type-options
nosniff
content-md5
8kNJ+LeRDyhmr8oF+ZZjoQ==
document-policy
force-load-at-top
content-security-policy-report-only
default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.xx.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
1364
x-fb-rlafr
0
x-fb-debug
TDwA1aWo+6vgwSZNg1z9cA+lh0sY9Qv9U44FabcLsK495Lpj5RyZUsM8UzTViKUGYV4jTAOK60ZeGnW7MJvqNw==
x-fb-trip-id
686109401
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Thu, 26 Jan 2023 03:44:02 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a function| __updateOrientation function| checking function| creatingInput function| searchingForms

2 Cookies

Domain/Path Name / Value
yg2.ir/ Name: PHPSESSID
Value: vob1050nf15qmgm6v6ia7pnuf6
yg2.ir/ Name: short_3nEIN
Value: 1

3 Console Messages

Source Level URL
Text
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/ym/l/0,cross/tbmm-v7ExV2.css?_nc_x=Ij3Wp8lg5Kz
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/kl88ihvTqaW.css?_nc_x=Ij3Wp8lg5Kz
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/Zk78-DQhWlO.css?_nc_x=Ij3Wp8lg5Kz
Message:
Failed to load resource: the server responded with a status of 404 ()