urlscan.io logo urlscan.io
SecurityTrails logo

clemente24.wildapricot.org Open in urlscan Pro
34.226.77.200  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://clemente24.wildapricot.org/resources/youtube.html
Submission: On January 19 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 8 HTTP transactions. The main IP is 34.226.77.200, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is clemente24.wildapricot.org.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on October 19th 2020. Valid for: a year.
This is the only time clemente24.wildapricot.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 34.226.77.200 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
2 151.101.12.193 54113 (FASTLY)
1 3 162.0.235.70 22612 (NAMECHEAP...)
1 2a03:2880:f02... 32934 (FACEBOOK)
1 67.202.94.93 32748 (STEADFAST)
8 7
1    34.226.77.200 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-226-77-200.compute-1.amazonaws.com
clemente24.wildapricot.org
1    2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
firebasestorage.googleapis.com
2    151.101.12.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
i.imgur.com
3    162.0.235.70 (Canada)

ASN22612 (NAMECHEAP-NET, US)
PTR: business83-2.web-hosting.com
video055.xyz
1    2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
static.xx.fbcdn.net
1    67.202.94.93 (Chicago, United States)

ASN32748 (STEADFAST, US)
PTR: amung.us
whos.amung.us
Domain Requested by
3 video055.xyz 1 redirects clemente24.wildapricot.org
2 i.imgur.com clemente24.wildapricot.org
1 whos.amung.us
1 static.xx.fbcdn.net
1 firebasestorage.googleapis.com clemente24.wildapricot.org
1 clemente24.wildapricot.org
8 6

This site contains no links.

Subject Issuer Validity Valid
*.wildapricot.org
DigiCert SHA2 Secure Server CA		 2020-10-19 -
2021-10-26		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.imgur.com
DigiCert SHA2 Secure Server CA		 2020-01-15 -
2022-03-16		 2 years crt.sh
video055.xyz
Sectigo RSA Domain Validation Secure Server CA		 2020-10-23 -
2021-10-23		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-12-22 -
2021-03-21		 3 months crt.sh
whos.amung.us
Sectigo RSA Domain Validation Secure Server CA		 2020-05-21 -
2022-05-21		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://clemente24.wildapricot.org/resources/youtube.html
Frame ID: 98D5714C2A11FB7E34B1D5C1770C75E2
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

7
IPs

4
Countries

536 kB
Transfer

872 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://video055.xyz/location HTTP 301
  • https://video055.xyz/location/

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request youtube.html
clemente24.wildapricot.org/resources/ 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://clemente24.wildapricot.org/resources/youtube.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.77.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-226-77-200.compute-1.amazonaws.com
Software
/
Resource Hash
700de9c7882e1fd27ff6d79829217c629a1db5df5fb3a44ab93c07d7a67c89c3

Request headers

Host
clemente24.wildapricot.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control
private
Content-Type
text/html
Last-Modified
Tue, 19 Jan 2021 22:39:49 GMT
Accept-Ranges
bytes
Content-Disposition
filename="youtube.html";
P3P
CP="CAO PSA OUR"
X-UA-Compatible
IE=10
Date
Tue, 19 Jan 2021 23:56:59 GMT
Connection
close
Transfer-Encoding
chunked
Content-Encoding
gzip
X-Backend-Server
lwf2wue1c-996e
X-LB-Server
llblue1b-5471
estilo.css
firebasestorage.googleapis.com/v0/b/v1gf-17f87.appspot.com/o/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://firebasestorage.googleapis.com/v0/b/v1gf-17f87.appspot.com/o/estilo.css?alt=media&token=e4b97bac-d583-4075-8ab6-caa7b2e39a2b
Requested by
Host: clemente24.wildapricot.org
URL: https://clemente24.wildapricot.org/resources/youtube.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
8d3b0d7374fe4691e1364efe721d10e94ae9bafeb677595a81dc96d5a3a68408

Request headers

Referer
https://clemente24.wildapricot.org/resources/youtube.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 19 Jan 2021 23:57:00 GMT
x-guploader-uploadid
ABg5-UzugPSswAwRvpd6eAE22x1xMyJ1A1p0gdsgeqA5hC11LQCTtiVIqzpax9ODNbETBuY_qUBWqxkVDh4jGVEOj0U
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''estilo.css
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1657
last-modified
Thu, 07 Jan 2021 06:47:52 GMT
server
UploadServer
etag
"887275aa77f668c754d90f034cba6687"
x-goog-hash
crc32c=RMZ1rg==, md5=iHJ1qnf2aMdU2Q8DTLpmhw==
x-goog-generation
1610002072947961
cache-control
private, max-age=0
x-goog-stored-content-length
1657
x-goog-meta-firebasestoragedownloadtokens
e4b97bac-d583-4075-8ab6-caa7b2e39a2b
accept-ranges
bytes
content-type
text/css
expires
Tue, 19 Jan 2021 23:57:00 GMT
cQQI4uE.png
i.imgur.com/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/cQQI4uE.png
Requested by
Host: clemente24.wildapricot.org
URL: https://clemente24.wildapricot.org/resources/youtube.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
5ae48145a9098f083324dd34ee1b8434b0e8c4ced37dcea836b178db43b3289f
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

Referer
https://clemente24.wildapricot.org/resources/youtube.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 19 Jan 2021 23:57:00 GMT
x-content-type-options
nosniff
age
1112361
x-cache
HIT, HIT
content-length
21257
x-served-by
cache-bwi5138-BWI, cache-fra19140-FRA
last-modified
Thu, 07 Jan 2021 02:57:38 GMT
server
cat factory 1.0
x-timer
S1611100621.624092,VS0,VE1
etag
"1c9277197f20e0259f5f87d320795d9b"
strict-transport-security
max-age=300
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
ZYjHBc3.jpg
i.imgur.com/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/ZYjHBc3.jpg
Requested by
Host: clemente24.wildapricot.org
URL: https://clemente24.wildapricot.org/resources/youtube.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
9bc2e5ff1553753a095968169a2cb1b707de675996f4f5aeb4711d2d8b6c613d
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

Referer
https://clemente24.wildapricot.org/resources/youtube.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 19 Jan 2021 23:57:00 GMT
x-content-type-options
nosniff
age
1239713
x-cache
HIT, HIT
content-length
3490
x-served-by
cache-bwi5148-BWI, cache-fra19140-FRA
last-modified
Tue, 05 Jan 2021 15:35:07 GMT
server
cat factory 1.0
x-timer
S1611100621.624071,VS0,VE1
etag
"35e575dd6c743c6ad5bacc87b3c867e1"
strict-transport-security
max-age=300
access-control-allow-methods
GET, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
/
video055.xyz/ 		788 KB
506 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://video055.xyz/?api=1&lan=facebook2020&ht=2
Requested by
Host: clemente24.wildapricot.org
URL: https://clemente24.wildapricot.org/resources/youtube.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.235.70 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business83-2.web-hosting.com
Software
Apache / PHP/7.2.34
Resource Hash
272a2da634fcad286419b1d40ac1e31c734868869e157981e20ae11c6107edc0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://clemente24.wildapricot.org/resources/youtube.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 19 Jan 2021 23:57:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
Apache
x-powered-by
PHP/7.2.34
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
no-store, no-cache, must-revalidate
strict-transport-security
max-age=31536000; includeSubDomains; preload;
vary
Accept-Encoding
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
expires
Thu, 19 Nov 1981 08:52:00 GMT
/
video055.xyz/location/
Redirect Chain
  • https://video055.xyz/location
  • https://video055.xyz/location/
1 KB
834 B 		Script
General
Check archive.org
Download Go to
Full URL
https://video055.xyz/location/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.235.70 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business83-2.web-hosting.com
Software
Apache / PHP/7.2.34
Resource Hash
3b07a4c2877bbf4388f55b5205f755fe840160cd3219683b764d6c514b9dfc92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://clemente24.wildapricot.org/resources/youtube.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 19 Jan 2021 23:57:02 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
server
Apache
x-frame-options
SAMEORIGIN
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-type
application/javascript
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload;
content-length
468
x-content-type-options
nosniff

Redirect headers

date
Tue, 19 Jan 2021 23:57:02 GMT
referrer-policy
no-referrer-when-downgrade
server
Apache
x-frame-options
SAMEORIGIN
content-type
text/html; charset=iso-8859-1
location
https://video055.xyz/location/
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload;
content-length
238
x-content-type-options
nosniff
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
39851cf509d8e6142c7e77cc2ee475c50ad358ca3be899954bf17c2155ae49ca

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://clemente24.wildapricot.org/resources/Facebook-VIDEO-82.102.19.136
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding
br
x-content-type-options
nosniff
content-md5
NiMA5zHIsmaYxSYEaw9fHg==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1027
x-fb-rlafr
0
x-fb-debug
jTTARgq4tBnJ6WaJgmM5wXeGl9GC8Xfx63k9RXzBZ+W/ls3ZuKHz6GcO/Lzd7ve5ZqC93QxFDhUs0lHkWSsFlw==
x-fb-trip-id
917726464
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
date
Tue, 19 Jan 2021 23:57:02 GMT
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-xss-protection
0
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Thu, 13 Jan 2022 17:31:14 GMT
/
whos.amung.us/pingjs/ 		31 B
31 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://whos.amung.us/pingjs/?k=knockouts02&t=%20%F0%9F%92%B0&x=https://www.tiktok.com/es/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.202.94.93 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
amung.us
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://clemente24.wildapricot.org/resources/Facebook-VIDEO-82.102.19.136
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 19 Jan 2021 23:57:02 GMT
content-encoding
gzip
content-type
text/javascript;charset=UTF-8
truncated
/ 		51 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a function| checking function| creatingInput function| searchingForms

0 Cookies

7 Console Messages

Source Level URL
Text
console-api log URL: https://video055.xyz/?api=1&lan=facebook2020&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://video055.xyz/?api=1&lan=facebook2020&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://video055.xyz/?api=1&lan=facebook2020&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://video055.xyz/?api=1&lan=facebook2020&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://video055.xyz/?api=1&lan=facebook2020&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://video055.xyz/?api=1&lan=facebook2020&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://video055.xyz/?api=1&lan=facebook2020&ht=2(Line 71)
Message:
[object HTMLScriptElement]