wf.bnsfmrj.icu Open in urlscan Pro
118.107.44.88 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://wf.bnsfmrj.icu/
Submission: On September 30 via api (September 30th 2024, 2:03:25 pm UTC) from US — Scanned from SG

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 17 HTTP transactions. The main IP is 118.107.44.88, located in Singapore and belongs to CTGSERVERLIMITED-AS-AP CTG Server Limited, HK. The main domain is wf.bnsfmrj.icu.
TLS certificate: Issued by R11 on September 28th 2024. Valid for: 3 months.

This is the only time wf.bnsfmrj.icu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
13	118.107.44.88 118.107.44.88	152194 (CTGSERVER...) (CTGSERVERLIMITED-AS-AP CTG Server Limited)
4	172.67.191.63 172.67.191.63	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	2

13 118.107.44.88 (Singapore)

ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK)

wf.bnsfmrj.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.67.191.63 (United States)

ASN13335 (CLOUDFLARENET, US)

www.cngamedown.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	bnsfmrj.icu wf.bnsfmrj.icu	576 KB
4	cngamedown.com www.cngamedown.com	19 KB
17	2

	Domain	Requested by
13	wf.bnsfmrj.icu	wf.bnsfmrj.icu
4	www.cngamedown.com	wf.bnsfmrj.icu
17	2

This site contains no links.

Subject Issuer	Validity	Valid
wos.bzdtzx.top R11	`2024-09-28` - `2024-12-27`	3 months	crt.sh
cngamedown.com WE1	`2024-08-12` - `2024-11-10`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://wf.bnsfmrj.icu/
Frame ID: 19612572DCA009879BAB257BA6CB32D3
Requests: 7 HTTP requests in this frame

Frame: https://wf.bnsfmrj.icu/business.html
Frame ID: 46AA396BCE88E7577FFBF2553B1A860B
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

新鲜事物

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

24 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

595 kB
Transfer

1644 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
wf.bnsfmrj.icu/ 15 KB
4 KB 534ms
60ms Document
text/html 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://wf.bnsfmrj.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

415320b145f03f3e8ce8611103eb8352d50aa73e57a9af3ab5d125d97902a74e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Mon, 30 Sep 2024 14:03:16 GMT
etag: W/"66f8004a-3cec"
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 style.css
wf.bnsfmrj.icu/static/css/ 21 KB
6 KB 48ms
38ms Stylesheet
text/css 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://wf.bnsfmrj.icu/static/css/style.css

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

2d7585dc4f88563726f3c4aff25ffb07895328dc1bc90efbdf6c241e49989d1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f8004a-558b"
expires: Tue, 01 Oct 2024 02:03:17 GMT
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: text/css
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 jquery-1.8.3.js Show response
wf.bnsfmrj.icu/ 260 KB
90 KB 94ms
85ms Script
application/javascript 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://wf.bnsfmrj.icu/jquery-1.8.3.js

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

756d7dfac4a35bb57543f677283d6c682e8d704e5350884b27325badd2b3c4a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f8004a-40f49"
expires: Tue, 01 Oct 2024 02:03:17 GMT
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: application/javascript
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 s.js Show response
wf.bnsfmrj.icu/js/ 951 B
1 KB 131ms
122ms Script
application/javascript 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://wf.bnsfmrj.icu/js/s.js

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

2e8f3a85e874aaa65b5438c14920e7f9ce309c1698dd628398da721b29dc9951

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
etag: "66f8004a-3b7"
expires: Tue, 01 Oct 2024 02:03:17 GMT
accept-ranges: bytes
content-length: 951
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: application/javascript
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx

GET
H2 200 fonts.css
wf.bnsfmrj.icu/static/css/ 2 KB
848 B 68ms
45ms Stylesheet
text/css 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://wf.bnsfmrj.icu/static/css/fonts.css

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/static/css/style.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

b503e716efedee3214c0f0276abd4245e28d3d8d1d61ba8daf9ce0668241f65d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/static/css/style.css

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f8004a-761"
expires: Tue, 01 Oct 2024 02:03:17 GMT
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: text/css
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 business.html Show response
wf.bnsfmrj.icu/ Frame 46AA 1 KB
819 B 46ms
43ms Document
text/html 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://wf.bnsfmrj.icu/business.html

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

85d3c4a487c92ee1a904355ae396f97cc64c3bb7d9fb60ca0f226591e1a39652

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wf.bnsfmrj.icu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Mon, 30 Sep 2024 14:03:17 GMT
etag: W/"66f8004a-514"
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 icomoon.ttf
wf.bnsfmrj.icu/static/font/ 6 KB
6 KB 42ms
41ms Font
application/octet-stream 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://wf.bnsfmrj.icu/static/font/icomoon.ttf

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/static/css/fonts.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

c2a30666853d10895ba8b09dcc6273739df2c0f7f5558d758dacd7cad9afeb48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://wf.bnsfmrj.icu
Referer: https://wf.bnsfmrj.icu/static/css/fonts.css

Response headers

strict-transport-security: max-age=31536000
etag: "66f8004a-1750"
accept-ranges: bytes
content-length: 5968
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: application/octet-stream
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx

GET
H2 200 chunk-vendors.d25f0563.css
wf.bnsfmrj.icu/css/ Frame 46AA 235 KB
45 KB 52ms
50ms Stylesheet
text/css 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://wf.bnsfmrj.icu/css/chunk-vendors.d25f0563.css

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/business.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

1bebba22cabbfd8e999e53d35ecb55b8cb82a9e928eed9ed10f9160ba1154e45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/business.html

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f8004a-3adcc"
expires: Tue, 01 Oct 2024 02:03:17 GMT
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: text/css
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 chunk-vendors.0156aa53.js Show response
wf.bnsfmrj.icu/js/ Frame 46AA 961 KB
312 KB 59ms
58ms Script
application/javascript 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://wf.bnsfmrj.icu/js/chunk-vendors.0156aa53.js

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/business.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

f8d4398aa42e5005dc2e1dc315e29c19a1045d1a4ddb2aa33234d78fa67d56c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/business.html

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f8004a-f0359"
expires: Tue, 01 Oct 2024 02:03:17 GMT
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: application/javascript
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 index.671dc2d3.js Show response
wf.bnsfmrj.icu/js/ Frame 46AA 18 KB
7 KB 114ms
113ms Script
application/javascript 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://wf.bnsfmrj.icu/js/index.671dc2d3.js

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/business.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

d6e619aaa6bd451833438fe3875473f4f76a7031bcbcfb4ec6930017a5088cbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/business.html

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f8004a-482b"
expires: Tue, 01 Oct 2024 02:03:17 GMT
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: application/javascript
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 walid Show response
www.cngamedown.com/ws/ Frame 46AA 46 B
496 B 128ms
91ms XHR
text/plain 172.67.191.63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cngamedown.com/ws/walid?sesskey=01fc1a08-1b14-03d2-07a9-4e78d904d6bc&t=1727704997669
Requested by: Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/js/chunk-vendors.0156aa53.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.191.63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae9fdf03babdb5d050f36a651732a29128377217d38d08a17d7157d056a1960b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://wf.bnsfmrj.icu/

Response headers

cache-control: max-age=43200, no-cache
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LOHKqh4lVrcceyjEzzCYwM2opYGzVKKTStMLRpcCCXUdjwOrYu0iBW1QFWqH04Xqvo063HaB91DDoZEY%2FSyMDZ91LNCTS2zo3cjJlwRPmszUkX2Nc8E32kum4Z3lGJ4HnFr0DB4%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb4c16bacb6cddd-SIN
expires: Tue, 01 Oct 2024 02:03:17 GMT
access-control-allow-origin: *
x-cache: MISS
date: Mon, 30 Sep 2024 14:03:17 GMT
server: cloudflare

GET
H2 200 favicon.png
wf.bnsfmrj.icu/ Frame 46AA 3 KB
3 KB 52ms
49ms Image
image/png 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wf.bnsfmrj.icu/favicon.png

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/business.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

309b5f587f9dca6af686943f384c286e6820db38a5273316fd8baa7930f87376

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/business.html

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
content-encoding: gzip
etag: W/"66f8004a-ae6"
expires: Wed, 30 Oct 2024 14:03:17 GMT
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: image/png
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 tutorial.png
wf.bnsfmrj.icu/img/ Frame 46AA 103 KB
100 KB 51ms
48ms Image
image/png 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wf.bnsfmrj.icu/img/tutorial.png

Requested by

Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/business.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

6d026c2709296a28bed443f1948554abf8676ce4f8eecb5a58487fd5f0c103ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/business.html

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
content-encoding: gzip
etag: W/"66f8004a-19cb9"
expires: Wed, 30 Oct 2024 14:03:17 GMT
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: image/png
last-modified: Sat, 28 Sep 2024 13:10:34 GMT
server: nginx
vary: Accept-Encoding

GET
H2 404 favicon.ico
wf.bnsfmrj.icu/ 148 B
228 B 320ms
319ms Other
text/html 118.107.44.88
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL: https://wf.bnsfmrj.icu/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 118.107.44.88 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: 9cad3cff676946810a81047247f12e4e51faccc01df4134edfd871aee8ba0956

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/

Response headers

content-length: 148
date: Mon, 30 Sep 2024 14:03:18 GMT
etag: "66f8004a-94"
content-type: text/html
server: nginx

GET
H3 200 qrcode
www.cngamedown.com/ws/ Frame 46AA 8 KB
9 KB 134ms
116ms Image
image/png 172.67.191.63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cngamedown.com/ws/qrcode?sesskey=01fc1a08-1b14-03d2-07a9-4e78d904d6bc&t=1727704997841
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.191.63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6162e9aa1e0575fa61fc9598fd2566a8edcf4a5f1cb4e9c60b8991527ba8af8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/

Response headers

cache-control: max-age=43200, no-cache
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M1G%2BCVYjcexL4YaItY5zZ6Dr1Uedhbo5ZIwBvSASJE3dUnFQICTztY%2FJxCCtWr8fzvDNlwkV%2BFsrv8q%2FHu8DwTFcCBVy59zL4V02zUHk8bVKLTE%2BMdPjyhN%2F907eqvMYOqb8H5E%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb4c16cbfe146df-SIN
expires: Tue, 01 Oct 2024 02:03:17 GMT
access-control-allow-origin: *
x-cache: MISS
date: Mon, 30 Sep 2024 14:03:17 GMT
content-type: image/png
server: cloudflare

GET
H3 200 walid Show response
www.cngamedown.com/ws/ Frame 46AA 20 B
440 B 48ms
47ms XHR
text/plain 172.67.191.63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cngamedown.com/ws/walid?sesskey=01fc1a08-1b14-03d2-07a9-4e78d904d6bc&t=1727705002669
Requested by: Host: wf.bnsfmrj.icu
URL: https://wf.bnsfmrj.icu/js/chunk-vendors.0156aa53.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.191.63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96b2f9cb3ae498c17baaacac6e9a2f2f3e8e382c36ec8985e733e5a92aeebf8e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://wf.bnsfmrj.icu/

Response headers

cache-control: max-age=43200, no-cache
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LDmmE8hpwTpAlYg%2BOfyr%2BdSGKy%2BE%2BtonYWs6UT0A3sbPI5HDhJZmMF11qBEQ5RfXjLxRJh4cYcR7CfWohR5i7uNmd8Gbs%2B14VIXxUXtFk7fJOCIbqOjzc4yHLMq%2BumUF1tDMby0%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb4c18ab82acddd-SIN
expires: Tue, 01 Oct 2024 02:03:22 GMT
access-control-allow-origin: *
x-cache: MISS
date: Mon, 30 Sep 2024 14:03:22 GMT
server: cloudflare

GET
H3 200 qrcode
www.cngamedown.com/ws/ Frame 46AA 8 KB
9 KB 63ms
62ms Image
image/png 172.67.191.63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cngamedown.com/ws/qrcode?sesskey=01fc1a08-1b14-03d2-07a9-4e78d904d6bc&t=1727705002811
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.191.63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6162e9aa1e0575fa61fc9598fd2566a8edcf4a5f1cb4e9c60b8991527ba8af8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://wf.bnsfmrj.icu/

Response headers

cache-control: max-age=43200, no-cache
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q8FVq%2Fiih%2BM8FjtGn9Sr5LeMUnqE0pR0LSWbm7vAtd82gbEY%2FbG19CYo0iw96Z%2FR6rNLiV38ab88E%2BbimoiuT4KUwp%2F3feC1XV9pOL11mgbT9JUEnJzPan5WoVj1PzPs4Dtxq2g%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cb4c18baed446df-SIN
expires: Tue, 01 Oct 2024 02:03:22 GMT
access-control-allow-origin: *
x-cache: MISS
date: Mon, 30 Sep 2024 14:03:22 GMT
content-type: image/png
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery string| ss

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://wf.bnsfmrj.icu/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

wf.bnsfmrj.icu
www.cngamedown.com
118.107.44.88
172.67.191.63
1bebba22cabbfd8e999e53d35ecb55b8cb82a9e928eed9ed10f9160ba1154e45
2d7585dc4f88563726f3c4aff25ffb07895328dc1bc90efbdf6c241e49989d1a
2e8f3a85e874aaa65b5438c14920e7f9ce309c1698dd628398da721b29dc9951
309b5f587f9dca6af686943f384c286e6820db38a5273316fd8baa7930f87376
415320b145f03f3e8ce8611103eb8352d50aa73e57a9af3ab5d125d97902a74e
6d026c2709296a28bed443f1948554abf8676ce4f8eecb5a58487fd5f0c103ee
756d7dfac4a35bb57543f677283d6c682e8d704e5350884b27325badd2b3c4a7
85d3c4a487c92ee1a904355ae396f97cc64c3bb7d9fb60ca0f226591e1a39652
96b2f9cb3ae498c17baaacac6e9a2f2f3e8e382c36ec8985e733e5a92aeebf8e
9cad3cff676946810a81047247f12e4e51faccc01df4134edfd871aee8ba0956
ae9fdf03babdb5d050f36a651732a29128377217d38d08a17d7157d056a1960b
b503e716efedee3214c0f0276abd4245e28d3d8d1d61ba8daf9ce0668241f65d
c2a30666853d10895ba8b09dcc6273739df2c0f7f5558d758dacd7cad9afeb48
c6162e9aa1e0575fa61fc9598fd2566a8edcf4a5f1cb4e9c60b8991527ba8af8
d6e619aaa6bd451833438fe3875473f4f76a7031bcbcfb4ec6930017a5088cbb
f8d4398aa42e5005dc2e1dc315e29c19a1045d1a4ddb2aa33234d78fa67d56c2

wf.bnsfmrj.icu Open in urlscan Pro 118.107.44.88 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

17 Requests

24 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

595 kBTransfer

1644 kBSize

0 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

wf.bnsfmrj.icu Open in urlscan Pro
118.107.44.88 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

24 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

595 kB
Transfer

1644 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!