whatsapps.ltd Open in urlscan Pro
2606:4700:3033::ac43:be83 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://whatsapps.ltd/
Effective URL:
https://whatsapps.ltd/
Submission: On May 22 via api (May 22nd 2023, 2:08:04 am UTC) from SG — Scanned from SG

Summary HTTP 15 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 2606:4700:3033::ac43:be83, located in United States and belongs to CLOUDFLARENET, US. The main domain is whatsapps.ltd.
TLS certificate: Issued by GTS CA 1P5 on May 19th 2023. Valid for: 3 months.

This is the only time whatsapps.ltd was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3037::6815:13f5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2606:4700:303... 2606:4700:3033::ac43:be83	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	103.235.46.191 103.235.46.191	55967 (BAIDU Bei...) (BAIDU Beijing Baidu Netcom Science and Technology Co.)
15	3

1 2606:4700:3037::6815:13f5 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

whatsapps.ltd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:3033::ac43:be83 (United States)

ASN13335 (CLOUDFLARENET, US)

whatsapps.ltd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.235.46.191 (Hong Kong)

ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN)

hm.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	whatsapps.ltd 1 redirects whatsapps.ltd	340 KB
2	baidu.com hm.baidu.com — Cisco Umbrella Rank: 8752	12 KB
0	Failed function sub() { [native code] }. Failed
15	3

	Domain	Requested by
13	whatsapps.ltd	1 redirects whatsapps.ltd
2	hm.baidu.com	whatsapps.ltd
0	dbjbempljhcmhlfpfacalomonjpalpko Failed	whatsapps.ltd
15	3

This site contains links to these domains. Also see Links.

Domain
www.telegram.org
vtf.oss-accelerate.aliyuncs.com
itunes.apple.com
www.facebook.com
blog.telegram.org
twitter.com

Subject Issuer	Validity	Valid
whatsapps.ltd GTS CA 1P5	`2023-05-19` - `2023-08-17`	3 months	crt.sh
baidu.com GlobalSign RSA OV SSL CA 2018	`2022-07-05` - `2023-08-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://whatsapps.ltd/
Frame ID: 00BCC4FD9B8F544312B39726D9108B43
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

app

Page URL History Show full URLs

http://whatsapps.ltd/ HTTP 301
https://whatsapps.ltd/ Page URL

Detected technologies

Baidu Analytics (百度统计) (Analytics) Expand

Overall confidence: 100%
Detected patterns

hm\.baidu\.com/hm\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

93 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

351 kB
Transfer

818 kB
Size

3
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://www.telegram.org/contact/
Title: 联系

Search URL Search Domain Scan URL

URL: https://vtf.oss-accelerate.aliyuncs.com/WhatsApp.apk
Title: Android

Search URL Search Domain Scan URL

URL: http://itunes.apple.com/us/app/whatsapp-messenger/id310633997?mt=8&fbclid=IwAR30kILqJposAMfPq2JiGQ00o5NwVDc3jvu86wtcmAwzPNCTJXLZaooUpVk
Title: iPhone

Search URL Search Domain Scan URL

URL: https://www.telegram.org/legal/
Title: 条款和隐私政策

Search URL Search Domain Scan URL

URL: https://www.telegram.org/business
Title: 商业

Search URL Search Domain Scan URL

URL: https://www.telegram.org/privacy
Title: 隐私指引

Search URL Search Domain Scan URL

URL: https://www.telegram.org/about
Title: 关于

Search URL Search Domain Scan URL

URL: https://www.telegram.org/join
Title: 工作机会

Search URL Search Domain Scan URL

URL: https://www.facebook.com/brand/resources/whatsapp/whatsapp-brand
Title: 品牌中心

Search URL Search Domain Scan URL

URL: https://www.telegram.org/contact
Title: 联系

Search URL Search Domain Scan URL

URL: https://blog.telegram.org/
Title: 博客

Search URL Search Domain Scan URL

URL: https://www.telegram.org/stories
Title: WhatsApp 快拍

Search URL Search Domain Scan URL

URL: https://www.telegram.org/android
Title: Android

Search URL Search Domain Scan URL

URL: https://twitter.com/whatsapp
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/WhatsApp
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.telegram.org/coronavirus
Title: 新冠疫情

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://whatsapps.ltd/ HTTP 301
https://whatsapps.ltd/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
whatsapps.ltd/
Redirect Chain

http://whatsapps.ltd/
https://whatsapps.ltd/

136 KB
83 KB

135ms
114ms

Document
text/html

2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://whatsapps.ltd/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45b351b48f5d9f15242e4528ce6dbd51854cc7c0020e42738f91f8e637630a3a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7cb1823cfd973e0c-SIN
content-encoding: br
content-type: text/html
date: Mon, 22 May 2023 02:07:59 GMT
last-modified: Fri, 19 May 2023 06:04:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=66Y4nAKIQKWm6MH0OLKlBm6ePrJG0Gd0o1PmuF%2FpMWENeb3jOEXRQilMWNw%2BJhrzTHa3cV3ZCAcyvUHpv8S39W37OlxiBxSyjDsVLgfqjqiH0mbdLcdKh5%2FJvOAvRM53dBxcVQyhF69XJqcQ"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

CF-RAY: 7cb1823cccb887d8-SIN
Cache-Control: max-age=3600
Connection: keep-alive
Date: Mon, 22 May 2023 02:07:59 GMT
Expires: Mon, 22 May 2023 03:07:59 GMT
Location: https://whatsapps.ltd/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7knZV0HxltXSk14vjqjZDWgU5b4K1AJW3riFWspFE%2FRQ9oq7%2F43%2BmE4iXBGGcBBLdOZbzS8DREhMUrVci6tQz0xpPHJotCIKPx2J8RJ%2BE016Tb9naoNsxDhaqAddF1Jc%2BnKbJ0T3UVL8kQ13"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 92yU3_1E6qP.css
whatsapps.ltd/static/css/ 7 KB
2 KB 85ms
84ms Stylesheet
text/css 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://whatsapps.ltd/static/css/92yU3_1E6qP.css
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1dec9c543ba7d88bd189d02e6b4b783e20061171c49094a928fc819ec788bcc

Request headers

Referer: https://whatsapps.ltd/
Origin: https://whatsapps.ltd
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Mon, 15 May 2023 04:15:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6461b1fc-1a1b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Zbs1DI66cX%2FLCLUC1BqevV3A3bPCo7Q5oSNF%2FBJopVmNb2SJwjvxlWkhOPDuyhgZiQqlUB4WZ2rYeYPHDKrAvoI%2BMXi2VbrccJbDn5IaWpmZ0diftUhwVRdU1avpRDNgYBPtQQYKhQXCe1z"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 7cb1823dbe733e0c-SIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Mon, 22 May 2023 14:07:59 GMT

GET
H2 200 xnxHL8zVBjo.css
whatsapps.ltd/static/css/ 120 KB
19 KB 97ms
96ms Stylesheet
text/css 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://whatsapps.ltd/static/css/xnxHL8zVBjo.css
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a5b99d1919a30be33683a3c8dfab90ecef8f9fc1861ec00ccdd3c411a28dc85b

Request headers

Referer: https://whatsapps.ltd/
Origin: https://whatsapps.ltd
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Mon, 15 May 2023 04:16:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6461b210-1deb7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Oh6RnjVmZIa5%2B4TYV7155Vw5mUqwChwJnrE2IXpQ5KoNNg%2Fw1t%2FI7Gk7VGQPq9DO0f8QKsrRcfsubqUflmKJ6tigsBXbIs9zcjoo%2FkYgl4rHBFSpqWajLmZvnmluh5k%2BqeKBDqa9OkTcM26P"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 7cb1823dbe763e0c-SIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Mon, 22 May 2023 14:07:59 GMT

GET
H2 200 EsyfAiyWshR.css
whatsapps.ltd/static/css/ 13 KB
4 KB 94ms
94ms Stylesheet
text/css 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://whatsapps.ltd/static/css/EsyfAiyWshR.css
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fee58b2c5d1dfec9419b07d030239a7621d674ee2215ab7cf6de5bf0e480bb68

Request headers

Referer: https://whatsapps.ltd/
Origin: https://whatsapps.ltd
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Mon, 15 May 2023 04:16:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6461b208-33e2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fDsp1fSyjF6A311iVwgJRtyQbT3TCrHAF9uQ9j6RyHZdT%2BH%2BivYS8C1TSLzz7IJrOBWKLuPJqe2DqdaRHOAU6kHu2k%2BK2I%2BONx99eN0cPbVFEhJe3wsE7H54NKp3CYFhl4GJEb7QeZC%2FNtRo"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 7cb1823dbe773e0c-SIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Mon, 22 May 2023 14:07:59 GMT

GET
H2 200 28bZN702Ikw.css
whatsapps.ltd/static/css/ 740 B
666 B 83ms
83ms Stylesheet
text/css 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://whatsapps.ltd/static/css/28bZN702Ikw.css
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70c5afec8f9e0757ab757763bc884038b7888d8d1f9e994deba75bdc38914f2d

Request headers

Referer: https://whatsapps.ltd/
Origin: https://whatsapps.ltd
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Mon, 15 May 2023 04:15:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6461b1f4-2e4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aP4r6s5y%2B%2BkerO7Wa59F42cAhgejMNYfu0SbirsmkrNmPQ4hzT3hNqsHwluDMmhrECp%2F88bOabXG%2Bu4Eo%2FlbWaXO7k4SJ%2FVeFzdgykP65ifNhhktEBxFT7onAniyAXFYTKiD6H2%2FDaOMEBJ2"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 7cb1823dbe793e0c-SIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Mon, 22 May 2023 14:07:59 GMT

GET
H2 200 2VSZD9_JH43.js Show response
whatsapps.ltd/static/js/ 309 KB
91 KB 91ms
91ms Script
application/javascript 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://whatsapps.ltd/static/js/2VSZD9_JH43.js
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17a99746b0a4baf21319ba7fd1b1e2906ff320db5ae12e39c3b8cccb00223809

Request headers

Referer: https://whatsapps.ltd/
Origin: https://whatsapps.ltd
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Mon, 15 May 2023 04:16:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6461b226-4d29b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=shmuaSyqJfFi2lQ%2B92ijgJ%2B4eSoQb0Osv5GwMhsXOvWSa07aY6gVHn4E2O2PiHNJoQNpxpHevi7htieD%2FCGtdsT5Pl4Ld%2FtG5akR5U5OAiYPAW%2B44wF1bzXv%2BMB72C%2FIvLICAWvS0x58cN5x"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 7cb1823dbe7a3e0c-SIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Mon, 22 May 2023 14:07:59 GMT

GET inspector.js
dbjbempljhcmhlfpfacalomonjpalpko/scripts/ 0
0

GET
H3 200 36B424nhiL4.svg
whatsapps.ltd/static/ 9 KB
4 KB 93ms
93ms Image
image/svg+xml 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whatsapps.ltd/static/36B424nhiL4.svg
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 708f4f787db19dcb4cca817e1c38fba2baf0216b092c90d59648464791d57abb

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://whatsapps.ltd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Mon, 15 May 2023 04:16:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6461b23a-221b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=46XB0MIQ7FOSwUlNkQyTK9W6c0VPVqL0oNsEt1VNSutK4Y346lLSuPUEN3yzBdGwMruni0Bcdib82jBy5bPHfvb8a9HmnqNwWs%2BfxpYmVnVe%2BZO5MVRtyyXG%2FgnntYRQhYC4PX0rQgxbH3wi"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 7cb1823e696c44ba-SIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 lOol7j-zq4u.svg
whatsapps.ltd/static/ 3 KB
2 KB 95ms
94ms Image
image/svg+xml 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whatsapps.ltd/static/lOol7j-zq4u.svg
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 533ef6670e3d9c0e44718d0afa43f2edda11b58586e9da4e8f621145cf84d4d2

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://whatsapps.ltd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Mon, 15 May 2023 04:17:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6461b248-a58"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cxmv9iqHPmHP0TiGX%2F2cTwJ8X56ynoY1cl8qTtSq9as1FyE11Spdz7YJQFn6Ufku24NxjfNujOfbRcF%2F8VaWugV4URSBNVHjgEvE8LzgEfmpjPcSo5zd2SX1HLvzdPMEwhX1kuiTZK%2BK%2BeBP"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 7cb1823e797244ba-SIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 199496234.png
whatsapps.ltd/static/ 22 KB
22 KB 12ms
11ms Image
image/png 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whatsapps.ltd/static/199496234.png
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 736ec0b63c70e29a0dad38ffb5a2f40c1b66062ac2e31ee4c21e43f2890b00e2

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://whatsapps.ltd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 71569
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 22083
last-modified: Mon, 15 May 2023 04:17:02 GMT
server: cloudflare
etag: "6461b23e-5643"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FRhCDmTjeX8ZzQfRRYbzRWfOMy4gGj6cN1MsBpmpFXo3r%2BvPXCrK2Ij7upjkTAHJ%2BuXVlXtRL8NeO%2Bwwq%2FFDe4P0tm3h%2B3XEZubnnmSIIcUpevST7leMkvjBlmgFiII2pFjC0dzIFlVmPnRr"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7cb1823e797344ba-SIN
expires: Tue, 20 Jun 2023 06:15:10 GMT

GET
H3 200 199550118.png
whatsapps.ltd/static/ 22 KB
22 KB 13ms
12ms Image
image/png 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whatsapps.ltd/static/199550118.png
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd899e99d525898009bc4673d29cf38ebdc2ddc6d14bd7263f2c53e322ef2ef4

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://whatsapps.ltd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 71569
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 22023
last-modified: Mon, 15 May 2023 04:17:06 GMT
server: cloudflare
etag: "6461b242-5607"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oF6a3L1VMSHkYorrsvP2W79mwKGyNzARkr6lnzBXzVzIQKcI1bPW37%2FF5Saw9DNlV8GTnWKtQmuSD6XFxTRK8rC5srerx2CqednIutsvUlIuNT90hGokYHgy3oqJzqfiGKONfNMDv4LUp5T9"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7cb1823e797544ba-SIN
expires: Tue, 20 Jun 2023 06:15:10 GMT

GET
H3 200 200489840.png
whatsapps.ltd/static/ 55 KB
56 KB 16ms
15ms Image
image/png 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whatsapps.ltd/static/200489840.png
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c230016694c1b4234b5b3330a1bb720efcc3152727ccde28ae63d9a89418cd24

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://whatsapps.ltd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 71569
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 56702
last-modified: Mon, 15 May 2023 04:17:08 GMT
server: cloudflare
etag: "6461b244-dd7e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UOF8G2jHTPX8mwIKC5OUew%2F77iGfwOEzRtVm6PmX0bdcl647JHI2PJSVPeK5NAr7I3a3xbCSjjIKHUuecggG4w1sIJgwJua%2BTWwZ7yp26XFfrLo4ggQY40m9DSpUETwuNFd4BC3K24Oasexy"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7cb1823e797644ba-SIN
expires: Tue, 20 Jun 2023 06:15:10 GMT

GET
H3 200 jquery.min.js Show response
whatsapps.ltd/static/js/ 95 KB
35 KB 15ms
15ms Script
application/javascript 2606:4700:3033::ac43:be83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://whatsapps.ltd/static/js/jquery.min.js
Requested by: Host: whatsapps.ltd
URL: https://whatsapps.ltd/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:be83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://whatsapps.ltd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 02:07:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 04:16:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 17844
etag: W/"6461b230-17b8b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P%2Fvh%2BspyZyRKLhh%2FZ3Lh1yIRlLaw5ryVDLiVmkLkSruFNclCpqclWIbln76rGcItCYOtvtLWeSm0Y7H%2Fq4VvSLypGDMb3n%2BvQNyb01lJGArNeCTz9lQmHemjUk0P916jjdsb38Wp9zLnZns%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 7cb1823e596144ba-SIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Mon, 22 May 2023 09:10:35 GMT

GET
H/1.1 200
OK hm.js Show response
hm.baidu.com/ 29 KB
12 KB 413ms
138ms Script
application/javascript 103.235.46.191
BAIDU Beijing Bai...

General

Check archive.org

Show headers Download Go to

Full URL

https://hm.baidu.com/hm.js?43c0903178a2b7f89eb875a54dca7069

Requested by

Host: whatsapps.ltd
URL: https://whatsapps.ltd/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),

Reverse DNS

Software

apache /

Resource Hash

345b0622fe085369772e1118f887d90dc425bc72b985886077e18c7cf35f3dbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://whatsapps.ltd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Mon, 22 May 2023 02:08:00 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=172800
Server: apache
Etag: 0fbce1b6e352bae20bb73f837ff372f3
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: application/javascript
Cache-Control: max-age=0, must-revalidate
Content-Length: 11260

GET
H/1.1 200
OK hm.gif
hm.baidu.com/ 43 B
299 B 113ms
113ms Image
image/gif 103.235.46.191
BAIDU Beijing Bai...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=en-us&lo=0&rnd=427456296&si=43c0903178a2b7f89eb875a54dca7069&v=1.3.0&lv=1&sn=13035&r=0&ww=1600&u=https%3A%2F%2Fwhatsapps.ltd%2F&tt=app

Requested by

Host: whatsapps.ltd
URL: https://whatsapps.ltd/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),

Reverse DNS

Software

apache /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800
X-Content-Type-Options	nosniff

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://whatsapps.ltd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 May 2023 02:08:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
Server: apache
Content-Type: image/gif
Cache-Control: private, max-age=0, no-cache
Content-Length: 43

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: dbjbempljhcmhlfpfacalomonjpalpko
URL: chrome-extension://dbjbempljhcmhlfpfacalomonjpalpko/scripts/inspector.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.hm.baidu.com/	1970-01-20 21:34:41	Name: HMACCOUNT_BFESS Value: D1B215A8EC34E225
.whatsapps.ltd/	1970-01-20 20:44:17	Name: Hm_lvt_43c0903178a2b7f89eb875a54dca7069 Value: 1684721280
.whatsapps.ltd/	1969-12-31 23:59:59	Name: Hm_lpvt_43c0903178a2b7f89eb875a54dca7069 Value: 1684721280

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: chrome-extension://dbjbempljhcmhlfpfacalomonjpalpko/scripts/inspector.js Message: Failed to load resource: net::ERR_UNKNOWN_URL_SCHEME

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dbjbempljhcmhlfpfacalomonjpalpko
hm.baidu.com
whatsapps.ltd
dbjbempljhcmhlfpfacalomonjpalpko
103.235.46.191
2606:4700:3033::ac43:be83
2606:4700:3037::6815:13f5
17a99746b0a4baf21319ba7fd1b1e2906ff320db5ae12e39c3b8cccb00223809
345b0622fe085369772e1118f887d90dc425bc72b985886077e18c7cf35f3dbc
45b351b48f5d9f15242e4528ce6dbd51854cc7c0020e42738f91f8e637630a3a
533ef6670e3d9c0e44718d0afa43f2edda11b58586e9da4e8f621145cf84d4d2
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
708f4f787db19dcb4cca817e1c38fba2baf0216b092c90d59648464791d57abb
70c5afec8f9e0757ab757763bc884038b7888d8d1f9e994deba75bdc38914f2d
736ec0b63c70e29a0dad38ffb5a2f40c1b66062ac2e31ee4c21e43f2890b00e2
a5b99d1919a30be33683a3c8dfab90ecef8f9fc1861ec00ccdd3c411a28dc85b
b1dec9c543ba7d88bd189d02e6b4b783e20061171c49094a928fc819ec788bcc
c230016694c1b4234b5b3330a1bb720efcc3152727ccde28ae63d9a89418cd24
cd899e99d525898009bc4673d29cf38ebdc2ddc6d14bd7263f2c53e322ef2ef4
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
fee58b2c5d1dfec9419b07d030239a7621d674ee2215ab7cf6de5bf0e480bb68

whatsapps.ltd Open in urlscan Pro 2606:4700:3033::ac43:be83 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

93 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

351 kBTransfer

818 kBSize

3 Cookies

16 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

36 JavaScript Global Variables

3 Cookies

1 Console Messages

Indicators

whatsapps.ltd Open in urlscan Pro
2606:4700:3033::ac43:be83 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

93 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

351 kB
Transfer

818 kB
Size

3
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!