wws.whptapps.com Open in urlscan Pro
2606:4700:3034::6815:c29  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response wws.whptapps.com/	18 KB 7 KB	2628ms 506ms	Document text/html	2606:4700:3034::6815:c29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wws.whptapps.com/ Protocol HTTP/1.1 Server 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a456b1dee284e827c4dc7fffe7495606cc92efcae3e3c217c01353a63ecc1f13 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers CF-Cache-Status DYNAMIC CF-RAY 816f9ee1ce5768f8-FRA Connection keep-alive Content-Encoding gzip Content-Type text/html Date Mon, 16 Oct 2023 10:29:25 GMT Last-Modified Sat, 30 Sep 2023 16:44:59 GMT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r4aRzZbS0iN4FQMiIDsIW4QLmX2PIbajL60DDSDjAoy4jtqPIwLG83z41uOoPLfNmTFhSgTCOfI63lii0gD35W78PHmz4p8%2BaRG%2BCnk8GMCMxq5EtFUtM3ZvrE06JfgoE9nlQO7AFeYM9fVpNtXb"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400
GET H/1.1	200 OK	jquery.min.js Show response cdn.staticfile.org/jquery/1.10.2/	91 KB 33 KB	904ms 26ms	Script application/javascript	163.181.92.187 TAOBAO Zhejiang T...
General Check archive.org Show headers Download Go to Full URL https://cdn.staticfile.org/jquery/1.10.2/jquery.min.js Requested by Host: wws.whptapps.com URL: http://wws.whptapps.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 163.181.92.187 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN), Reverse DNS Software Tengine / Resource Hash 89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e Request headers accept-language de-DE,de;q=0.9 Referer http://wws.whptapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers X-Log X-Log Date Sun, 15 Oct 2023 13:24:43 GMT Via cache23.l2de2[0,0,304-0,H], cache2.l2de2[0,0], ens-cache13.de5[0,0,200-0,H], ens-cache6.de5[1,0] Content-Encoding gzip X-Svr IO X-Reqid B7EAAABjmaa8So4X Age 75883 X-Swift-CacheTime 86398 X-Cache HIT TCP_MEM_HIT dirn:11:412510519 Content-Transfer-Encoding binary Content-Disposition inline; filename="jquery.min.js"; filename*=utf-8''jquery.min.js Connection keep-alive X-Swift-SaveTime Sun, 15 Oct 2023 13:24:45 GMT Content-Length 32989 Last-Modified Tue, 16 Feb 2016 04:22:54 GMT Server Tengine Etag "FuLzYD4jcR9kRvJ4pBHZBWI9ZSAe.gz" Access-Control-Max-Age 2592000 Ali-Swift-Global-Savetime 1697376283 Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Expose-Headers X-Log, X-Reqid Cache-Control public, max-age=31536000 Vary Accept-Encoding Accept-Ranges bytes X-Qiniu-Zone 0 Timing-Allow-Origin * EagleId a3b55c9a16974521667995637e
GET H/1.1	200 OK	stylex-ce269a9819ee8f292840728689a22cc5.css wws.whptapps.com/WhatsApp_files/	175 KB 50 KB	742ms 740ms	Stylesheet text/css	2606:4700:3034::6815:c29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wws.whptapps.com/WhatsApp_files/stylex-ce269a9819ee8f292840728689a22cc5.css Requested by Host: wws.whptapps.com URL: http://wws.whptapps.com/ Protocol HTTP/1.1 Server 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 775fafc214e32a36e2a39e694322fed097e37d964c9dce65663655b64492d068 Request headers accept-language de-DE,de;q=0.9 Referer http://wws.whptapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Mon, 16 Oct 2023 10:29:26 GMT Content-Encoding gzip CF-Cache-Status MISS NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Sat, 15 Jul 2023 07:33:04 GMT Server cloudflare ETag W/"64b24bb0-2bb72" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RjWWk%2BrNCjKyLaL63M2t2BrSOTJ5unGbUfFkz6b%2BEPuGFnEIhIW5oUNlVrgtxl0E9BrnMYufqstmV95v4%2Fen1ijPyuyEa53tI%2F5Yf1a228cTifRa3ZJa8fXopTafM6RFrajxDlncE3uD9pFo7rea"}],"group":"cf-nel","max_age":604800} Content-Type text/css Cache-Control max-age=43200 CF-RAY 816f9ee4f9ba68f8-FRA Expires Mon, 16 Oct 2023 22:29:26 GMT
GET H/1.1	200 OK	app-6d34864fd47903428794.css wws.whptapps.com/WhatsApp_files/	187 KB 66 KB	743ms 741ms	Stylesheet text/css	2606:4700:3034::6815:c29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wws.whptapps.com/WhatsApp_files/app-6d34864fd47903428794.css Requested by Host: wws.whptapps.com URL: http://wws.whptapps.com/ Protocol HTTP/1.1 Server 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 69acbe3d7c92af1a509b7351cabfac35b356c18eef8c9299f5ac354acfdba079 Request headers accept-language de-DE,de;q=0.9 Referer http://wws.whptapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Mon, 16 Oct 2023 10:29:26 GMT Content-Encoding gzip CF-Cache-Status MISS NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Sat, 15 Jul 2023 07:33:02 GMT Server cloudflare ETag W/"64b24bae-2eab4" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FyFuDf6lAZfd1ndVOkh5%2F6npwm2pANEi%2FufHU6SOLkSZO7ge8j%2BSXRdlf%2BCaFynmTyy4bGVFHgzWyU20Rx2ChojOXD1HbPqW55qaOgiULKVXrof99wHI6wbCz%2BANJ1rVflG5MyBn8dp5HWO9aCUz"}],"group":"cf-nel","max_age":604800} Content-Type text/css Cache-Control max-age=43200 CF-RAY 816f9ee4fa745d79-FRA Expires Mon, 16 Oct 2023 22:29:26 GMT
GET H/1.1	200 OK	main~.b66100b3486cd1857cd3.css wws.whptapps.com/WhatsApp_files/	21 KB 6 KB	29ms 21ms	Stylesheet text/css	2606:4700:3034::6815:c29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wws.whptapps.com/WhatsApp_files/main~.b66100b3486cd1857cd3.css Requested by Host: wws.whptapps.com URL: http://wws.whptapps.com/ Protocol HTTP/1.1 Server 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a636dbd66666f13902713e7bc7d2e1cab497b299f533495759a2c68c459c5a4 Request headers accept-language de-DE,de;q=0.9 Referer http://wws.whptapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Mon, 16 Oct 2023 10:29:25 GMT Content-Encoding gzip CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 1846 Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Sat, 15 Jul 2023 07:33:04 GMT Server cloudflare ETag W/"64b24bb0-55b9" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PCZ0bb4uO9S%2BRaMjGpM4Zt9fkbjgZxBQGVVAWM5M3P61t3utkrBEx6nF5Wy3bpYkGYsq%2FuR%2F%2B%2Bt71ytV87HbLpbMPtqIhdCBCJk4DOR3rl36r4fsiJiOHGaoVdACBa7bqhGHDkZGZuH5sNyQfTcu"}],"group":"cf-nel","max_age":604800} Content-Type text/css Cache-Control max-age=43200 CF-RAY 816f9ee50da64dc6-FRA Expires Mon, 16 Oct 2023 21:58:39 GMT
GET H/1.1	200 OK	main.fdf0caa2786c3269572d.css wws.whptapps.com/WhatsApp_files/	150 KB 37 KB	31ms 23ms	Stylesheet text/css	2606:4700:3034::6815:c29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wws.whptapps.com/WhatsApp_files/main.fdf0caa2786c3269572d.css Requested by Host: wws.whptapps.com URL: http://wws.whptapps.com/ Protocol HTTP/1.1 Server 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 79acde4aa0ad3feafd96271141640066d0c52c050724b13272b1ca3d6930f8d1 Request headers accept-language de-DE,de;q=0.9 Referer http://wws.whptapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Mon, 16 Oct 2023 10:29:25 GMT Content-Encoding gzip CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 1803 Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Sat, 15 Jul 2023 07:33:02 GMT Server cloudflare ETag W/"64b24bae-257df" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KaJfI%2B1wDRmDMyBIHc9pVomycvPIXFLwrS6YKaJZ1mfPKzn4gtsC%2FHiH1cbBSM3guwO7wmr0nlXMnHd5ypvXKBi5kqB6MknFWVjx0p%2BwYvJGGal9fUEoHcQIl08oEWOE1GNpbQ3ytclQMzqow3fR"}],"group":"cf-nel","max_age":604800} Content-Type text/css Cache-Control max-age=43200 CF-RAY 816f9ee50dcd2c36-FRA Expires Mon, 16 Oct 2023 21:59:22 GMT
GET H/1.1	200 OK	qr-video_0c6ec69b054fdeb31cf3e5e10290fd8e.png wws.whptapps.com/WhatsApp_files/	16 KB 17 KB	751ms 743ms	Image image/png	2606:4700:3034::6815:c29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://wws.whptapps.com/WhatsApp_files/qr-video_0c6ec69b054fdeb31cf3e5e10290fd8e.png Requested by Host: wws.whptapps.com URL: http://wws.whptapps.com/ Protocol HTTP/1.1 Server 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d980ab372658f4c7c8f07d730ef6dc67e3fb3471f37928274f915c0308850994 Request headers Referer http://wws.whptapps.com/ Origin http://wws.whptapps.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Mon, 16 Oct 2023 10:29:26 GMT CF-Cache-Status MISS NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 16259 Last-Modified Sat, 15 Jul 2023 07:33:04 GMT Server cloudflare ETag "64b24bb0-3f83" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cN45VK%2FxbZ6rKzVaEVfQCPc2W7NnuCri5peJXKNYtCCTYDdk5ZKRJk24omRk%2FbpWLszI9dH8GO6z3mlvHHhXFek5QARXZTKVkdLaOqtu9hir1Wwn6T7H6U3lyyinBCnaQ32ElxSeVQj3YrzimSF1"}],"group":"cf-nel","max_age":604800} Content-Type image/png Cache-Control max-age=2592000 Accept-Ranges bytes CF-RAY 816f9ee50aa00472-FRA Expires Wed, 15 Nov 2023 10:29:26 GMT
GET H/1.1	200 OK	m.js Show response wws.whptapps.com/	3 KB 2 KB	30ms 22ms	Script application/javascript	2606:4700:3034::6815:c29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wws.whptapps.com/m.js?ver=1.5 Requested by Host: wws.whptapps.com URL: http://wws.whptapps.com/ Protocol HTTP/1.1 Server 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f6979ffca16ea5a6bd7f03ed20be942b9765e35cbb54ee30c902561188b7dbd6 Request headers accept-language de-DE,de;q=0.9 Referer http://wws.whptapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Mon, 16 Oct 2023 10:29:25 GMT Content-Encoding gzip CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 12 Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Sat, 30 Sep 2023 17:11:31 GMT Server cloudflare ETag W/"651856c3-abb" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JecmXJH%2Bcr7%2BYBS%2Bb6gGhpIof0qEO8rR7vQurOwm0IgAd9JvdIAq8KY4drPQz2NZvqLcgPS3tHDgmRf5frTvBgB1MmkrvUr9dlur2Vt4NLLthyvzmTF6iX9%2BvciW1vV0ncRxLFfz1RrLgNyCpzy9"}],"group":"cf-nel","max_age":604800} Content-Type application/javascript Cache-Control max-age=43200 CF-RAY 816f9ee50c3f6955-FRA Expires Mon, 16 Oct 2023 22:29:13 GMT
GET H3	200	c960e78a-92a1-436d-a8fa-9227fa42a085.png ssr.wjalttas.vip/qrcodes/	2 KB 2 KB	337ms 319ms	Image image/png	2606:4700:3033::6815:318 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://ssr.wjalttas.vip/qrcodes/c960e78a-92a1-436d-a8fa-9227fa42a085.png?1697452167466 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:318 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash c7c3665f4dc63e2531cd7fa328a7204e716231343d8e996c79502194f0d56f02 Request headers accept-language de-DE,de;q=0.9 Referer http://wws.whptapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Mon, 16 Oct 2023 10:29:27 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-powered-by Express alt-svc h3=":443"; ma=86400 content-length 1712 last-modified Mon, 16 Oct 2023 10:29:10 GMT server cloudflare etag W/"6b0-18b38084fcc" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IXvsBwfIU%2BtqQy9zcE9XQeTpIrE1M%2B490py%2BERagl2R5D%2BjHGOwuvXGzhCKUfDAUSyg5JHcf%2BeogOv%2F2h0PumvGGkZvCyNYxcYtHD2eZ6AFLjpQBNKLKIruOPdNfHqlMVukqLsBqqZptzNeu%2Be2Q"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control public, max-age=14400 accept-ranges bytes cf-ray 816f9eeecf5c9b86-FRA
GET H3	200	c960e78a-92a1-436d-a8fa-9227fa42a085.png ssr.wjalttas.vip/qrcodes/	2 KB 2 KB	354ms 353ms	Image image/png	2606:4700:3033::6815:318 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://ssr.wjalttas.vip/qrcodes/c960e78a-92a1-436d-a8fa-9227fa42a085.png?1697452170467 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:318 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash c7c3665f4dc63e2531cd7fa328a7204e716231343d8e996c79502194f0d56f02 Request headers accept-language de-DE,de;q=0.9 Referer http://wws.whptapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Mon, 16 Oct 2023 10:29:30 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-powered-by Express alt-svc h3=":443"; ma=86400 content-length 1712 last-modified Mon, 16 Oct 2023 10:29:10 GMT server cloudflare etag W/"6b0-18b38084fcc" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9GRdKcWX4K%2F03Sz9CCtRex3c72e%2B9HXu%2B58h5QdeDjfM7orZGVJO%2FdEsu9LuGGa1O387bQTfsAvXEQPkx4tsiW8dO5zSD6UG29NWqAJ0xNKP7u5gJjbxiAhPqmo7M6OQve4sKhBC64XmvvxYnEjg"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control public, max-age=14400 accept-ranges bytes cf-ray 816f9f0178249b86-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery boolean| systemThemeDark object| theme object| systemThemeMode object| systemTheme boolean| darkTheme string| srv number| i_referer number| isEnable function| guid function| getUUID string| uuid function| xorEncryptDecrypt object| ws function| status_callback function| refershQrCode object| json number| code string| qrcode_text

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.staticfile.org
ssr.wjalttas.vip
wws.whptapps.com
163.181.92.187
2606:4700:3033::6815:318
2606:4700:3034::6815:c29
69acbe3d7c92af1a509b7351cabfac35b356c18eef8c9299f5ac354acfdba079
775fafc214e32a36e2a39e694322fed097e37d964c9dce65663655b64492d068
79acde4aa0ad3feafd96271141640066d0c52c050724b13272b1ca3d6930f8d1
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
8a636dbd66666f13902713e7bc7d2e1cab497b299f533495759a2c68c459c5a4
a456b1dee284e827c4dc7fffe7495606cc92efcae3e3c217c01353a63ecc1f13
c7c3665f4dc63e2531cd7fa328a7204e716231343d8e996c79502194f0d56f02
d980ab372658f4c7c8f07d730ef6dc67e3fb3471f37928274f915c0308850994
f6979ffca16ea5a6bd7f03ed20be942b9765e35cbb54ee30c902561188b7dbd6