chat.whatsapp.kasdfwasdf.ap.ngrok.io Open in urlscan Pro
2406:da18:27f:c801::6e:4 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
Submission: On June 03 via automatic, source certstream-suspicious (June 3rd 2023, 9:50:46 pm UTC) — Scanned from SG

Summary HTTP 9 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 2406:da18:27f:c801::6e:4, located in Singapore and belongs to AMAZON-02, US. The main domain is chat.whatsapp.kasdfwasdf.ap.ngrok.io.
TLS certificate: Issued by R3 on June 3rd 2023. Valid for: 3 months.

This is the only time chat.whatsapp.kasdfwasdf.ap.ngrok.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
8	2406:da18:27f... 2406:da18:27f:c801::6e:4	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2

8 2406:da18:27f:c801::6e:4 (Singapore)

ASN16509 (AMAZON-02, US)

chat.whatsapp.kasdfwasdf.ap.ngrok.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	ngrok.io chat.whatsapp.kasdfwasdf.ap.ngrok.io	323 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 249	28 KB
9	2

	Domain	Requested by
8	chat.whatsapp.kasdfwasdf.ap.ngrok.io	chat.whatsapp.kasdfwasdf.ap.ngrok.io cdnjs.cloudflare.com
1	cdnjs.cloudflare.com	chat.whatsapp.kasdfwasdf.ap.ngrok.io
9	2

This site contains links to these domains. Also see Links.

Domain
www.whatsapp.com
web.whatsapp.com
faq.whatsapp.com
www.whatsappbrand.com
blog.whatsapp.com
twitter.com
www.facebook.com

Subject Issuer	Validity	Valid
chat.whatsapp.kasdfwasdf.ap.ngrok.io R3	`2023-06-03` - `2023-09-01`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
Frame ID: A5E4E1C5EDC7A4BEEA905DFA40735647
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WhatsApp Group Invite

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

351 kB
Transfer

408 kB
Size

0
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://www.whatsapp.com/

Search URL Search Domain Scan URL

URL: https://web.whatsapp.com/
Title: WhatsApp Web

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/features/
Title: Features

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/download/
Title: Download

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/security/
Title: Security

Search URL Search Domain Scan URL

URL: https://faq.whatsapp.com/
Title: FAQ

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/contact/
Title: Get in touch

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/download

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/business/
Title: Business

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/about/
Title: About

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/join/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.whatsappbrand.com/
Title: Brand Center

Search URL Search Domain Scan URL

URL: https://blog.whatsapp.com/
Title: Blog

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/stories/
Title: WhatsApp Stories

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/android/
Title: Android

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/appstore/
Title: iPhone

Search URL Search Domain Scan URL

URL: https://twitter.com/whatsapp
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/WhatsApp
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/coronavirus/
Title: Coronavirus

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/legal/
Title: Privacy & Terms

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
chat.whatsapp.kasdfwasdf.ap.ngrok.io/ 14 KB
14 KB 342ms
321ms Document
text/html 2406:da18:27f:c801::6e:4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2406:da18:27f:c801::6e:4 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: ee9737d30f859a24de77a22daecf2ff9ba0aecd9f214615996b36ab69b75659e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

content-length: 14485
content-type: text/html; charset=UTF-8
date: Sat, 03 Jun 2023 21:50:32 GMT
host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
ngrok-trace-id: 2f0200f30fc94391e68b6870d91bbcbe

GET
H2 200 s9hWiNS5894.css
chat.whatsapp.kasdfwasdf.ap.ngrok.io/css/ 268 KB
269 KB 348ms
346ms Stylesheet
text/css 2406:da18:27f:c801::6e:4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/css/s9hWiNS5894.css
Requested by: Host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2406:da18:27f:c801::6e:4 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7fb86e02e050165fd98ad59af9d04771424fddc0dfd16d8b3c48b7accddde043

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

ngrok-trace-id: 3f8ee44bf187587e7294128af43d6065
date: Sat, 03 Jun 2023 21:50:33 GMT
host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
content-length: 274824
content-type: text/css; charset=UTF-8

GET
H2 200 Epf3I8GM5jv.css
chat.whatsapp.kasdfwasdf.ap.ngrok.io/css/ 23 KB
23 KB 563ms
562ms Stylesheet
text/css 2406:da18:27f:c801::6e:4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/css/Epf3I8GM5jv.css
Requested by: Host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2406:da18:27f:c801::6e:4 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 08e90cde4f55bf5ce3f112171e2ff3093af1e729f949088e3574905381174d0c

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

ngrok-trace-id: 24d17347ee16636b4c01bc96907c7e5f
date: Sat, 03 Jun 2023 21:50:33 GMT
host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
content-length: 23177
content-type: text/css; charset=UTF-8

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ 86 KB
28 KB 37ms
11ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 21:50:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1310049
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27748
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15851"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vx%2F8EhEHeguz61Q65LNCsyPQ%2Bt7lHO1gXDu6PNuEyOfO%2BNM95IAfasJEZ3%2BegW6qNcR%2FeH0p5oveR8SA1r5CKcBKuPH9iVvFwDvotoSevBDJHpQFacc%2FtyG6SyY6pvTYVf4q8mbF%2B3XlX4068klK6rQw"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7d1b272faa984023-SIN
expires: Thu, 23 May 2024 21:50:40 GMT

GET
H2 200 info.js Show response
chat.whatsapp.kasdfwasdf.ap.ngrok.io/js/ 3 KB
3 KB 294ms
293ms Script
application/javascript 2406:da18:27f:c801::6e:4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/js/info.js
Requested by: Host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2406:da18:27f:c801::6e:4 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8051aaebc03697186fa11ae9ebe07f0cff5e28407a0357faa24bc43652b6e564

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

ngrok-trace-id: 7ee8310e97b04cc7a321faadb8f36dfb
date: Sat, 03 Jun 2023 21:50:33 GMT
host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
content-length: 2560
content-type: application/javascript

GET
H2 200 location.js Show response
chat.whatsapp.kasdfwasdf.ap.ngrok.io/js/ 2 KB
2 KB 352ms
351ms Script
application/javascript 2406:da18:27f:c801::6e:4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/js/location.js
Requested by: Host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2406:da18:27f:c801::6e:4 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 0223e2ec0963fed8b10000b94d28e4f5f346e65a9e508c34fbe34457db5431b0

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

ngrok-trace-id: 54c9429d322bb36e9bb24b9b8d9e5c87
date: Sat, 03 Jun 2023 21:50:33 GMT
host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
content-length: 2190
content-type: application/javascript

GET
H2 200 -r3j-x8ZnM7.svg
chat.whatsapp.kasdfwasdf.ap.ngrok.io/images/ 5 KB
5 KB 352ms
352ms Image
image/svg+xml 2406:da18:27f:c801::6e:4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/images/-r3j-x8ZnM7.svg
Requested by: Host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/css/s9hWiNS5894.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2406:da18:27f:c801::6e:4 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4c38e1097b864a873243dee54c73acca2dbcfd48112e5afde26973b627b40835

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/css/s9hWiNS5894.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

ngrok-trace-id: 99d1ba70336454e54715fdab883a82be
date: Sat, 03 Jun 2023 21:50:34 GMT
host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
content-length: 4899
content-type: image/svg+xml

GET
H2 200 index.jpeg
chat.whatsapp.kasdfwasdf.ap.ngrok.io/images/ 7 KB
8 KB 342ms
342ms Image
image/jpeg 2406:da18:27f:c801::6e:4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/images/index.jpeg
Requested by: Host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2406:da18:27f:c801::6e:4 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 6c355d283300b4d8f65e5917facf30db31eeb75722a248dcf6e00bc26998a0e1

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

ngrok-trace-id: 473dc9473eeeae47b5fd87f9f21d7e8d
date: Sat, 03 Jun 2023 21:50:34 GMT
host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
content-length: 7604
content-type: image/jpeg

POST
H2 200 info_handler.php Show response
chat.whatsapp.kasdfwasdf.ap.ngrok.io/ 0
109 B 272ms
271ms XHR
text/html 2406:da18:27f:c801::6e:4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/info_handler.php
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2406:da18:27f:c801::6e:4 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / PHP/7.4.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: */*
Referer: https://chat.whatsapp.kasdfwasdf.ap.ngrok.io/
X-Requested-With: XMLHttpRequest
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

ngrok-trace-id: 5f61acb82001fdbd0b5fdc11163b5947
date: Sat, 03 Jun 2023 21:50:35 GMT
host: chat.whatsapp.kasdfwasdf.ap.ngrok.io
x-powered-by: PHP/7.4.33
content-type: text/html;charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
chat.whatsapp.kasdfwasdf.ap.ngrok.io
2406:da18:27f:c801::6e:4
2606:4700::6811:180e
0223e2ec0963fed8b10000b94d28e4f5f346e65a9e508c34fbe34457db5431b0
08e90cde4f55bf5ce3f112171e2ff3093af1e729f949088e3574905381174d0c
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
4c38e1097b864a873243dee54c73acca2dbcfd48112e5afde26973b627b40835
6c355d283300b4d8f65e5917facf30db31eeb75722a248dcf6e00bc26998a0e1
7fb86e02e050165fd98ad59af9d04771424fddc0dfd16d8b3c48b7accddde043
8051aaebc03697186fa11ae9ebe07f0cff5e28407a0357faa24bc43652b6e564
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee9737d30f859a24de77a22daecf2ff9ba0aecd9f214615996b36ab69b75659e

chat.whatsapp.kasdfwasdf.ap.ngrok.io Open in urlscan Pro 2406:da18:27f:c801::6e:4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

351 kBTransfer

408 kBSize

0 Cookies

21 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

0 Cookies

Indicators

chat.whatsapp.kasdfwasdf.ap.ngrok.io Open in urlscan Pro
2406:da18:27f:c801::6e:4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

351 kB
Transfer

408 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!