uua.tuan203.top
Open in
urlscan Pro
172.67.187.79
Malicious Activity!
Public Scan
Effective URL: https://uua.tuan203.top/
Submission Tags: falconsandbox
Submission: On June 02 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on May 11th 2024. Valid for: 3 months.
This is the only time uua.tuan203.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 202.162.98.174 202.162.98.174 | 64050 (BCPL-SG B...) (BCPL-SG BGPNET Global ASN) | |
4 | 172.67.187.79 172.67.187.79 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2 |
ASN64050 (BCPL-SG BGPNET Global ASN, SG)
whatsapp.whotsappcn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
tuan203.top
uua.tuan203.top |
342 KB |
1 |
whotsappcn.com
1 redirects
whatsapp.whotsappcn.com |
477 B |
4 | 2 |
Domain | Requested by | |
---|---|---|
4 | uua.tuan203.top |
uua.tuan203.top
|
1 | whatsapp.whotsappcn.com | 1 redirects |
4 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
tuan203.top GTS CA 1P5 |
2024-05-11 - 2024-08-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://uua.tuan203.top/
Frame ID: 1B1DCA0794FD9E8D425860C13789FBB5
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://whatsapp.whotsappcn.com/
HTTP 307
https://whatsapp.whotsappcn.com/ HTTP 301
https://uua.tuan203.top/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://whatsapp.whotsappcn.com/
HTTP 307
https://whatsapp.whotsappcn.com/ HTTP 301
https://uua.tuan203.top/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
uua.tuan203.top/ Redirect Chain
|
380 B 642 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
iij4mpellevv568qgdafd0180b.css
uua.tuan203.top/css/ |
429 KB 109 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
iij4mpellevv568qgdafd0180b.js
uua.tuan203.top/js/ |
871 KB 232 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
uua.tuan203.top/ |
548 B 556 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
85 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _0x43f838 function| QRCode function| guid function| getLocation function| _0x5a43 function| _0x1947 function| sock function| qrcode function| qrcode2 function| refreshqrcode function| _0x28d705 function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
uua.tuan203.top
whatsapp.whotsappcn.com
172.67.187.79
202.162.98.174
3d70239c215961ece3344d0360f15ff9621567f50a84e2d58fbdbecbb9f0b934
4a2a95b6c4b266ec4c147a314186500c8e8f38f65093e93e9f2188e2107f6a3d
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
62902c0552196c46e0c93761b1c9bb84b38a9560fb4ee572fbf743266005b26c
656e11e3a7cde0c748bd1bb714c745c3bce6658b81843fe19fb9e37bdfb33254
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
e9e50f784ad1e8f7d63d8f1dd4012a19a90fd197c67a7e974250a7f0744160f3