wss.whatsappm4.xyz
Open in
urlscan Pro
2606:4700:3034::ac43:a4da
Malicious Activity!
Public Scan
Effective URL: https://wss.whatsappm4.xyz/
Submission: On August 09 via api from CN — Scanned from DE
Summary
TLS certificate: Issued by WE1 on August 7th 2024. Valid for: 3 months.
This is the only time wss.whatsappm4.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 2606:4700:303... 2606:4700:3034::ac43:a4da | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 183.240.98.228 183.240.98.228 | 56040 (CMNET-GUA...) (CMNET-GUANGDONG-AP China Mobile communications corporation) | |
12 | 3 |
ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN)
hm.baidu.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
whatsappm4.xyz
wss.whatsappm4.xyz |
213 KB |
2 |
baidu.com
hm.baidu.com — Cisco Umbrella Rank: 8226 |
12 KB |
12 | 2 |
Domain | Requested by | |
---|---|---|
10 | wss.whatsappm4.xyz |
wss.whatsappm4.xyz
|
2 | hm.baidu.com |
wss.whatsappm4.xyz
|
12 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
whatsappm4.xyz WE1 |
2024-08-07 - 2024-11-05 |
3 months | crt.sh |
baidu.com GlobalSign RSA OV SSL CA 2018 |
2024-07-08 - 2025-08-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://wss.whatsappm4.xyz/
Frame ID: 0735D78BEC74E6F272E4CC7C30EDEBB1
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
wss.whatsappm4.xyzPage URL History Show full URLs
-
http://wss.whatsappm4.xyz/
HTTP 307
https://wss.whatsappm4.xyz/ Page URL
Detected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- <[^>]+\sdata-v(?:ue)?-
Baidu Analytics (百度统计) (Analytics) Expand
Detected patterns
- hm\.baidu\.com/hm\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://wss.whatsappm4.xyz/
HTTP 307
https://wss.whatsappm4.xyz/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
wss.whatsappm4.xyz/ Redirect Chain
|
1 KB 1010 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
54Cu16Ur5I.css
wss.whatsappm4.xyz/static/css/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
b8QktxlShW.css
wss.whatsappm4.xyz/static/css/ |
1 KB 914 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
XrU6rJcJ.js
wss.whatsappm4.xyz/static/js/ |
24 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f3jI9w2wtw.js
wss.whatsappm4.xyz/static/js/ |
518 KB 166 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
8cQktxlShW.css
wss.whatsappm4.xyz/static/css/ |
0 642 B |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
53jI9w2wtw.js
wss.whatsappm4.xyz/static/js/ |
0 3 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ddjI9w2wtw.js
wss.whatsappm4.xyz/static/js/ |
0 28 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hm.js
hm.baidu.com/ |
29 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ddjI9w2wtw.js
wss.whatsappm4.xyz/static/js/ |
95 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hm.gif
hm.baidu.com/ |
43 B 299 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
85 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
wss.whatsappm4.xyz/ |
787 B 1 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _hmt function| a3_0x270c27 function| a3_0x172bed function| a3_0x327dd5 function| a3_0x506108 function| a3_0x5013 function| a3_0x151f function| a3_0x5d9f04 object| webpackJsonp function| a0_0x433a function| a0_0x3791 function| _0x32bd94 object| $cookies function| a1_0x12eea1 function| a1_0x4740b3 function| a1_0x2efe function| a1_0x4900f2 function| a1_0x6b83a function| a1_0x91fe function| a1_0x2155d8 boolean| _bdhm_loaded_b4f314a33c2093bda1e4478b665f72834 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.hm.baidu.com/ | Name: HMACCOUNT_BFESS Value: 379506CAC77BE8E2 |
|
.wss.whatsappm4.xyz/ | Name: Hm_lvt_b4f314a33c2093bda1e4478b665f7283 Value: 1723214800 |
|
.wss.whatsappm4.xyz/ | Name: Hm_lpvt_b4f314a33c2093bda1e4478b665f7283 Value: 1723214800 |
|
.wss.whatsappm4.xyz/ | Name: HMACCOUNT Value: 379506CAC77BE8E2 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
hm.baidu.com
wss.whatsappm4.xyz
183.240.98.228
2606:4700:3034::ac43:a4da
48bc13bb729802926a12aef7a6a2bd977eb146fd66103e101fff9ff0638a67af
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
5c1cfa9a55bf6c38a20dee0667f770df677ccb54faf0b6a0cf1181d5045bee05
759dc14a647618bcae5099437c89998c28a2828fd56784bf1ce88edea1c037fa
876041e5065bd5aff3343f633b60a86e13370044741555213ec99711aacea8a2
9f790b3d8484ef96968bd979b09d5311e7f34eb5a67ee16b7cec64aeaa76fa82
c92276daac309a80726cd32e0d3e31688d6c7704bfe6d73908081aa15ca75199
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0cadf240e89340b93df35240e7809039c1c574be05fbe2cf3243e2f487bc9ec
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f4c5fc58b445591f1ebd44ddba1304dec46ebd8e2a7894f6a968dce163d5ed22
f8a8e99289456df4ffbb2acddfed64820cda68b09d8646eae569bad738ed1cfd