urlscan.io logo urlscan.io
SecurityTrails logo

wha2.dltem.cn Open in urlscan Pro
202.162.98.174  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://wha2.dltem.cn/
Submission: On June 22 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 202.162.98.174, located in Ho Chi Minh City, Viet Nam and belongs to CTGSERVERLIMITED-AS-AP CTG Server Limited, HK. The main domain is wha2.dltem.cn.
TLS certificate: Issued by R10 on June 21st 2024. Valid for: 3 months.
This is the only time wha2.dltem.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
4 202.162.98.174 152194 (CTGSERVER...)
4 2
Apex Domain
Subdomains		 Transfer
4 dltem.cn
wha2.dltem.cn
341 KB
4 1
Domain Requested by
4 wha2.dltem.cn wha2.dltem.cn
4 1

This site contains no links.

Subject Issuer Validity Valid
whats.yuehuak.cn
R10		 2024-06-21 -
2024-09-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://wha2.dltem.cn/
Frame ID: B1ADFE17408520C841E46994B1BDCCFF
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

341 kB
Transfer

1294 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
wha2.dltem.cn/ 		358 B
511 B 		Document
General
Check archive.org
Download Go to
Full URL
https://wha2.dltem.cn/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.162.98.174 Ho Chi Minh City, Viet Nam, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),
Reverse DNS
Software
nginx /
Resource Hash
6c1c409e142ecce8b2a9f4a12f3e757caff45f31eb71f89a66dc0c10e1f2e494
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
content-length
358
content-type
text/html
date
Sat, 22 Jun 2024 02:16:57 GMT
etag
"665e34ea-166"
last-modified
Mon, 03 Jun 2024 21:26:02 GMT
server
nginx
strict-transport-security
max-age=31536000
xsuoblecc85e50a.css
wha2.dltem.cn/css/ 		429 KB
109 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wha2.dltem.cn/css/xsuoblecc85e50a.css
Requested by
Host: wha2.dltem.cn
URL: https://wha2.dltem.cn/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.162.98.174 Ho Chi Minh City, Viet Nam, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),
Reverse DNS
Software
nginx /
Resource Hash
3d70239c215961ece3344d0360f15ff9621567f50a84e2d58fbdbecbb9f0b934
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wha2.dltem.cn/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 22 Jun 2024 02:16:57 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sun, 12 May 2024 21:18:15 GMT
server
nginx
etag
W/"66413217-6b550"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sat, 22 Jun 2024 14:16:57 GMT
xsuoblecc85e50a.js
wha2.dltem.cn/js/ 		854 KB
231 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wha2.dltem.cn/js/xsuoblecc85e50a.js
Requested by
Host: wha2.dltem.cn
URL: https://wha2.dltem.cn/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.162.98.174 Ho Chi Minh City, Viet Nam, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),
Reverse DNS
Software
nginx /
Resource Hash
18c70911a06ed52717d157dd4887c3b59618d8ba6fa5be58ab5142ec7a9be150
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wha2.dltem.cn/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 22 Jun 2024 02:16:57 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Mon, 03 Jun 2024 21:24:40 GMT
server
nginx
etag
W/"665e3498-d582f"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Sat, 22 Jun 2024 14:16:57 GMT
favicon.ico
wha2.dltem.cn/ 		548 B
611 B 		Other
General
Check archive.org
Download Go to
Full URL
https://wha2.dltem.cn/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.162.98.174 Ho Chi Minh City, Viet Nam, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),
Reverse DNS
Software
nginx /
Resource Hash
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wha2.dltem.cn/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 22 Jun 2024 02:16:58 GMT
server
nginx
content-length
548
content-type
text/html
truncated
/ 		85 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		9 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
00ef7c6e08ee5ac78a6e289d5c64b92c079f0ff5b3d977888cfbd64965af85d3

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| _0x275d57 function| QRCode function| guid function| _0x1f01 function| getLocation function| sock function| qrcode function| _0x4df1 function| qrcode2 function| refreshqrcode function| _0x178f85 function| $ function| jQuery

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://wha2.dltem.cn/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000