wwf.whatsdklam.icu Open in urlscan Pro
2606:4700:3034::ac43:c08c Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://wwf.whatsdklam.icu/
Effective URL:
https://wwf.whatsdklam.icu/
Submission: On July 04 via api (July 4th 2024, 6:04:05 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3034::ac43:c08c, located in United States and belongs to CLOUDFLARENET, US. The main domain is wwf.whatsdklam.icu.
TLS certificate: Issued by WE1 on July 3rd 2024. Valid for: 3 months.

This is the only time wwf.whatsdklam.icu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
9	2606:4700:303... 2606:4700:3034::ac43:c08c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.192.140 172.67.192.140	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	3

9 2606:4700:3034::ac43:c08c (United States)

ASN13335 (CLOUDFLARENET, US)

wwf.whatsdklam.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.192.140 (United States)

ASN13335 (CLOUDFLARENET, US)

wwf.whatsdklam.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	whatsdklam.icu wwf.whatsdklam.icu	208 KB
10	1

	Domain	Requested by
10	wwf.whatsdklam.icu	wwf.whatsdklam.icu
10	1

This site contains no links.

Subject Issuer	Validity	Valid
whatsdklam.icu WE1	`2024-07-03` - `2024-10-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://wwf.whatsdklam.icu/
Frame ID: 35A73383B57DDE3584A5B4D7A32DEDF2
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

QR code Login

Page URL History Show full URLs

http://wwf.whatsdklam.icu/ HTTP 307
https://wwf.whatsdklam.icu/ Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

3
IPs

1
Countries

208 kB
Transfer

645 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://wwf.whatsdklam.icu/ HTTP 307
https://wwf.whatsdklam.icu/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response wwf.whatsdklam.icu/ Redirect Chain http://wwf.whatsdklam.icu/ https://wwf.whatsdklam.icu/	1 KB 856 B	532ms 458ms	Document text/html	2606:4700:3034::ac43:c08c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wwf.whatsdklam.icu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c08c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `eae74f3767a11fc1b6accf9aa631fd71018ddc92f82e2b7bea85778f0db479db` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 89e108efba52910c-FRA content-encoding br content-type text/html date Thu, 04 Jul 2024 18:03:57 GMT last-modified Sat, 15 Jun 2024 11:35:16 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HsJFMt78nOTUKhBINj0na1HpRn%2BwAJwMPGcR5ppfON%2BgIi%2B6sotb80SZDJ1thKFe2nzJxL%2BzY2dumawTlwVe4%2FWG5Lnp5QQslzAPibqhJca6eUYGyBbSlY0mBFuP5yiepA621ujXze2AQ2C5hF5pKMs%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding Redirect headers Location https://wwf.whatsdklam.icu/ Non-Authoritative-Reason HttpsUpgrades
GET H2	200	b81f3f69.css wwf.whatsdklam.icu/static/css/	1 KB 789 B	446ms 444ms	Stylesheet text/css	2606:4700:3034::ac43:c08c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wwf.whatsdklam.icu/static/css/b81f3f69.css Requested by Host: wwf.whatsdklam.icu URL: https://wwf.whatsdklam.icu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c08c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `759dc14a647618bcae5099437c89998c28a2828fd56784bf1ce88edea1c037fa` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wwf.whatsdklam.icu/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 18:03:57 GMT content-encoding gzip cf-cache-status MISS last-modified Sat, 15 Jun 2024 11:35:32 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"666d7c84-47e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A2F1x1ErUee%2B0mW5LzH19mOJHUnpKXtOuFMCbismVfHIkI6vCU32wjPoEzvYQBpN0rbQeILAxjshoRxgwQWl8KX4qZC92aNRh0DqrmyOxt8ja95a6eiLJiJFhTFb9FlkGY%2F0m6d7QM%2FJ2J5Y5jeYADE%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 89e108f29e1c910c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	ed74c755.css wwf.whatsdklam.icu/static/css/	10 KB 3 KB	464ms 463ms	Stylesheet text/css	2606:4700:3034::ac43:c08c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wwf.whatsdklam.icu/static/css/ed74c755.css Requested by Host: wwf.whatsdklam.icu URL: https://wwf.whatsdklam.icu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c08c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6ad47184b37f307576748d5c619b3c760fc87ecb0f7916b5b427e1a30a0fd25c` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wwf.whatsdklam.icu/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 18:03:57 GMT content-encoding gzip cf-cache-status MISS last-modified Sat, 15 Jun 2024 11:35:33 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"666d7c85-29a4" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fgSVh%2BWy9i50KKZiJCMkzIAycnGMNO5Dcv5WtZqXRpm9N4NUYcVFwAqLrWiayvrqqgEX1LC5wmtZ7G1PvxoYJeasZnawhlb08OZIB0jQbchMLSbpvz6zAZ9xnfIWLMCAUE7a9f3IJFH5aMgn5YU2gcw%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 89e108f29e1f910c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	d35de392.js Show response wwf.whatsdklam.icu/static/js/	24 KB 8 KB	495ms 494ms	Script application/javascript	2606:4700:3034::ac43:c08c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wwf.whatsdklam.icu/static/js/d35de392.js Requested by Host: wwf.whatsdklam.icu URL: https://wwf.whatsdklam.icu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c08c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `49ef8f9f3383ce25457cfa17d4f11e1c76e6bc21856c85f6f6a1888f142be5d7` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wwf.whatsdklam.icu/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 18:03:57 GMT content-encoding gzip cf-cache-status MISS last-modified Sat, 15 Jun 2024 11:35:29 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"666d7c81-6032" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FJWJ6SUWcEDLtl4IvUFo%2F9gsi3YUlZR9INV826%2FORBYdw9Z0RznEKV6gV1TBvqXExUQ3O0fL08y3doCykSi5K3xv072nMHVLmufiR8BBUYjcvQKcy4ZsteESr46HFyPWixMLW8UIjUqJj6V7y5VtbjI%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 89e108f29e20910c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	f31354d5.js Show response wwf.whatsdklam.icu/static/js/	517 KB 165 KB	898ms 897ms	Script application/javascript	2606:4700:3034::ac43:c08c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wwf.whatsdklam.icu/static/js/f31354d5.js Requested by Host: wwf.whatsdklam.icu URL: https://wwf.whatsdklam.icu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c08c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8c366f0448ef28db6b2daac87ff13dfa80867c321a10bb65cc4ca7965c087f41` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wwf.whatsdklam.icu/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 18:03:58 GMT content-encoding gzip cf-cache-status MISS last-modified Sat, 15 Jun 2024 11:35:31 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"666d7c83-81402" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uqey74ekL2QVs2I1PPj79wlZhl1XWKN%2FkLPrz7KbCnpLTdxrU0QscqteH5NEIfhB0wRYTzlnsFWkyUJ%2FOJ%2BZmMYg1a85l4vpi5AMfX6KUUWaty2pXOPab%2FaMffEqWNtt6U%2F8aSaSrVLmOfl5SrCyx08%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 89e108f29e21910c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	8cb0399b.css wwf.whatsdklam.icu/static/css/	0 473 B	461ms 460ms	Other text/css	2606:4700:3034::ac43:c08c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wwf.whatsdklam.icu/static/css/8cb0399b.css Requested by Host: wwf.whatsdklam.icu URL: https://wwf.whatsdklam.icu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c08c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wwf.whatsdklam.icu/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 18:03:57 GMT content-encoding br cf-cache-status MISS last-modified Sat, 15 Jun 2024 11:35:32 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"666d7c84-16f" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SsFi1gHSnnevu7e2UwmgTXLzy9NcQbr%2BIT%2FoNgUmRbnYUdS7f42IpxQjwvXY1ft%2BRBdm2PZXd4IfTBU50tyKry%2FdyQ8M0JoTUQy6WZ2t7ah5wRT8TlGYdH%2FftaF4kVoEp9SbUV3CkeD%2FU4ajB9Orc40%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 89e108f2be3a910c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	c65a02c0.js wwf.whatsdklam.icu/static/js/	0 24 KB	699ms 699ms	Other application/javascript	2606:4700:3034::ac43:c08c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wwf.whatsdklam.icu/static/js/c65a02c0.js Requested by Host: wwf.whatsdklam.icu URL: https://wwf.whatsdklam.icu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c08c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wwf.whatsdklam.icu/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 18:03:57 GMT content-encoding gzip cf-cache-status MISS last-modified Sat, 15 Jun 2024 11:35:29 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"666d7c81-14602" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3w7HTVCM%2FRN4wFlMabzIVpVCTB7xtWHcv9TZET8ooTtot6FGgwQv4n400I7f7%2B1oqesUv2rVuUyWMRpBXcaCx97kupWmB4fRMWvrmuzgaYVE9XecCmlaS1cNUuo0Tk94ERzLxFBysWVeSkVUUECOAI%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 89e108f2be3d910c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	efb0b0c2.js wwf.whatsdklam.icu/static/js/	0 3 KB	482ms 482ms	Other application/javascript	2606:4700:3034::ac43:c08c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wwf.whatsdklam.icu/static/js/efb0b0c2.js Requested by Host: wwf.whatsdklam.icu URL: https://wwf.whatsdklam.icu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c08c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wwf.whatsdklam.icu/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 18:03:57 GMT content-encoding gzip cf-cache-status MISS last-modified Sat, 15 Jun 2024 11:35:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"666d7c82-2155" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pXvod7KkMcjhIsRUk%2BAFocDm9hbJR%2FBGHopHBJB03%2BJRCi1Tes7eP0FEwHZYhColzZLbh3O2MbopIInRnhqu1Hui%2Fp9DHIPqrC%2Bz1nMQND6ztMrml6Fd7GB7UnZ1tVFzgFS0z9ODmL%2BiahH09L11Nyg%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 89e108f2be3e910c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	c65a02c0.js Show response wwf.whatsdklam.icu/static/js/	82 KB 0	0ms 0ms	Script application/javascript	2606:4700:3034::ac43:c08c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wwf.whatsdklam.icu/static/js/c65a02c0.js Requested by Host: wwf.whatsdklam.icu URL: https://wwf.whatsdklam.icu/static/js/d35de392.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c08c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `099a36d4c6594642d2d794431e94712b85599b6960e122b7c1e76b2362a4aff6` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wwf.whatsdklam.icu/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 18:03:57 GMT content-encoding gzip cf-cache-status MISS last-modified Sat, 15 Jun 2024 11:35:29 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"666d7c81-14602" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3w7HTVCM%2FRN4wFlMabzIVpVCTB7xtWHcv9TZET8ooTtot6FGgwQv4n400I7f7%2B1oqesUv2rVuUyWMRpBXcaCx97kupWmB4fRMWvrmuzgaYVE9XecCmlaS1cNUuo0Tk94ERzLxFBysWVeSkVUUECOAI%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 89e108f2be3d910c-FRA alt-svc h3=":443"; ma=86400
GET H3	200	favicon.ico wwf.whatsdklam.icu/	787 B 1 KB	39ms 39ms	Other image/x-icon	172.67.192.140 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wwf.whatsdklam.icu/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.192.140 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d0cadf240e89340b93df35240e7809039c1c574be05fbe2cf3243e2f487bc9ec` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wwf.whatsdklam.icu/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 18:03:58 GMT content-encoding br cf-cache-status HIT last-modified Fri, 14 Jun 2024 15:16:13 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 929 etag W/"666c5ebd-313" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J9KaU61mVa%2B3SyfRR0%2B09c%2BAWcfxnFkChc%2FJSApFWIRyms4aNRWLGyzha4yRRHd3DjrV0yeVMEiX6kTHEppUqaoPa0YKbdUzeZePy12yS2lzaMY1HSeH9lQYuCkpSX9MTblnff8%3D"}],"group":"cf-nel","max_age":604800} content-type image/x-icon cache-control max-age=14400 cf-ray 89e108fbfd3c5caa-FRA alt-svc h3=":443"; ma=86400
GET DATA	200 OK	truncated /	85 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	9 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7abaa14516022a1462f61e6453b07889eb03329ed25bf41550e2d2f85698314e` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

wwf.whatsdklam.icu
172.67.192.140
2606:4700:3034::ac43:c08c
099a36d4c6594642d2d794431e94712b85599b6960e122b7c1e76b2362a4aff6
49ef8f9f3383ce25457cfa17d4f11e1c76e6bc21856c85f6f6a1888f142be5d7
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
6ad47184b37f307576748d5c619b3c760fc87ecb0f7916b5b427e1a30a0fd25c
759dc14a647618bcae5099437c89998c28a2828fd56784bf1ce88edea1c037fa
7abaa14516022a1462f61e6453b07889eb03329ed25bf41550e2d2f85698314e
8c366f0448ef28db6b2daac87ff13dfa80867c321a10bb65cc4ca7965c087f41
d0cadf240e89340b93df35240e7809039c1c574be05fbe2cf3243e2f487bc9ec
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eae74f3767a11fc1b6accf9aa631fd71018ddc92f82e2b7bea85778f0db479db

wwf.whatsdklam.icu Open in urlscan Pro 2606:4700:3034::ac43:c08c Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

50 %IPv6

1 Domains

1 Subdomains

3 IPs

1 Countries

208 kBTransfer

645 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

0 Cookies

Indicators

wwf.whatsdklam.icu Open in urlscan Pro
2606:4700:3034::ac43:c08c Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

3
IPs

1
Countries

208 kB
Transfer

645 kB
Size

0
Cookies

10 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!