whatsapppg.com Open in urlscan Pro
172.67.172.104  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response whatsapppg.com/	810 B 1 KB	583ms 412ms	Document text/html	172.67.172.104 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://whatsapppg.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.172.104 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 440986efd392462ee072bec4378e8ba25d39e346962deaeb1f28e7e3d7d5e332 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8d20f1142fb478de-LAX content-encoding zstd content-type text/html date Sun, 13 Oct 2024 17:10:12 GMT last-modified Tue, 08 Oct 2024 11:36:32 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UJahS%2BbyJJKgCQ4Lx2oxeh1yPVmMkOnS13JugmeQe3TEnjtBAuudWyizDJNh988lKqauUjcHbRRPt0M8alWh%2BwSTaHGGIoulZ2FgPH8OW4Dg9U1nx8GixGyezQcVA73Fow%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation"
GET H3	200	speculation whatsapppg.com/cdn-cgi/	128 B 557 B	83ms 83ms	Other application/speculationrules+json	172.67.172.104 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://whatsapppg.com/cdn-cgi/speculation Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.172.104 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://whatsapppg.com Referer https://whatsapppg.com/ Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qn5eYuFbFVgprMlrEiPzqvIiABes5zTvD15aGzURNe9C8%2Bg9A4UvLALZ3uAYNrqswOgwlvFnBTRmM6KkFBZ%2BMx6RcY29VxmQa69zEuJCBqUILohoLc55x7gYuqbEuh6uEA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8d20f116cb3678de-LAX access-control-allow-origin https://whatsapppg.com alt-svc h3=":443"; ma=86400 content-length 128 date Sun, 13 Oct 2024 17:10:12 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H3	200	ovk0jm9va.css whatsapppg.com/css/	429 KB 109 KB	157ms 157ms	Stylesheet text/css	172.67.172.104 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://whatsapppg.com/css/ovk0jm9va.css Requested by Host: whatsapppg.com URL: https://whatsapppg.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.172.104 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3d70239c215961ece3344d0360f15ff9621567f50a84e2d58fbdbecbb9f0b934 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://whatsapppg.com/ Response headers cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding gzip cf-cache-status HIT etag W/"67034155-6b550" age 564 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z1rTZfmOmO9ZOuiaZWGeAC3ajdqsgdUxDv1nULvwu66DNAPs8IFXDZnoGAauBbK5YXz6Xaq5KgI6qvOhCXgVrBqCEx1bMlonYY3%2Fxw8GeccTYOmqW0PP9vA9Z4oaiX79wg%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8d20f116cb3978de-LAX expires Mon, 14 Oct 2024 05:00:48 GMT alt-svc h3=":443"; ma=86400 date Sun, 13 Oct 2024 17:10:12 GMT content-type text/css last-modified Mon, 07 Oct 2024 02:03:01 GMT vary Accept-Encoding server cloudflare
GET H3	200	ovk0jm9va.js Show response whatsapppg.com/js/	865 KB 230 KB	85ms 85ms	Script application/javascript	172.67.172.104 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://whatsapppg.com/js/ovk0jm9va.js Requested by Host: whatsapppg.com URL: https://whatsapppg.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.172.104 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bc08193b4e6b6c4aa08d5d1283d60de30670ce218ec6d86054be9c131d9e8b9c Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://whatsapppg.com/ Response headers cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding gzip cf-cache-status HIT etag W/"670341e2-d8364" age 564 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zGhHc234m2DRAbtgvbILzPbp%2BKm93sYyN2iKF78BbImJlm34yKk2vPN%2Fipxc1w4Po5oSCi%2FBWVS5J0A65ElTAJNefbLvPwzCE2QS8brPG16jNFxfkryQ01eD5ysQChCLEg%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8d20f116cb3d78de-LAX expires Mon, 14 Oct 2024 05:00:48 GMT alt-svc h3=":443"; ma=86400 date Sun, 13 Oct 2024 17:10:12 GMT content-type application/javascript last-modified Mon, 07 Oct 2024 02:05:22 GMT vary Accept-Encoding server cloudflare
GET H3	404	favicon.ico whatsapppg.com/	148 B 565 B	419ms 419ms	Other text/html	172.67.172.104 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://whatsapppg.com/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.172.104 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9cad3cff676946810a81047247f12e4e51faccc01df4134edfd871aee8ba0956 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://whatsapppg.com/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status EXPIRED speculation-rules "/cdn-cgi/speculation" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9mVLfjp6Gvb%2B6nNFc9S%2FFWSYlLB1%2BtHW3zQsCHKNGhtMA8%2F580Okqi8vOcqd0mnLZ87ECAa%2BQ0x26vqRa2DjUxHQmPx0rHHIBSqrOG5b31SaoVNmpoEqLRMooUUFfxdjrQ%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8d20f11a6fe878de-LAX alt-svc h3=":443"; ma=86400 date Sun, 13 Oct 2024 17:10:13 GMT content-type text/html vary Accept-Encoding server cloudflare
GET DATA	200 OK	truncated /	85 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	9 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5e98dca6a9ee28009078b88d321f866e4d3ef76b6fec03601adcc263204b4d12 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x3fd82e function| QRCode function| _0xdd63 function| guid function| getLocation function| sock function| qrcode function| qrcode2 function| refreshqrcode function| _0x3a5f function| _0x3fb629 function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://whatsapppg.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

whatsapppg.com
172.67.172.104
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
3d70239c215961ece3344d0360f15ff9621567f50a84e2d58fbdbecbb9f0b934
440986efd392462ee072bec4378e8ba25d39e346962deaeb1f28e7e3d7d5e332
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
5e98dca6a9ee28009078b88d321f866e4d3ef76b6fec03601adcc263204b4d12
9cad3cff676946810a81047247f12e4e51faccc01df4134edfd871aee8ba0956
bc08193b4e6b6c4aa08d5d1283d60de30670ce218ec6d86054be9c131d9e8b9c