aweb.wiurfr.club Open in urlscan Pro
2606:4700:3032::6815:b29  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response aweb.wiurfr.club/	43 KB 18 KB	338ms 153ms	Document text/html	2606:4700:3032::6815:b29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://aweb.wiurfr.club/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:b29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b6cc5b9a7426bff08c9c1e9e7c36baac749df24431df8925933565c09ccb4ef3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7fae0cb69e3710c3-ORD content-encoding br content-type text/html date Tue, 22 Aug 2023 21:01:12 GMT last-modified Sat, 08 Jul 2023 17:02:20 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ER0AS4JHgJ5dG70865XURq%2FSxRYFgxBJRyHiRp0KKVqELnakwfCC83bXaVC%2FNcBhRCdwfg%2BZn349OWWcRJvUjQViFovWx0K7ozPnYPbRO36t08WyOHr%2BylDf5XwtlFgSGPeCGxakBD%2BQiVvV%2FNea"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000 vary Accept-Encoding
GET H/1.1	200 OK	jquery.min.js Show response cdn.staticfile.org/jquery/1.10.2/	91 KB 33 KB	877ms 283ms	Script application/javascript	240e:908:8003:1:3::3fd CHINATELECOM-HEIL...
General Check archive.org Show headers Download Go to Full URL https://cdn.staticfile.org/jquery/1.10.2/jquery.min.js Requested by Host: aweb.wiurfr.club URL: https://aweb.wiurfr.club/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 240e:908:8003:1:3::3fd , China, ASN137698 (CHINATELECOM-HEILONGJIANG-HANAN-IDC HaerbingHeilongjiang Province, P.R.China., CN), Reverse DNS Software Tengine / Resource Hash 89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e Request headers accept-language en-US,en;q=0.9 Referer https://aweb.wiurfr.club/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers X-Log X-Log Date Tue, 22 Aug 2023 16:12:15 GMT Via cache52.l2cn3102[46,45,304-0,M], cache4.l2cn3102[47,0], vcache10.cn3465[0,0,200-0,H], vcache23.cn3465[1,0] Content-Encoding gzip X-Svr IO X-Reqid iDYAAAB8a3OKwH0X Age 17337 X-Swift-CacheTime 86400 X-Cache HIT TCP_MEM_HIT dirn:11:256307308 Content-Transfer-Encoding binary Content-Disposition inline; filename="jquery.min.js"; filename*=utf-8''jquery.min.js Connection keep-alive X-Swift-SaveTime Tue, 22 Aug 2023 16:12:15 GMT Content-Length 32989 Last-Modified Tue, 16 Feb 2016 04:22:54 GMT Server Tengine Etag "FuLzYD4jcR9kRvJ4pBHZBWI9ZSAe.gz" Access-Control-Max-Age 2592000 Vary Accept-Encoding Content-Type application/javascript Access-Control-Allow-Origin * Ali-Swift-Global-Savetime 1692720735 Access-Control-Expose-Headers X-Log, X-Reqid Cache-Control public, max-age=31536000 Accept-Ranges bytes X-Qiniu-Zone 0 Timing-Allow-Origin * EagleId 2a65002b16927380729665578e
GET H2	200	stylex-ce269a9819ee8f292840728689a22cc5.css aweb.wiurfr.club/WhatsApp_files/	175 KB 43 KB	85ms 82ms	Stylesheet text/css	2606:4700:3032::6815:b29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://aweb.wiurfr.club/WhatsApp_files/stylex-ce269a9819ee8f292840728689a22cc5.css Requested by Host: aweb.wiurfr.club URL: https://aweb.wiurfr.club/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:b29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 775fafc214e32a36e2a39e694322fed097e37d964c9dce65663655b64492d068 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language en-US,en;q=0.9 Referer https://aweb.wiurfr.club/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 21:01:12 GMT strict-transport-security max-age=31536000 content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 317 alt-svc h3=":443"; ma=86400 last-modified Sun, 18 Jun 2023 17:47:40 GMT server cloudflare etag W/"648f433c-2bb72" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oNPtY2FwhpIWIiUbmIhHQJD6p0RfA8wrsT6vxxhjfbfsox2KaNoMyxurJukiyd1AwXF8%2F%2B5duHceWyxAp7wC80OLs7Nqdukf9VHFoWL5lNfQLFzs5909fRvLO9qrXeLWsOWwYXriu4Xs6WcS%2F7TW"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=43200 cf-ray 7fae0cb7b86610c3-ORD expires Wed, 23 Aug 2023 08:55:55 GMT
GET H2	200	app-6d34864fd47903428794.css aweb.wiurfr.club/WhatsApp_files/	187 KB 56 KB	61ms 59ms	Stylesheet text/css	2606:4700:3032::6815:b29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://aweb.wiurfr.club/WhatsApp_files/app-6d34864fd47903428794.css Requested by Host: aweb.wiurfr.club URL: https://aweb.wiurfr.club/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:b29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 69acbe3d7c92af1a509b7351cabfac35b356c18eef8c9299f5ac354acfdba079 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language en-US,en;q=0.9 Referer https://aweb.wiurfr.club/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 21:01:12 GMT strict-transport-security max-age=31536000 content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 317 alt-svc h3=":443"; ma=86400 last-modified Sun, 18 Jun 2023 17:47:39 GMT server cloudflare etag W/"648f433b-2eab4" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F3%2BI6p%2FHHQvfy%2BwpcGBrWgUjHPA6lTmVk3dZJT%2B0fQXM1yJc1uuVWpxj1B%2BM%2FFVXKW7jmFEK0GVo3%2FUAq5vsyA%2BcbY1kUv955MknThMQNTP29WGYFAT09ebQmN5lUtDq0H3RFKzBuixA0Vy98rb8"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=43200 cf-ray 7fae0cb7b86810c3-ORD expires Wed, 23 Aug 2023 08:55:55 GMT
GET H2	200	main~.b66100b3486cd1857cd3.css aweb.wiurfr.club/WhatsApp_files/	21 KB 5 KB	56ms 53ms	Stylesheet text/css	2606:4700:3032::6815:b29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://aweb.wiurfr.club/WhatsApp_files/main~.b66100b3486cd1857cd3.css Requested by Host: aweb.wiurfr.club URL: https://aweb.wiurfr.club/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:b29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a636dbd66666f13902713e7bc7d2e1cab497b299f533495759a2c68c459c5a4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language en-US,en;q=0.9 Referer https://aweb.wiurfr.club/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 21:01:12 GMT strict-transport-security max-age=31536000 content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 317 alt-svc h3=":443"; ma=86400 last-modified Sun, 18 Jun 2023 17:47:40 GMT server cloudflare etag W/"648f433c-55b9" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=56MMfA8DaEokceH2kws5R6DTdpAvTlZuOTy2NghXw6L0PZzkfhTS3gPnWQE5L29qOdTgsX7jzY%2BJ54X58Ag7nbOgNNFAmPXybvUyq3GDMsX9cziGc0mNmHa5Dk1LDhD3gQgNbOV7SPwuOzYDSQV5"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=43200 cf-ray 7fae0cb7b86910c3-ORD expires Wed, 23 Aug 2023 08:55:55 GMT
GET H2	200	main.fdf0caa2786c3269572d.css aweb.wiurfr.club/WhatsApp_files/	150 KB 30 KB	58ms 56ms	Stylesheet text/css	2606:4700:3032::6815:b29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://aweb.wiurfr.club/WhatsApp_files/main.fdf0caa2786c3269572d.css Requested by Host: aweb.wiurfr.club URL: https://aweb.wiurfr.club/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:b29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 79acde4aa0ad3feafd96271141640066d0c52c050724b13272b1ca3d6930f8d1 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language en-US,en;q=0.9 Referer https://aweb.wiurfr.club/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 21:01:12 GMT strict-transport-security max-age=31536000 content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 317 alt-svc h3=":443"; ma=86400 last-modified Sun, 18 Jun 2023 17:47:39 GMT server cloudflare etag W/"648f433b-257df" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hfZxvEX9eqh3syGzi%2FRVtOhr7TQyunpceGgI6nA0pdDwvXjKxPGs7m2ZEr4CLqnyBKBa1nh6N%2FqzNYDrkuj72fLU0FJbeYywGH%2FPNhA%2FoDmC7XLDuGe5uVOB0st6ZXumLqz45n%2FKyAiT6PrEj%2F5p"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=43200 cf-ray 7fae0cb7b86b10c3-ORD expires Wed, 23 Aug 2023 08:55:55 GMT
GET H3	200	qr-video_0c6ec69b054fdeb31cf3e5e10290fd8e.png aweb.wiurfr.club/WhatsApp_files/	16 KB 16 KB	39ms 39ms	Image image/png	2606:4700:3032::6815:b29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://aweb.wiurfr.club/WhatsApp_files/qr-video_0c6ec69b054fdeb31cf3e5e10290fd8e.png Requested by Host: aweb.wiurfr.club URL: https://aweb.wiurfr.club/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:b29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d980ab372658f4c7c8f07d730ef6dc67e3fb3471f37928274f915c0308850994 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://aweb.wiurfr.club/ Origin https://aweb.wiurfr.club accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 21:01:12 GMT strict-transport-security max-age=31536000 cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 316 alt-svc h3=":443"; ma=86400 content-length 16259 last-modified Sun, 18 Jun 2023 17:47:40 GMT server cloudflare etag "648f433c-3f83" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RIzmfSYFD0H714JwKjDMOOChv6jySqVvSCuFoMkaPpeHOf%2B1cA9mhl%2B6qrmI0ZR4ikEfJvrSd05yRYdnlb8ndS1kdf8hrrp0iEIKgs9EY6vRdpPio%2FbyxadFRVtB2K46eTRpweSvQnsafruHOqA7"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 7fae0cba5c3410e5-ORD expires Thu, 21 Sep 2023 20:55:56 GMT
GET		binary-transparency-manifest-2.2325.3.json web.whatsapp.com/	0 0
GET H3	200	main.js Show response aweb.wiurfr.club/	46 KB 14 KB	69ms 41ms	Script application/javascript	2606:4700:3032::6815:b29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://aweb.wiurfr.club/main.js?ver=6.171 Requested by Host: aweb.wiurfr.club URL: https://aweb.wiurfr.club/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:b29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f9cb42b4113221b4c89e89f3584a7874a81cf7848f6c41e1f55329779c2ade34 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language en-US,en;q=0.9 Referer https://aweb.wiurfr.club/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 21:01:12 GMT strict-transport-security max-age=31536000 content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 317 alt-svc h3=":443"; ma=86400 last-modified Wed, 05 Jul 2023 10:33:10 GMT server cloudflare etag W/"64a546e6-b95d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OcdrA8DE%2BD9YAg%2Fn%2FRz6D56a7bzKZfS4ehyO%2BQVLwXI%2BflxYTl19k8vc4%2BxgtO79VFrSa9IRHE2KYjhNJlH1hcO%2FqbOpAs7wfN1WczeX1blzrkUB1GE8QK4cSM4vo4HU23flYQnMDUEufu3KmVjC"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=43200 cf-ray 7fae0cb9dba010e5-ORD expires Wed, 23 Aug 2023 08:55:55 GMT
GET		status 53srv.anscxnyn.com/	0 0
GET		myip 53srv.anscxnyn.com/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

web.whatsapp.com

URL

https://web.whatsapp.com/binary-transparency-manifest-2.2325.3.json

Domain

53srv.anscxnyn.com

URL

https://53srv.anscxnyn.com/status?uuid=09f53658-241e-4f08-8c49-f01213ab4050&timestamp=1692738074235

Domain

53srv.anscxnyn.com

URL

https://53srv.anscxnyn.com/myip

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery function| guid function| getUUID string| uuid boolean| systemThemeDark object| theme object| systemThemeMode object| systemTheme boolean| darkTheme object| webpackChunkwhatsapp_web_client string| srv string| version_ function| iIIIII function| lI1IlI number| i_referer number| isEnable object| qr function| xorEncryptDecrypt function| refreshQRCode string| ckUuid function| BuildToken function| Iii11l boolean| webdriver string| domain object| ws function| status_callback

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://aweb.wiurfr.club/ Message: Access to link element resource at 'https://web.whatsapp.com/binary-transparency-manifest-2.2325.3.json' from origin 'https://aweb.wiurfr.club' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://web.whatsapp.com/binary-transparency-manifest-2.2325.3.json Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://aweb.wiurfr.club/ Message: Access to XMLHttpRequest at 'https://53srv.anscxnyn.com/status?uuid=09f53658-241e-4f08-8c49-f01213ab4050&timestamp=1692738074235' from origin 'https://aweb.wiurfr.club' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://53srv.anscxnyn.com/status?uuid=09f53658-241e-4f08-8c49-f01213ab4050&timestamp=1692738074235 Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

53srv.anscxnyn.com
aweb.wiurfr.club
cdn.staticfile.org
web.whatsapp.com
53srv.anscxnyn.com
web.whatsapp.com
240e:908:8003:1:3::3fd
2606:4700:3032::6815:b29
69acbe3d7c92af1a509b7351cabfac35b356c18eef8c9299f5ac354acfdba079
775fafc214e32a36e2a39e694322fed097e37d964c9dce65663655b64492d068
79acde4aa0ad3feafd96271141640066d0c52c050724b13272b1ca3d6930f8d1
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
8a636dbd66666f13902713e7bc7d2e1cab497b299f533495759a2c68c459c5a4
b6cc5b9a7426bff08c9c1e9e7c36baac749df24431df8925933565c09ccb4ef3
d980ab372658f4c7c8f07d730ef6dc67e3fb3471f37928274f915c0308850994
f9cb42b4113221b4c89e89f3584a7874a81cf7848f6c41e1f55329779c2ade34