bcskids.com Open in urlscan Pro
69.49.230.142 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://whtsapp.frappe.cloud/inicio
Effective URL:
https://bcskids.com/WhatsApp.html
Submission: On September 28 via automatic, source openphish (September 28th 2024, 1:25:24 am UTC) — Scanned from DE

Summary HTTP 17 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 7 domains to perform 17 HTTP transactions. The main IP is 69.49.230.142, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is bcskids.com.
TLS certificate: Issued by R11 on September 22nd 2024. Valid for: 3 months.

This is the only time bcskids.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
7	3.84.240.128 3.84.240.128	14618 (AMAZON-AES) (AMAZON-AES)
1 6	69.49.230.142 69.49.230.142	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
1	172.67.74.152 172.67.74.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.117.59.81 34.117.59.81	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:235... 2600:9000:2359:e000:10:474e:104a:2961	16509 (AMAZON-02) (AMAZON-02)
17	7

7 3.84.240.128 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-84-240-128.compute-1.amazonaws.com

whtsapp.frappe.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 69.49.230.142 (United States) 1 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 69-49-230-142.webhostbox.net

bcskids.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.74.152 (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.59.81 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com

ipinfo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2359:e000:10:474e:104a:2961 (United States)

ASN16509 (AMAZON-02, US)

cdn.auth0.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	frappe.cloud whtsapp.frappe.cloud	750 KB
6	bcskids.com 1 redirects bcskids.com	591 KB
1	auth0.com cdn.auth0.com — Cisco Umbrella Rank: 7058	803 B
1	ipinfo.io ipinfo.io — Cisco Umbrella Rank: 7134	485 B
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2176	156 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 454	31 KB
0	whatsapp.com Failed web.whatsapp.com Failed
17	7

	Domain	Requested by
7	whtsapp.frappe.cloud	whtsapp.frappe.cloud
6	bcskids.com	1 redirects whtsapp.frappe.cloud bcskids.com
1	cdn.auth0.com	bcskids.com
1	ipinfo.io	ajax.googleapis.com
1	api.ipify.org	ajax.googleapis.com
1	ajax.googleapis.com	bcskids.com
0	web.whatsapp.com Failed
17	7

This site contains links to these domains. Also see Links.

Domain
faq.whatsapp.com

Subject Issuer	Validity	Valid
*.frappe.cloud R11	`2024-08-08` - `2024-11-06`	3 months	crt.sh
webdisk.bcskids.com R11	`2024-09-22` - `2024-12-21`	3 months	crt.sh
upload.video.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
ipify.org WE1	`2024-09-15` - `2024-12-14`	3 months	crt.sh
ipinfo.io R11	`2024-08-17` - `2024-11-15`	3 months	crt.sh
*.auth0.com Amazon RSA 2048 M03	`2024-01-25` - `2025-02-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://bcskids.com/WhatsApp.html
Frame ID: 9755F462AFDB27092F1672B5737AEB02
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WhatsApp

Page URL History Show full URLs

https://whtsapp.frappe.cloud/inicio Page URL
https://bcskids.com/ HTTP 302
https://bcskids.com/WhatsApp.html Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

94 %
HTTPS

33 %
IPv6

7
Domains

7
Subdomains

7
IPs

2
Countries

1373 kB
Transfer

2595 kB
Size

5
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://faq.whatsapp.com/1317564962315842?lang=es
Title: ¿Necesitas ayuda para comenzar?

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://whtsapp.frappe.cloud/inicio Page URL
https://bcskids.com/ HTTP 302
https://bcskids.com/WhatsApp.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 inicio Show response
whtsapp.frappe.cloud/ 323 KB
92 KB 683ms
391ms Document
text/html 3.84.240.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://whtsapp.frappe.cloud/inicio

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-84-240-128.compute-1.amazonaws.com

Software

Frappe Cloud /

Resource Hash

698b2fd834f749358b0b4746324160157d2b6d317c087ba145855b45b592f1f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: 'Origin, Content-Type, Accept
access-control-allow-methods: 'GET, POST, OPTIONS
access-control-allow-origin: https://whtsapp.frappe.cloud
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 28 Sep 2024 01:25:15 GMT
link: </assets/frappe/dist/css/website.bundle.LQUTEGEG.css>; rel=preload; as=style,</assets/erpnext/dist/css/erpnext-web.bundle.W4NZSAHX.css>; rel=preload; as=style,</assets/frappe/dist/js/frappe-web.bundle.FWWFRIJG.js>; rel=preload; as=script,</website_script.js>; rel=preload; as=script,</assets/erpnext/dist/js/erpnext-web.bundle.J4A2DQB4.js>; rel=preload; as=script
referrer-policy: no-referrer-when-downgrade
server: Frappe Cloud
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-frappe-request-id: 327f6bf1-149b-4861-b3fa-86f16a67eb42
x-from-cache: False
x-page-name: inicio
x-proxy-upstream: http://23435425bfb64f16
x-ratelimit-limit: 3600000000
x-ratelimit-remaining: 3521842955
x-ratelimit-reset: 12886
x-ratelimit-used: 128650
x-xss-protection: 1; mode=block

GET
H2 200 website.bundle.LQUTEGEG.css
whtsapp.frappe.cloud/assets/frappe/dist/css/ 433 KB
70 KB 246ms
245ms Stylesheet
text/css 3.84.240.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://whtsapp.frappe.cloud/assets/frappe/dist/css/website.bundle.LQUTEGEG.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-84-240-128.compute-1.amazonaws.com

Software

Frappe Cloud /

Resource Hash

2bc7a34d5e95392ee2034e1742137551b353627e15fcb4d0f7e3c8c9678c0195

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whtsapp.frappe.cloud/inicio

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=31536000
content-encoding: gzip
etag: W/"66f410f3-6c58e"
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
x-proxy-upstream: http://23435425bfb64f16
x-proxy-cache: HIT
date: Sat, 28 Sep 2024 01:25:15 GMT
x-xss-protection: 1; mode=block
content-type: text/css
last-modified: Wed, 25 Sep 2024 13:32:35 GMT
vary: Accept-Encoding
server: Frappe Cloud
x-frame-options: SAMEORIGIN

GET
H2 200 erpnext-web.bundle.W4NZSAHX.css
whtsapp.frappe.cloud/assets/erpnext/dist/css/ 3 KB
1 KB 246ms
245ms Stylesheet
text/css 3.84.240.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://whtsapp.frappe.cloud/assets/erpnext/dist/css/erpnext-web.bundle.W4NZSAHX.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-84-240-128.compute-1.amazonaws.com

Software

Frappe Cloud /

Resource Hash

b1d42190f5bdad379dfd307541000466f55b62787dc2bcc1abd9711d4eeef7e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whtsapp.frappe.cloud/inicio

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=31536000
content-encoding: gzip
etag: W/"66f410f3-b30"
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
x-proxy-upstream: http://23435425bfb64f16
x-proxy-cache: HIT
date: Sat, 28 Sep 2024 01:25:15 GMT
x-xss-protection: 1; mode=block
content-type: text/css
last-modified: Wed, 25 Sep 2024 13:32:35 GMT
vary: Accept-Encoding
server: Frappe Cloud
x-frame-options: SAMEORIGIN

GET
H2 200 frappe-web.bundle.FWWFRIJG.js Show response
whtsapp.frappe.cloud/assets/frappe/dist/js/ 810 KB
247 KB 247ms
246ms Script
application/javascript 3.84.240.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://whtsapp.frappe.cloud/assets/frappe/dist/js/frappe-web.bundle.FWWFRIJG.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-84-240-128.compute-1.amazonaws.com

Software

Frappe Cloud /

Resource Hash

5fb451760cb942e13b2bf410809e7f821339307a0df4b73bb3a3645daa1816fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whtsapp.frappe.cloud/inicio

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=31536000
content-encoding: gzip
etag: W/"66f410f4-ca9d3"
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
x-proxy-upstream: http://23435425bfb64f16
x-proxy-cache: HIT
date: Sat, 28 Sep 2024 01:25:15 GMT
x-xss-protection: 1; mode=block
content-type: application/javascript
last-modified: Wed, 25 Sep 2024 13:32:36 GMT
vary: Accept-Encoding
server: Frappe Cloud
x-frame-options: SAMEORIGIN

GET
H2 200 website_script.js Show response
whtsapp.frappe.cloud/ 25 B
945 B 246ms
246ms Script
application/javascript 3.84.240.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://whtsapp.frappe.cloud/website_script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-84-240-128.compute-1.amazonaws.com

Software

Frappe Cloud /

Resource Hash

bfc3f25bc17c6b96e68b6c11b85d9c6f9ea1f26f94bc5153c8f2312148265e3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whtsapp.frappe.cloud/inicio

Response headers

content-encoding: gzip
x-content-type-options: nosniff
access-control-allow-methods: 'GET, POST, OPTIONS
date: Sat, 28 Sep 2024 01:25:15 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-ratelimit-used: 20884
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-headers: 'Origin, Content-Type, Accept
x-page-name: website_script.js
x-ratelimit-reset: 12885
referrer-policy: no-referrer-when-downgrade
x-ratelimit-remaining: 3521714305
x-proxy-upstream: http://23435425bfb64f16
x-frappe-request-id: d83d2a7a-3d34-48e0-a697-b2bbf35197ba
access-control-allow-credentials: true
access-control-allow-origin: https://whtsapp.frappe.cloud
x-from-cache: True
x-xss-protection: 1; mode=block
x-ratelimit-limit: 3600000000
server: Frappe Cloud

GET
H2 200 erpnext-web.bundle.J4A2DQB4.js Show response
whtsapp.frappe.cloud/assets/erpnext/dist/js/ 294 B
621 B 246ms
245ms Script
application/javascript 3.84.240.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://whtsapp.frappe.cloud/assets/erpnext/dist/js/erpnext-web.bundle.J4A2DQB4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-84-240-128.compute-1.amazonaws.com

Software

Frappe Cloud /

Resource Hash

b6cbf64ee17f3350fde83fe29559cc4d41cc3568323594128008084098b4f4c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whtsapp.frappe.cloud/inicio

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=31536000
content-encoding: gzip
etag: W/"66f410f3-126"
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
x-proxy-upstream: http://23435425bfb64f16
x-proxy-cache: HIT
date: Sat, 28 Sep 2024 01:25:15 GMT
x-xss-protection: 1; mode=block
content-type: application/javascript
last-modified: Wed, 25 Sep 2024 13:32:35 GMT
vary: Accept-Encoding
server: Frappe Cloud
x-frame-options: SAMEORIGIN

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f5256ac362e80e47b7d04e4c3dded387e408ea1f42d69231bfd988ef33fddac2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 InterVariable.woff2
whtsapp.frappe.cloud/assets/frappe/css/fonts/inter/ 337 KB
338 KB 136ms
135ms Font
application/octet-stream 3.84.240.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://whtsapp.frappe.cloud/assets/frappe/css/fonts/inter/InterVariable.woff2

Requested by

Host: whtsapp.frappe.cloud
URL: https://whtsapp.frappe.cloud/assets/frappe/dist/css/website.bundle.LQUTEGEG.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-84-240-128.compute-1.amazonaws.com

Software

Frappe Cloud /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://whtsapp.frappe.cloud
Referer: https://whtsapp.frappe.cloud/assets/frappe/dist/css/website.bundle.LQUTEGEG.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=31536000
etag: "66f410f3-545f4"
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
x-proxy-upstream: http://23435425bfb64f16
x-proxy-cache: HIT
accept-ranges: bytes
content-length: 345588
date: Sat, 28 Sep 2024 01:25:15 GMT
x-xss-protection: 1; mode=block
content-type: application/octet-stream
last-modified: Wed, 25 Sep 2024 13:32:35 GMT
server: Frappe Cloud
x-frame-options: SAMEORIGIN

GET
H/1.1

200
OK

Primary Request WhatsApp.html Show response
bcskids.com/
Redirect Chain

https://bcskids.com/
https://bcskids.com/WhatsApp.html

14 KB
14 KB

173ms
173ms

Document
text/html

69.49.230.142
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bcskids.com/WhatsApp.html
Requested by: Host: whtsapp.frappe.cloud
URL: https://whtsapp.frappe.cloud/inicio
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 69.49.230.142 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 69-49-230-142.webhostbox.net
Software: Apache /
Resource Hash: 1434920cfd573b0084583180ec0aab7c43e602400df0fdd89d387347466a4fdf

Request headers

Referer: https://whtsapp.frappe.cloud/inicio
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 14423
Content-Type: text/html
Date: Sat, 28 Sep 2024 01:25:19 GMT
Keep-Alive: timeout=5, max=99
Last-Modified: Fri, 27 Sep 2024 20:14:21 GMT
Server: Apache

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Sat, 28 Sep 2024 01:25:19 GMT
Keep-Alive: timeout=5, max=100
Location: WhatsApp.html
Server: Apache

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 90ms
27ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: bcskids.com
URL: https://bcskids.com/WhatsApp.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://bcskids.com/

Response headers

content-encoding: gzip
age: 98460
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Fri, 26 Sep 2025 22:04:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Sep 2024 22:04:19 GMT
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31021
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK stylex-7416205700eb56b41e3c100d03e4afc2.css
bcskids.com/WhatsApp%20Archivos/ 219 KB
219 KB 330ms
329ms Stylesheet
text/css 69.49.230.142
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bcskids.com/WhatsApp%20Archivos/stylex-7416205700eb56b41e3c100d03e4afc2.css
Requested by: Host: bcskids.com
URL: https://bcskids.com/WhatsApp.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 69.49.230.142 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 69-49-230-142.webhostbox.net
Software: Apache /
Resource Hash: 294eb2d726feb2a7caccba84f1bcc04d0b6f3e36682040d521498c7d99cf9a7a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://bcskids.com/WhatsApp.html

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 224453
Keep-Alive: timeout=5, max=100
Date: Sat, 28 Sep 2024 01:25:19 GMT
Last-Modified: Fri, 27 Sep 2024 20:14:59 GMT
Content-Type: text/css
Server: Apache

GET
H/1.1 200
OK app-c1c9f745bb0ae3c63811.css
bcskids.com/WhatsApp%20Archivos/ 205 KB
205 KB 319ms
167ms Stylesheet
text/css 69.49.230.142
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bcskids.com/WhatsApp%20Archivos/app-c1c9f745bb0ae3c63811.css
Requested by: Host: bcskids.com
URL: https://bcskids.com/WhatsApp.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 69.49.230.142 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 69-49-230-142.webhostbox.net
Software: Apache /
Resource Hash: 782e629396f5c18478eb6821fcb405f3eae07835efe0665a153bcb825ab05180

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://bcskids.com/WhatsApp.html

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 209669
Keep-Alive: timeout=5, max=98
Date: Sat, 28 Sep 2024 01:25:19 GMT
Last-Modified: Fri, 27 Sep 2024 20:14:59 GMT
Content-Type: text/css
Server: Apache

GET
H/1.1 200
OK main.058972cf635290857867.css
bcskids.com/WhatsApp%20Archivos/ 147 KB
148 KB 479ms
162ms Stylesheet
text/css 69.49.230.142
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bcskids.com/WhatsApp%20Archivos/main.058972cf635290857867.css
Requested by: Host: bcskids.com
URL: https://bcskids.com/WhatsApp.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 69.49.230.142 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 69-49-230-142.webhostbox.net
Software: Apache /
Resource Hash: 2742cefd3fa89561f5c31c1345d0987bfbf9f1ac3f3c887ee93500c6e3fb7560

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://bcskids.com/WhatsApp.html

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 151011
Keep-Alive: timeout=5, max=100
Date: Sat, 28 Sep 2024 01:25:19 GMT
Last-Modified: Fri, 27 Sep 2024 20:14:59 GMT
Content-Type: text/css
Server: Apache

GET
H2 200 / Show response
api.ipify.org/ 23 B
156 B 225ms
131ms XHR
application/json 172.67.74.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83b63b4f02357648d4d3cb09548ee9c277df537d4bf4f833ef7114be007b4aff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://bcskids.com/

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8c9ff05e4e629046-FRA
access-control-allow-origin: *
content-length: 23
date: Sat, 28 Sep 2024 01:25:19 GMT
content-type: application/json
vary: Origin
server: cloudflare

GET
H2 200 / Show response
ipinfo.io/ 306 B
485 B 246ms
156ms XHR
application/json 34.117.59.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ipinfo.io/

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

81.59.117.34.bc.googleusercontent.com

Software

Resource Hash

8dd39ff7f1ef1f32e461dc60dd117c762a4896870fe859e9fa5634da3ef1a0e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://bcskids.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 202
date: Sat, 28 Sep 2024 01:25:19 GMT
x-xss-protection: 1; mode=block
content-type: application/json; charset=utf-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H/1.1 200
OK sax.min.js Show response
bcskids.com/WhatsApp%20Archivos/ 4 KB
4 KB 329ms
161ms Script
text/javascript 69.49.230.142
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bcskids.com/WhatsApp%20Archivos/sax.min.js
Requested by: Host: bcskids.com
URL: https://bcskids.com/WhatsApp.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 69.49.230.142 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 69-49-230-142.webhostbox.net
Software: Apache /
Resource Hash: 9cab4c44f04af897ed5d805566c3142545719b1a7737bc3229fd6c43833a9022

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://bcskids.com/WhatsApp.html

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 4092
Keep-Alive: timeout=5, max=100
Date: Sat, 28 Sep 2024 01:25:19 GMT
Last-Modified: Fri, 27 Sep 2024 20:14:59 GMT
Content-Type: text/javascript
Server: Apache

GET
H2 200 object-assign.min.js Show response
cdn.auth0.com/js/polyfills/1.0/ 278 B
803 B 129ms
31ms Script
application/javascript 2600:9000:2359:e000:10:474e:104a:2961
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.auth0.com/js/polyfills/1.0/object-assign.min.js

Requested by

Host: bcskids.com
URL: https://bcskids.com/WhatsApp.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2359:e000:10:474e:104a:2961 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2e3281ce824bc83f86243254926e320d7a51fd34e310d76f38ddf5ca4430bcd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://bcskids.com/

Response headers

x-robots-tag: noindex
x-amz-version-id: QnBigF9q9VrtNR8TU_yhfoN9BlecmQ2x
etag: "4dfaafaab07b1c6c2314bfe79a1baa81"
age: 10304
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: Ld23OAJcB_pQVwc1M5TMZj2N7K2znCtwzwTuRARBU_25CzqLE3oqOA==
date: Fri, 27 Sep 2024 22:33:36 GMT
content-type: application/javascript
last-modified: Thu, 08 Jun 2017 20:30:02 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains
x-amz-replication-status: COMPLETED
cache-control: max-age=10800,public
via: 1.1 9a97e41242551c9a56be1311e4d3db70.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 278
x-amz-cf-pop: FRA60-P10
server: AmazonS3

GET favicon_c5088e888c97ad440a61d247596f88e5.png
web.whatsapp.com/img/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: web.whatsapp.com
URL: https://web.whatsapp.com/img/favicon_c5088e888c97ad440a61d247596f88e5.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
whtsapp.frappe.cloud/	1970-01-21 00:01:38	Name: sid Value: Guest
whtsapp.frappe.cloud/	1969-12-31 23:59:59	Name: system_user Value: no
whtsapp.frappe.cloud/	1969-12-31 23:59:59	Name: full_name Value: Guest
whtsapp.frappe.cloud/	1969-12-31 23:59:59	Name: user_id Value: Guest
whtsapp.frappe.cloud/	1969-12-31 23:59:59	Name: user_image Value:

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
bcskids.com
cdn.auth0.com
ipinfo.io
web.whatsapp.com
whtsapp.frappe.cloud
web.whatsapp.com
172.67.74.152
2600:9000:2359:e000:10:474e:104a:2961
2a00:1450:4001:80e::200a
3.84.240.128
34.117.59.81
69.49.230.142
1434920cfd573b0084583180ec0aab7c43e602400df0fdd89d387347466a4fdf
2742cefd3fa89561f5c31c1345d0987bfbf9f1ac3f3c887ee93500c6e3fb7560
294eb2d726feb2a7caccba84f1bcc04d0b6f3e36682040d521498c7d99cf9a7a
2bc7a34d5e95392ee2034e1742137551b353627e15fcb4d0f7e3c8c9678c0195
2e3281ce824bc83f86243254926e320d7a51fd34e310d76f38ddf5ca4430bcd8
5fb451760cb942e13b2bf410809e7f821339307a0df4b73bb3a3645daa1816fb
698b2fd834f749358b0b4746324160157d2b6d317c087ba145855b45b592f1f2
782e629396f5c18478eb6821fcb405f3eae07835efe0665a153bcb825ab05180
83b63b4f02357648d4d3cb09548ee9c277df537d4bf4f833ef7114be007b4aff
8dd39ff7f1ef1f32e461dc60dd117c762a4896870fe859e9fa5634da3ef1a0e9
9cab4c44f04af897ed5d805566c3142545719b1a7737bc3229fd6c43833a9022
b1d42190f5bdad379dfd307541000466f55b62787dc2bcc1abd9711d4eeef7e8
b6cbf64ee17f3350fde83fe29559cc4d41cc3568323594128008084098b4f4c8
bfc3f25bc17c6b96e68b6c11b85d9c6f9ea1f26f94bc5153c8f2312148265e3b
f5256ac362e80e47b7d04e4c3dded387e408ea1f42d69231bfd988ef33fddac2
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

bcskids.com Open in urlscan Pro 69.49.230.142 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

94 %HTTPS

33 %IPv6

7 Domains

7 Subdomains

7 IPs

2 Countries

1373 kBTransfer

2595 kBSize

5 Cookies

1 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

5 Cookies

Security Headers

Indicators

bcskids.com Open in urlscan Pro
69.49.230.142 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

94 %
HTTPS

33 %
IPv6

7
Domains

7
Subdomains

7
IPs

2
Countries

1373 kB
Transfer

2595 kB
Size

5
Cookies

17 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!