wws.sadhwr86.cyou Open in urlscan Pro
2606:4700:3031::ac43:9143  Malicious Activity! Public Scan

URL: https://wws.sadhwr86.cyou/
Submission: On July 12 via api from HK — Scanned from CA

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3031::ac43:9143, located in United States and belongs to CLOUDFLARENET, US. The main domain is wws.sadhwr86.cyou.
TLS certificate: Issued by WE1 on July 9th 2024. Valid for: 3 months.
This is the only time wws.sadhwr86.cyou was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
10 2606:4700:303... 13335 (CLOUDFLAR...)
10 2
Apex Domain
Subdomains
Transfer
10 sadhwr86.cyou
wws.sadhwr86.cyou
89 KB
10 1
Domain Requested by
10 wws.sadhwr86.cyou wws.sadhwr86.cyou
10 1

This site contains no links.

Subject Issuer Validity Valid
sadhwr86.cyou
WE1
2024-07-09 -
2024-10-07
3 months crt.sh

This page contains 1 frames:

Primary Page: https://wws.sadhwr86.cyou/
Frame ID: 6AB46B0E46AA2DEF527C76DE58B8EF90
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

wws.sadhwr86.cyou

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

89 kB
Transfer

226 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
wws.sadhwr86.cyou/
1 KB
867 B
Document
General
Full URL
https://wws.sadhwr86.cyou/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:9143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19c73a55a5b2d1824c0c8c0d2fbeec68ddebe0b8a33c39efb5b863f575c209d4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8a205c9099eb36d5-YYZ
content-encoding
br
content-type
text/html
date
Fri, 12 Jul 2024 10:31:05 GMT
last-modified
Sun, 07 Jul 2024 10:52:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ll7Abeh1Mcvc4j4qviDvT%2BBxIVXE4pr%2BiG8gY0DE9r1jmVwhQjIiO059msaNMZ17DZKeVe4WIFhOOhLYnkS8WgbFS9FZ3uKaRIALBnlL%2F6mQ%2B944uShTQYXvBvfuFQBAAULwCqs0dZgz82%2Ffd%2Bo6Ag%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
542590378a17.css
wws.sadhwr86.cyou/static/css/
13 KB
4 KB
Stylesheet
General
Full URL
https://wws.sadhwr86.cyou/static/css/542590378a17.css
Requested by
Host: wws.sadhwr86.cyou
URL: https://wws.sadhwr86.cyou/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:9143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4c5fc58b445591f1ebd44ddba1304dec46ebd8e2a7894f6a968dce163d5ed22

Request headers

Referer
https://wws.sadhwr86.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 12 Jul 2024 10:31:05 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sun, 07 Jul 2024 10:52:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668a737e-33d9"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=426USbF7uy53en3xtfee4dB%2BcEveiOerFclL6yHKGVO5YKthHCpZC3rrOGUgxgfBkcVDymHTx8pEbYImmXWTBlRibFD1%2Bub8ZTx3nL53xeD62DXMxGWmmMfQa3BhZVybrY7%2BvDwS%2F8VKG1AGIrVX1g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8a205c936b5836d5-YYZ
alt-svc
h3=":443"; ma=86400
b81f3f696521.css
wws.sadhwr86.cyou/static/css/
1 KB
764 B
Stylesheet
General
Full URL
https://wws.sadhwr86.cyou/static/css/b81f3f696521.css
Requested by
Host: wws.sadhwr86.cyou
URL: https://wws.sadhwr86.cyou/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:9143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
759dc14a647618bcae5099437c89998c28a2828fd56784bf1ce88edea1c037fa

Request headers

Referer
https://wws.sadhwr86.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 12 Jul 2024 10:31:05 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sun, 07 Jul 2024 10:52:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668a737e-47e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=csTiRc8M4yCbcsB%2F8gW1dhpuRuCe3lDjOiu1oI4MkWWZQmACuz6Ac9Applj4dtdi9vBiOFNZDmOEIt44LdsPpWeVrUUGMOGDmbU0MILiSYxgsmpAx0pig4EC5RsUnHmMuFhPtVVpkatdBw0DkIotVg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8a205c936b5936d5-YYZ
alt-svc
h3=":443"; ma=86400
a8e9X0x2yK.js
wws.sadhwr86.cyou/static/js/
167 KB
66 KB
Script
General
Full URL
https://wws.sadhwr86.cyou/static/js/a8e9X0x2yK.js
Requested by
Host: wws.sadhwr86.cyou
URL: https://wws.sadhwr86.cyou/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:9143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03515ff6274c03aee3c157d9a9c08c23f07516b8b10c7c46966acc82689ce4f8

Request headers

Referer
https://wws.sadhwr86.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 12 Jul 2024 10:31:05 GMT
content-encoding
gzip
cf-cache-status
REVALIDATED
last-modified
Sun, 07 Jul 2024 10:52:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668a737f-29cf7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=93kCXFnu9onUXhtg0HztZWGzoTjynylzpVULE0truDIRwJxQDPtLtCsP7eF26hxb8CcGmWH9SeD3vIDyd2Pryvx8iDaAlmbnfPw7LB4gLSK39mvGK54Tjhjn0uZ1XBEY3ix0WqTdq5eqgem7phnDjg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
8a205c936b5a36d5-YYZ
alt-svc
h3=":443"; ma=86400
twcEPbv4.js
wws.sadhwr86.cyou/static/js/
5 KB
3 KB
Script
General
Full URL
https://wws.sadhwr86.cyou/static/js/twcEPbv4.js
Requested by
Host: wws.sadhwr86.cyou
URL: https://wws.sadhwr86.cyou/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:9143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
776186497347640c4b7dda1f563b4c1db4d794b1db84c7dd06d24d4190a6fb5d

Request headers

Referer
https://wws.sadhwr86.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 12 Jul 2024 10:31:05 GMT
content-encoding
gzip
cf-cache-status
REVALIDATED
last-modified
Sun, 07 Jul 2024 10:52:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668a737f-15b3"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bOdaPfkLwwHA7K2wJTAD8ApCbKT05ZSn79iI%2Bvvmxu8%2FjNJnLXCe9NiO992NO30629j8rDyZelBIHG%2BT1q%2F4nXPGV7%2B2ifCnKoBjoWSI%2BPMnIwPjr60Zaz%2FY542IXK9QBFzJH2DdhP%2BBOjr6MyvW5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
8a205c936b5c36d5-YYZ
alt-svc
h3=":443"; ma=86400
8cb0399b28aa.css
wws.sadhwr86.cyou/static/css/
0
477 B
Other
General
Full URL
https://wws.sadhwr86.cyou/static/css/8cb0399b28aa.css
Requested by
Host: wws.sadhwr86.cyou
URL: https://wws.sadhwr86.cyou/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:9143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://wws.sadhwr86.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 12 Jul 2024 10:31:05 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Sun, 07 Jul 2024 10:52:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668a737e-16f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Eh1dy9SBaNaBSJcRgo%2FjprZpeI%2BlLpn3kORn%2BCFXeGXa9AcMVDut5bS4EfxnfZ%2F5asQmEd9aapGsSC%2BcLWMXoSduCV%2Fyc2q%2BPX7VWoHiG4u2fPRCxyLEnS0HvS1ddhqygzZZUtdN0QY9fR5yIOr3jQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8a205c937b7536d5-YYZ
alt-svc
h3=":443"; ma=86400
a2e9X0x2yK.js
wws.sadhwr86.cyou/static/js/
0
816 B
Other
General
Full URL
https://wws.sadhwr86.cyou/static/js/a2e9X0x2yK.js
Requested by
Host: wws.sadhwr86.cyou
URL: https://wws.sadhwr86.cyou/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:9143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://wws.sadhwr86.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 12 Jul 2024 10:31:05 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Sun, 07 Jul 2024 10:52:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668a737f-2f5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MF4Zuci4hHpPIPNPrMHwyx1ELJsEdEzJ7s%2F0BKe7WgozK%2F%2B1HFSUG3IqmFDz5SuguL0aWTob7NZg%2Bvnk0AGuLbL2v8SwtXiWwkSWSemi7uUeKUjRQducYdAKcWbCoJ%2BgWFCtmLPpHWsGnMh1lIo%2Btw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
8a205c937b7736d5-YYZ
alt-svc
h3=":443"; ma=86400
e9e9X0x2yK.js
wws.sadhwr86.cyou/static/js/
0
12 KB
Other
General
Full URL
https://wws.sadhwr86.cyou/static/js/e9e9X0x2yK.js
Requested by
Host: wws.sadhwr86.cyou
URL: https://wws.sadhwr86.cyou/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:9143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://wws.sadhwr86.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 12 Jul 2024 10:31:05 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sun, 07 Jul 2024 10:52:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668a737f-704b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ncj9MCYeQ3%2FbXWtIVOUnKotlIsGvPT3%2Bf8m2wpJaTriq%2Fcoxh%2FdL1mmyJ1FwBkHrmF%2FRT28gwMoVg7bUe497UPMrLgXLGfx7TmsFeRKydO%2B6g5j1Cf710QmLnejZSGo6apKyihRCc%2F0JzQbOVqfVRA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
8a205c937b7836d5-YYZ
alt-svc
h3=":443"; ma=86400
e9e9X0x2yK.js
wws.sadhwr86.cyou/static/js/
28 KB
0
Script
General
Full URL
https://wws.sadhwr86.cyou/static/js/e9e9X0x2yK.js
Requested by
Host: wws.sadhwr86.cyou
URL: https://wws.sadhwr86.cyou/static/js/twcEPbv4.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:9143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e5ef8d1fc5d5a7cdeb9e5fef37a8be07ed858d09fe79593a124fb602a39b11a

Request headers

Referer
https://wws.sadhwr86.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 12 Jul 2024 10:31:05 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sun, 07 Jul 2024 10:52:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668a737f-704b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ncj9MCYeQ3%2FbXWtIVOUnKotlIsGvPT3%2Bf8m2wpJaTriq%2Fcoxh%2FdL1mmyJ1FwBkHrmF%2FRT28gwMoVg7bUe497UPMrLgXLGfx7TmsFeRKydO%2B6g5j1Cf710QmLnejZSGo6apKyihRCc%2F0JzQbOVqfVRA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
8a205c937b7836d5-YYZ
alt-svc
h3=":443"; ma=86400
favicon.ico
wws.sadhwr86.cyou/
787 B
1 KB
Other
General
Full URL
https://wws.sadhwr86.cyou/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:9143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0cadf240e89340b93df35240e7809039c1c574be05fbe2cf3243e2f487bc9ec

Request headers

Referer
https://wws.sadhwr86.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 12 Jul 2024 10:31:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sun, 07 Jul 2024 10:52:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"668a737e-313"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YIdvZNdNl1ytMcFoV9m%2F9emIJRJramYxG251lY1DnWS9qvw78PpkNdzUEAgxPyn4x4zXikBxa2JzV3qO4R4omt2pR09oJkMiLIPafD3wFmJPH1NZRqPwG6ar1M3Ha6Qm%2BokIM%2BEkz7yg4pZw0TxbRA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/x-icon
cache-control
max-age=14400
cf-ray
8a205c970984ac2e-YYZ
alt-svc
h3=":443"; ma=86400
truncated
/
85 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/
9 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8135d49e18653784831e2e4c4e5835736de0cf47049ccbffb2445aa4b6174f7a

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackJsonp object| $cookies

0 Cookies