chat-whattsapp.com
Open in
urlscan Pro
85.187.128.24
Malicious Activity!
Public Scan
Effective URL: http://chat-whattsapp.com/KsteMsiXT8TBK4PHmXhhy/
Submission: On March 13 via automatic, source openphish
Summary
This is the only time chat-whattsapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 4 | 85.187.128.24 85.187.128.24 | 55293 (A2HOSTING) (A2HOSTING) | |
5 5 | 2606:4700:303... 2606:4700:3031::681b:90e8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 184.171.242.11 184.171.242.11 | 33182 (DIMENOC) (DIMENOC) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:81c::200e | 15169 (GOOGLE) (GOOGLE) | |
11 | 5 |
ASN55293 (A2HOSTING, US)
PTR: sg1-ls8.a2hosting.com
www.chat-whattsapp.com | |
chat-whattsapp.com |
ASN33182 (DIMENOC, US)
PTR: single-4730.banahosting.com
chat.whatssapp.co |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
whatssapp.co
chat.whatssapp.co |
310 KB |
5 |
whatssap.me
5 redirects
chat.whatssap.me |
2 KB |
4 |
chat-whattsapp.com
2 redirects
www.chat-whattsapp.com chat-whattsapp.com |
25 KB |
2 |
google-analytics.com
www.google-analytics.com |
18 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
28 KB |
11 | 5 |
Domain | Requested by | |
---|---|---|
6 | chat.whatssapp.co |
chat-whattsapp.com
chat.whatssapp.co |
5 | chat.whatssap.me | 5 redirects |
2 | www.google-analytics.com |
www.googletagmanager.com
chat-whattsapp.com |
2 | chat-whattsapp.com |
chat-whattsapp.com
|
2 | www.chat-whattsapp.com | 2 redirects |
1 | www.googletagmanager.com |
chat-whattsapp.com
|
11 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
translate.whatsapp.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google-analytics.com GTS CA 1O1 |
2020-02-25 - 2020-05-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://chat-whattsapp.com/KsteMsiXT8TBK4PHmXhhy/
Frame ID: 1C6D065D538E237054C978D8DFD92517
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.chat-whattsapp.com/DpPyHMSsYDI0jZYCn4zSlE1
HTTP 301
http://www.chat-whattsapp.com/DpPyHMSsYDI0jZYCn4zSlE1/ HTTP 301
http://chat-whattsapp.com/KsteMsiXT8TBK4PHmXhhy/ Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Help translate WhatsApp into your language
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.chat-whattsapp.com/DpPyHMSsYDI0jZYCn4zSlE1
HTTP 301
http://www.chat-whattsapp.com/DpPyHMSsYDI0jZYCn4zSlE1/ HTTP 301
http://chat-whattsapp.com/KsteMsiXT8TBK4PHmXhhy/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://chat.whatssap.me/x_files/invite.css HTTP 301
- http://chat.whatssapp.co/x_files/invite.css
- http://chat.whatssap.me/x_files/analytics.js.descarga HTTP 301
- http://chat.whatssapp.co/x_files/analytics.js.descarga
- http://chat.whatssap.me/x_files/jquery.js.descarga HTTP 301
- http://chat.whatssapp.co/x_files/jquery.js.descarga
- http://chat.whatssap.me/x_files/jquery-1.js.descarga HTTP 301
- http://chat.whatssapp.co/x_files/jquery-1.js.descarga
- http://chat.whatssap.me/x_files/jquery.min.js.descarga HTTP 301
- http://chat.whatssapp.co/x_files/jquery.min.js.descarga
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
chat-whattsapp.com/KsteMsiXT8TBK4PHmXhhy/ Redirect Chain
|
21 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
invite.css
chat.whatssapp.co/x_files/ Redirect Chain
|
14 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
analytics.js.descarga
chat.whatssapp.co/x_files/ Redirect Chain
|
34 KB 35 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js.descarga
chat.whatssapp.co/x_files/ Redirect Chain
|
93 KB 93 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.js.descarga
chat.whatssapp.co/x_files/ Redirect Chain
|
95 KB 95 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js.descarga
chat.whatssapp.co/x_files/ Redirect Chain
|
82 KB 83 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
75 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
906.png
chat-whattsapp.com/DpPyHMSsYDI0jZYCn4zSlE1/i/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-chat.png
chat.whatssapp.co/img/v4/invite/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
157 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
44 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/r/ |
35 B 101 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)45 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| ga object| gaplugins function| $ function| jQuery function| gtag object| dataLayer string| image_save_msg string| no_menu_msg string| smessage function| disableEnterKey function| disable_copy function| disable_copy_ie function| reEnable function| disableSelection function| nocontext object| _0xf3be object| _0xb070 object| objetos function| aleatorio object| rlink string| msgamigo number| shareCountG string| urlpubliMovil string| urlpubliPC string| msg function| setCookie function| getCookie number| c string| g function| fng function| random function| checkZero function| timer1 number| ii number| iy function| hidepop object| citas number| alea object| google_tag_manager string| GoogleAnalyticsObject object| gaGlobal object| gaData object| google_tag_data4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.chat-whattsapp.com/ | Name: _gat_gtag_UA_112019461_3 Value: 1 |
|
.chat-whattsapp.com/ | Name: _gid Value: GA1.2.349797836.1584059360 |
|
.chat-whattsapp.com/ | Name: _ga Value: GA1.2.1886470752.1584059360 |
|
chat-whattsapp.com/KsteMsiXT8TBK4PHmXhhy | Name: invgrupo Value: 0 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
chat-whattsapp.com
chat.whatssap.me
chat.whatssapp.co
www.chat-whattsapp.com
www.google-analytics.com
www.googletagmanager.com
184.171.242.11
2606:4700:3031::681b:90e8
2a00:1450:4001:81c::200e
2a00:1450:4001:81d::2008
85.187.128.24
0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8
1525ff682f8616316d31b26a6f38ce98c0c79bfec35f2ad35695ed41861e7206
19d32096e5e9e5f20be0cf17585596f37af51f5b2fa36cc3c9eb8e78513ce43d
2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
78fc650dbf114dc9179def1cfe1cc6aaa46f46ea11fa215efc116b9661f55747
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
c523573e059f6677ca7a4116acf48460d994734f9bf4e67252e43838c4a62090
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e76acb5d863d93580337e8a1f53b6ee086a2658f37dfeedd0ad6df8933a49be1
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
fb2ceb00d62c62740a0d175a3a943ce09a66c30c9eb8a6f98760f8bc774b182c