whats.whdoxkdx.com
Open in
urlscan Pro
43.249.30.44
Malicious Activity!
Public Scan
URL:
https://whats.whdoxkdx.com/
Submission: On December 02 via api from US — Scanned from US
Submission: On December 02 via api from US — Scanned from US
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 9 HTTP transactions.
The main IP is 43.249.30.44, located in
Hong Kong and
belongs to HKKFGL-AS-AP HK Kwaifong Group Limited, HK.
The main domain is whats.whdoxkdx.com.
TLS certificate: Issued by R3 on December 2nd 2023. Valid for: 3 months.
This is the only time whats.whdoxkdx.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on December 2nd 2023. Valid for: 3 months.
This is the only time whats.whdoxkdx.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 43.249.30.44 43.249.30.44 | 133115 (HKKFGL-AS...) (HKKFGL-AS-AP HK Kwaifong Group Limited) | |
| 4 | 38.181.88.92 38.181.88.92 | 151796 (BIGNETLIM...) (BIGNETLIMITED-AS-AP BIGNET LIMITED) | |
| 9 | 2 |
5
43.249.30.44
(Hong Kong)
ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK)
ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK)
| whats.whdoxkdx.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
whdoxkdx.com
whats.whdoxkdx.com |
464 KB |
| 4 |
wantabnew.com
www.wantabnew.com |
754 B |
| 9 | 2 |
| Domain | Requested by | |
|---|---|---|
| 5 | whats.whdoxkdx.com |
whats.whdoxkdx.com
|
| 4 | www.wantabnew.com |
whats.whdoxkdx.com
|
| 9 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| whats.whdoxkdx.com R3 |
2023-12-02 - 2024-03-01 |
3 months | crt.sh |
| www.wantabnew.com R3 |
2023-11-24 - 2024-02-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://whats.whdoxkdx.com/
Frame ID: D7EF6B51F08CE0D47C2DFC66350F2763
Requests: 9 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
whats.whdoxkdx.com/ |
749 B 980 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
chunk-vendors.d25f0563.css
whats.whdoxkdx.com/css/ |
235 KB 45 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
chunk-vendors.ba4f7857.js
whats.whdoxkdx.com/js/ |
956 KB 309 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
web.7005629b.js
whats.whdoxkdx.com/js/ |
11 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
walid
www.wantabnew.com/whatsapp/ |
46 B 322 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tutorial.png
whats.whdoxkdx.com/img/ |
103 KB 103 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
qrcode
www.wantabnew.com/whatsapp/ |
55 B 55 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
walid
www.wantabnew.com/whatsapp/ |
46 B 322 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
qrcode
www.wantabnew.com/whatsapp/ |
55 B 55 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| webpackJsonp function| _0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
whats.whdoxkdx.com
www.wantabnew.com
38.181.88.92
43.249.30.44
1bebba22cabbfd8e999e53d35ecb55b8cb82a9e928eed9ed10f9160ba1154e45
6bbf2ee81b05567a610e6f9350fc23175e7ec3941ae5a5fb0c608d5ea0292733
6d026c2709296a28bed443f1948554abf8676ce4f8eecb5a58487fd5f0c103ee
ae9fdf03babdb5d050f36a651732a29128377217d38d08a17d7157d056a1960b
b8ec5d902cc9fe345b625fc404ec5fd775b2e16d3101d50239e684be7c9b7c25
d05f1331b55473758dc16ec6d4eb46084b6f56fc60038b08b5201e09578cdc8c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855