www.joingroupwhatsapp.zzux.com Open in urlscan Pro
173.212.204.167  Malicious Activity! Public Scan

Submitted URL: https://www.joingroupwhatsapp.zzux.com/
Effective URL: https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
Submission: On April 06 via automatic, source certstream-suspicious

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 173.212.204.167, located in Germany and belongs to CONTABO, DE. The main domain is www.joingroupwhatsapp.zzux.com.
TLS certificate: Issued by joingroupwhatsapp.zzux.com on April 5th 2019. Valid for: a year.
This is the only time www.joingroupwhatsapp.zzux.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
2 6 173.212.204.167 51167 (CONTABO)
1 2a03:2880:f22... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
6 3
Apex Domain
Subdomains
Transfer
6 zzux.com
www.joingroupwhatsapp.zzux.com
379 KB
1 blogspot.com
2.bp.blogspot.com
38 KB
1 whatsapp.net
www-cdn.whatsapp.net
5 KB
6 3
Domain Requested by
6 www.joingroupwhatsapp.zzux.com 2 redirects www.joingroupwhatsapp.zzux.com
1 2.bp.blogspot.com www.joingroupwhatsapp.zzux.com
1 www-cdn.whatsapp.net www.joingroupwhatsapp.zzux.com
6 3
Subject Issuer Validity Valid
joingroupwhatsapp.zzux.com
joingroupwhatsapp.zzux.com
2019-04-05 -
2020-04-04
a year crt.sh
*.whatsapp.net
DigiCert SHA2 High Assurance Server CA
2019-02-27 -
2019-05-28
3 months crt.sh
*.googleusercontent.com
Google Internet Authority G3
2019-03-01 -
2019-05-24
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
Frame ID: A18D99CC639CD7CB915AE20754ACCA3A
Requests: 6 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://www.joingroupwhatsapp.zzux.com/ HTTP 302
    https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y HTTP 301
    https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

6
Requests

33 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

421 kB
Transfer

419 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.joingroupwhatsapp.zzux.com/ HTTP 302
    https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y HTTP 301
    https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
Redirect Chain
  • https://www.joingroupwhatsapp.zzux.com/
  • https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y
  • https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
22 KB
22 KB
Document
General
Full URL
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.212.204.167 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS
xpert.rusherhost.web.id
Software
Apache /
Resource Hash
87a5ede6308bcf40cf43ddedba6d948da0468e2aa5fbe961034383d8e76883a8

Request headers

Host
www.joingroupwhatsapp.zzux.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 06 Apr 2019 22:54:43 GMT
Server
Apache
Last-Modified
Fri, 07 Sep 2018 10:22:46 GMT
Accept-Ranges
bytes
Content-Length
22068
Keep-Alive
timeout=5, max=98
Connection
Keep-Alive
Content-Type
text/html

Redirect headers

Date
Sat, 06 Apr 2019 22:54:43 GMT
Server
Apache
Location
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
Content-Length
280
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
style.build35e6.css
www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/css/v4/
241 KB
241 KB
Stylesheet
General
Full URL
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/css/v4/style.build35e6.css?v=32fe13a
Requested by
Host: www.joingroupwhatsapp.zzux.com
URL: https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.212.204.167 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS
xpert.rusherhost.web.id
Software
Apache /
Resource Hash
61c8fe74b1a340b6637de523fc0e46a2805f81b0c601c87e5ac122e81dece9a7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
www.joingroupwhatsapp.zzux.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 06 Apr 2019 22:54:43 GMT
Last-Modified
Thu, 26 Jul 2018 07:24:42 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
246425
jquery-1.12.2.min.js
www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/js/v4/
95 KB
95 KB
Script
General
Full URL
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/js/v4/jquery-1.12.2.min.js
Requested by
Host: www.joingroupwhatsapp.zzux.com
URL: https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.212.204.167 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS
xpert.rusherhost.web.id
Software
Apache /
Resource Hash
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
www.joingroupwhatsapp.zzux.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 06 Apr 2019 22:54:43 GMT
Last-Modified
Thu, 21 Sep 2017 23:12:34 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
97244
whatsapp-logo.svg
www-cdn.whatsapp.net/img/v4/
5 KB
5 KB
Image
General
Full URL
https://www-cdn.whatsapp.net/img/v4/whatsapp-logo.svg?v=46fe27fc8
Requested by
Host: www.joingroupwhatsapp.zzux.com
URL: https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/js/v4/jquery-1.12.2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f22d:c5:face:b00c:0:167 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
lighttpd/1.4.35 /
Resource Hash
4c38e1097b864a873243dee54c73acca2dbcfd48112e5afde26973b627b40835
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/css/v4/style.build35e6.css?v=32fe13a
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
via
HTTP/1.1 192.155.212.203:443 (fwdproxy2/c761819eca1f49a4bd61947b4028550c 69.171.251.14)
x-content-type-options
nosniff
last-modified
Thu, 21 Sep 2017 17:12:35 GMT
server
lighttpd/1.4.35
access-control-allow-origin
https://www.whatsapp.com
date
Sat, 06 Apr 2019 22:54:43 GMT
x-frame-options
SAMEORIGIN
x-fb-ip-type
allowed
content-type
image/svg+xml; charset=utf-8
status
200
cache-control
max-age=1209600, no-transform
x-connected-to
192.155.212.203
accept-ranges
bytes
content-length
4899
icon-chat.png
www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/img/v4/
20 KB
20 KB
Image
General
Full URL
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/img/v4/icon-chat.png
Requested by
Host: www.joingroupwhatsapp.zzux.com
URL: https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/js/v4/jquery-1.12.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.212.204.167 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS
xpert.rusherhost.web.id
Software
Apache /
Resource Hash
b6b5990665e9b1e7db462f4f74c4d9517e1e6b315403cdc43150bd26084ea4c4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
www.joingroupwhatsapp.zzux.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/css/v4/style.build35e6.css?v=32fe13a
Connection
keep-alive
Cache-Control
no-cache
Referer
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/css/v4/style.build35e6.css?v=32fe13a
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 06 Apr 2019 22:54:43 GMT
Last-Modified
Fri, 22 Dec 2017 03:24:34 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
20384
Calendar-Girl-Poster.jpg
2.bp.blogspot.com/-ujP6DexUjLM/Vw3-9WzLfvI/AAAAAAAAAZg/SXYW8gcWeuUAl-stYMEF5FaKhpiGTleXwCLcB/s1600/
37 KB
38 KB
Image
General
Full URL
https://2.bp.blogspot.com/-ujP6DexUjLM/Vw3-9WzLfvI/AAAAAAAAAZg/SXYW8gcWeuUAl-stYMEF5FaKhpiGTleXwCLcB/s1600/Calendar-Girl-Poster.jpg
Requested by
Host: www.joingroupwhatsapp.zzux.com
URL: https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/js/v4/jquery-1.12.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:815::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
022f11930edc3779b31550dce32305af5b1762b7cb71462e40c06379d18fa2fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.joingroupwhatsapp.zzux.com/invite/ftJgvJTDYseyV874e7ogySg8y/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sat, 06 Apr 2019 22:54:43 GMT
x-content-type-options
nosniff
age
0
status
200
content-disposition
inline;filename="Calendar-Girl-Poster.jpg"
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
38122
x-xss-protection
0
server
fife
etag
"v199"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Fri, 29 Mar 2019 11:14:57 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery

0 Cookies