chatwhtsapp.com
Open in
urlscan Pro
31.220.17.208
Malicious Activity!
Public Scan
Submission: On March 15 via manual from PE
Summary
TLS certificate: Issued by R3 on January 31st 2021. Valid for: 3 months.
This is the only time chatwhtsapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 31.220.17.208 31.220.17.208 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
1 2 | 185.60.216.53 185.60.216.53 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:801::200e | 15169 (GOOGLE) (GOOGLE) | |
9 | 5 |
ASN32934 (FACEBOOK, US)
PTR: whatsapp-cdn-shv-01-frx5.fbcdn.net
www.cdn.whatsapp.net | |
www.whatsapp.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
chatwhtsapp.com
1 redirects
chatwhtsapp.com |
153 KB |
2 |
google-analytics.com
www.google-analytics.com |
19 KB |
1 |
whatsapp.com
www.whatsapp.com |
|
1 |
whatsapp.net
1 redirects
www.cdn.whatsapp.net |
159 B |
9 | 4 |
Domain | Requested by | |
---|---|---|
7 | chatwhtsapp.com |
1 redirects
chatwhtsapp.com
|
2 | www.google-analytics.com |
chatwhtsapp.com
www.google-analytics.com |
1 | www.whatsapp.com |
chatwhtsapp.com
|
1 | www.cdn.whatsapp.net | 1 redirects |
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
chatwhtsapp.com R3 |
2021-01-31 - 2021-05-01 |
3 months | crt.sh |
*.whatsapp.net DigiCert SHA2 High Assurance Server CA |
2021-02-10 - 2021-05-10 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2021-02-23 - 2021-05-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://chatwhtsapp.com/ERrgbiwrVNK4xZjmGlviNw/
Frame ID: 833933B32A45CB320872C11E02167EF1
Requests: 10 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://www.cdn.whatsapp.net/js/jquery.js HTTP 302
- https://www.whatsapp.com/js/jquery.js
- https://chatwhtsapp.com/img/v4/invite/icon-chat.png HTTP 302
- https://chatwhtsapp.com/ERrgbiwrVNK4xZjmGlviNw/
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
chatwhtsapp.com/ERrgbiwrVNK4xZjmGlviNw/ |
22 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
invite.css
chatwhtsapp.com/ERrgbiwrVNK4xZjmGlviNw/css/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
www.whatsapp.com/js/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
jquery-1.js
chatwhtsapp.com/ERrgbiwrVNK4xZjmGlviNw/js/ |
95 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
jquery.min.js
chatwhtsapp.com/ERrgbiwrVNK4xZjmGlviNw/js/ |
82 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
46 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
/
chatwhtsapp.com/ERrgbiwrVNK4xZjmGlviNw/ Redirect Chain
|
22 KB 22 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
157 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
collect
www.google-analytics.com/j/ |
2 B 126 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
5-min.png
chatwhtsapp.com/ERrgbiwrVNK4xZjmGlviNw/png/ |
60 KB 60 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery string| GoogleAnalyticsObject function| ga object| _0xd733 object| objetos function| aleatorio object| rlink string| msgamigo number| shareCountG string| urlpubliMovil string| urlpubliPC string| msg function| setCookie function| getCookie number| c string| g function| fng function| random function| checkZero function| timer1 number| ii number| iy function| hidepop object| citas number| alea object| google_tag_data object| gaplugins object| gaGlobal object| gaData4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.chatwhtsapp.com/ | Name: _gat Value: 1 |
|
.chatwhtsapp.com/ | Name: _gid Value: GA1.2.235103071.1615770139 |
|
.chatwhtsapp.com/ | Name: _ga Value: GA1.2.1312505045.1615770139 |
|
chatwhtsapp.com/ERrgbiwrVNK4xZjmGlviNw | Name: invgrupo Value: 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
chatwhtsapp.com
www.cdn.whatsapp.net
www.google-analytics.com
www.whatsapp.com
185.60.216.53
2a00:1450:4001:801::200e
2a00:1450:4001:828::200e
31.220.17.208
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
6cf38dd3ed35b2609eb89c900a6107d95315a241964ae3e88a3d5920c89fd988
929fc7de403996f8699ceaa2e29739df62d258c394711a91945475eabaca6213
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a556263a0c49d83c6504f54ba8f28d836f6cfee991a9e2e9f44b4046a28cd644
d43582dd7fa6bf05be4edae222bab4052c0134511428f86e6cdbc70378f10bc9
df34524351c5fabc921a89183b5da5667aebd7b9e9a1c52255c76ff722935ea3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb2ceb00d62c62740a0d175a3a943ce09a66c30c9eb8a6f98760f8bc774b182c