groupwa-link.r0ulxye4.my.id Open in urlscan Pro
152.42.230.136 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://groupwa-link.r0ulxye4.my.id/rambo.html
Submission: On April 17 via api (April 17th 2024, 8:06:50 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 10 HTTP transactions. The main IP is 152.42.230.136, located in Singapore, Singapore and belongs to DIGITALOCEAN-ASN, US. The main domain is groupwa-link.r0ulxye4.my.id.
TLS certificate: Issued by R3 on April 15th 2024. Valid for: 3 months.

This is the only time groupwa-link.r0ulxye4.my.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
6	152.42.230.136 152.42.230.136	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 1	216.58.206.78 216.58.206.78	15169 (GOOGLE) (GOOGLE)
1	172.217.18.100 172.217.18.100	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
10	5

6 152.42.230.136 (Singapore, Singapore)

ASN14061 (DIGITALOCEAN-ASN, US)

groupwa-link.r0ulxye4.my.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.78 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: tzfraa-aa-in-f14.1e100.net

google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.100 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

2.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	r0ulxye4.my.id groupwa-link.r0ulxye4.my.id	381 KB
2	google.com 1 redirects google.com — Cisco Umbrella Rank: 1 www.google.com — Cisco Umbrella Rank: 2	2 KB
1	blogspot.com 2.bp.blogspot.com — Cisco Umbrella Rank: 18261	38 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 97	3 KB
0	whatsapp.com Failed www.whatsapp.com Failed
10	5

	Domain	Requested by
6	groupwa-link.r0ulxye4.my.id	groupwa-link.r0ulxye4.my.id
1	2.bp.blogspot.com	groupwa-link.r0ulxye4.my.id
1	www.google.com	groupwa-link.r0ulxye4.my.id
1	google.com	1 redirects
1	www.facebook.com	groupwa-link.r0ulxye4.my.id
0	www.whatsapp.com Failed	groupwa-link.r0ulxye4.my.id
10	6

This site contains links to these domains. Also see Links.

Domain
www.whatsapp.com
translate.whatsapp.com
web.whatsapp.com
www.whatsappbrand.com
blog.whatsapp.com
twitter.com
www.facebook.com

Subject Issuer	Validity	Valid
groupwa-link.r0ulxye4.my.id R3	`2024-04-15` - `2024-07-14`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-01-26` - `2024-04-25`	3 months	crt.sh
misc-sni.blogspot.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://groupwa-link.r0ulxye4.my.id/rambo.html
Frame ID: 5D861E44F7C2B5BB857D7BF67833C755
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WhatsApp Group Invite

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

80 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

5
IPs

3
Countries

423 kB
Transfer

427 kB
Size

0
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://www.whatsapp.com/

Search URL Search Domain Scan URL

URL: https://translate.whatsapp.com/
Title: Help translate WhatsApp into your language

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/download
Title: Download

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/features/
Title: Features

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/security/
Title: Security

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/download/
Title: Download

Search URL Search Domain Scan URL

URL: https://web.whatsapp.com/
Title: WhatsApp Web

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/about/
Title: About

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/join/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.whatsappbrand.com/
Title: Brand Center

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/contact/
Title: Get in touch

Search URL Search Domain Scan URL

URL: https://blog.whatsapp.com/
Title: Blog

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/android/
Title: Android

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/appstore/
Title: iPhone

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/wp/
Title: Windows Phone

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/ota/
Title: BlackBerry

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/nokia/
Title: Nokia

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/faq/
Title: FAQ

Search URL Search Domain Scan URL

URL: https://twitter.com/whatsapp
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/WhatsApp
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.whatsapp.com/legal/
Title: Privacy & Terms

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://google.com/favicon.ico HTTP 301
https://www.google.com/favicon.ico

Request Chain 5

https://www-cdn.whatsapp.net/img/v4/whatsapp-logo.svg?v=46fe27fc8 HTTP 302
https://www.whatsapp.com/img/v4/whatsapp-logo.svg

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request rambo.html Show response
groupwa-link.r0ulxye4.my.id/ 24 KB
24 KB 973ms
203ms Document
text/html 152.42.230.136
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://groupwa-link.r0ulxye4.my.id/rambo.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.230.136 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 0f6f19f8f8c4e9c35196ecbcf72488795cd56331a272b988994f7da201310906

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 24474
Content-Type: text/html
Date: Wed, 17 Apr 2024 20:06:45 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Sun, 23 Sep 2018 17:54:34 GMT
Server: Apache

GET
H/1.1 200
OK style.build35e635e6.css
groupwa-link.r0ulxye4.my.id/css/v4/ 241 KB
241 KB 203ms
203ms Stylesheet
text/css 152.42.230.136
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://groupwa-link.r0ulxye4.my.id/css/v4/style.build35e635e6.css?v=32fe13a
Requested by: Host: groupwa-link.r0ulxye4.my.id
URL: https://groupwa-link.r0ulxye4.my.id/rambo.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.230.136 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 45dc92046e30064bee0a777e9ab0d916a4164db023a38128c88dba58c770831f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://groupwa-link.r0ulxye4.my.id/rambo.html
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 20:06:45 GMT
Last-Modified: Thu, 26 Jul 2018 20:24:42 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 246597

GET
H/1.1 200
OK jquery-1.12.2.min.js Show response
groupwa-link.r0ulxye4.my.id/js/v4/ 95 KB
95 KB 397ms
201ms Script
text/javascript 152.42.230.136
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://groupwa-link.r0ulxye4.my.id/js/v4/jquery-1.12.2.min.js
Requested by: Host: groupwa-link.r0ulxye4.my.id
URL: https://groupwa-link.r0ulxye4.my.id/rambo.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.230.136 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://groupwa-link.r0ulxye4.my.id/rambo.html
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 20:06:45 GMT
Last-Modified: Fri, 22 Sep 2017 12:12:34 GMT
Server: Apache
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 97244

GET
H/1.1 404
Not Found analytics.html
groupwa-link.r0ulxye4.my.id/www.google-analytics.com/ 0
0 206ms
206ms Script
text/html 152.42.230.136
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://groupwa-link.r0ulxye4.my.id/www.google-analytics.com/analytics.html
Requested by: Host: groupwa-link.r0ulxye4.my.id
URL: https://groupwa-link.r0ulxye4.my.id/rambo.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.230.136 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://groupwa-link.r0ulxye4.my.id/rambo.html
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 20:06:46 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 favicon.ico
www.facebook.com/ 5 KB
3 KB 184ms
128ms Image
image/png 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/favicon.ico

Requested by

Host: groupwa-link.r0ulxye4.my.id
URL: https://groupwa-link.r0ulxye4.my.id/rambo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

88ae5454a7c32c630703440849d35c58f570d8eecc23c071dbe68d63ce6a40d7

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://groupwa-link.r0ulxye4.my.id/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
date: Wed, 17 Apr 2024 20:06:46 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: no-cache
x-fb-debug: NHwlpHIscD44sPzANnQDEJW9sKrH3F5KxBlEX6+GYKaOUs5xNeJUWxkUbFvMZfc/qBCjgi4t1Yc12dx0Xr9IyA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-cache, no-store, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

favicon.ico
www.google.com/
Redirect Chain

https://google.com/favicon.ico
https://www.google.com/favicon.ico

5 KB
1 KB

109ms
21ms

Image
image/x-icon

172.217.18.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/favicon.ico

Requested by

Host: groupwa-link.r0ulxye4.my.id
URL: https://groupwa-link.r0ulxye4.my.id/rambo.html

Protocol

Server

172.217.18.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f4.1e100.net

Software

sffe /

Resource Hash

6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://groupwa-link.r0ulxye4.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Wed, 17 Apr 2024 15:44:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15763
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1494
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:30:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/x-icon
cache-control: public, max-age=691200
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 25 Apr 2024 15:44:03 GMT

Redirect headers

date: Wed, 17 Apr 2024 19:47:31 GMT
x-content-type-options: nosniff
server: sffe
age: 1155
content-type: text/html; charset=UTF-8
location: https://www.google.com/favicon.ico
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 231
x-xss-protection: 0
expires: Wed, 17 Apr 2024 20:17:31 GMT

GET

whatsapp-logo.svg
www.whatsapp.com/img/v4/
Redirect Chain

https://www-cdn.whatsapp.net/img/v4/whatsapp-logo.svg?v=46fe27fc8
https://www.whatsapp.com/img/v4/whatsapp-logo.svg

0
0

GET
H/1.1 200
OK icon-chat.png
groupwa-link.r0ulxye4.my.id/img/v4/ 20 KB
20 KB 203ms
202ms Image
image/png 152.42.230.136
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://groupwa-link.r0ulxye4.my.id/img/v4/icon-chat.png
Requested by: Host: groupwa-link.r0ulxye4.my.id
URL: https://groupwa-link.r0ulxye4.my.id/css/v4/style.build35e635e6.css?v=32fe13a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.230.136 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: b6b5990665e9b1e7db462f4f74c4d9517e1e6b315403cdc43150bd26084ea4c4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://groupwa-link.r0ulxye4.my.id/css/v4/style.build35e635e6.css?v=32fe13a
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 20:06:46 GMT
Last-Modified: Fri, 22 Dec 2017 17:24:34 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 20384

GET
H2 200 Calendar-Girl-Poster.jpg
2.bp.blogspot.com/-ujP6DexUjLM/Vw3-9WzLfvI/AAAAAAAAAZg/SXYW8gcWeuUAl-stYMEF5FaKhpiGTleXwCLcB/s1600/ 37 KB
38 KB 613ms
435ms Image
image/jpeg 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-ujP6DexUjLM/Vw3-9WzLfvI/AAAAAAAAAZg/SXYW8gcWeuUAl-stYMEF5FaKhpiGTleXwCLcB/s1600/Calendar-Girl-Poster.jpg

Requested by

Host: groupwa-link.r0ulxye4.my.id
URL: https://groupwa-link.r0ulxye4.my.id/rambo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

186e45b63f746052626083d2cf347b7ba341a5a24e261c870e55e524f3671977

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://groupwa-link.r0ulxye4.my.id/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 20:06:46 GMT
x-content-type-options: nosniff
server: fife
etag: "v199"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Calendar-Girl-Poster.jpg"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38134
x-xss-protection: 0
expires: Thu, 18 Apr 2024 20:06:46 GMT

GET
H/1.1 404
Not Found favicon.html
groupwa-link.r0ulxye4.my.id/whatsapp.com/ 16 B
229 B 203ms
203ms Other
text/html 152.42.230.136
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://groupwa-link.r0ulxye4.my.id/whatsapp.com/favicon.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.230.136 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://groupwa-link.r0ulxye4.my.id/rambo.html
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 20:06:47 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=96
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.whatsapp.com
URL: https://www.whatsapp.com/img/v4/whatsapp-logo.svg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| GoogleAnalyticsObject function| ga function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://groupwa-link.r0ulxye4.my.id/rambo.html Message: Mixed Content: The page at 'https://groupwa-link.r0ulxye4.my.id/rambo.html' was loaded over HTTPS, but requested an insecure element 'http://google.com/favicon.ico'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network	error	URL: https://groupwa-link.r0ulxye4.my.id/www.google-analytics.com/analytics.html Message: Failed to load resource: the server responded with a status of 404 (Not Found)
security	warning	URL: https://groupwa-link.r0ulxye4.my.id/rambo.html(Line 307) Message: Mixed Content: The page at 'https://groupwa-link.r0ulxye4.my.id/rambo.html' was loaded over HTTPS, but requested an insecure element 'http://google.com/favicon.ico'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://groupwa-link.r0ulxye4.my.id/js/v4/jquery-1.12.2.min.js(Line 1) Message: Mixed Content: The page at 'https://groupwa-link.r0ulxye4.my.id/rambo.html' was loaded over HTTPS, but requested an insecure element 'http://2.bp.blogspot.com/-ujP6DexUjLM/Vw3-9WzLfvI/AAAAAAAAAZg/SXYW8gcWeuUAl-stYMEF5FaKhpiGTleXwCLcB/s1600/Calendar-Girl-Poster.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
recommendation	verbose	URL: https://groupwa-link.r0ulxye4.my.id/rambo.html Message: [DOM] Multiple forms should be contained in their own form elements; break up complex forms into ones that represent a single action: (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://groupwa-link.r0ulxye4.my.id/whatsapp.com/favicon.html Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2.bp.blogspot.com
google.com
groupwa-link.r0ulxye4.my.id
www.facebook.com
www.google.com
www.whatsapp.com
www.whatsapp.com
152.42.230.136
172.217.18.100
216.58.206.78
2a00:1450:4001:80f::2001
2a03:2880:f177:83:face:b00c:0:25de
0f6f19f8f8c4e9c35196ecbcf72488795cd56331a272b988994f7da201310906
186e45b63f746052626083d2cf347b7ba341a5a24e261c870e55e524f3671977
45dc92046e30064bee0a777e9ab0d916a4164db023a38128c88dba58c770831f
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
88ae5454a7c32c630703440849d35c58f570d8eecc23c071dbe68d63ce6a40d7
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9
b6b5990665e9b1e7db462f4f74c4d9517e1e6b315403cdc43150bd26084ea4c4

groupwa-link.r0ulxye4.my.id Open in urlscan Pro 152.42.230.136 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

80 %HTTPS

40 %IPv6

5 Domains

6 Subdomains

5 IPs

3 Countries

423 kBTransfer

427 kBSize

0 Cookies

21 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

6 Console Messages

Indicators

groupwa-link.r0ulxye4.my.id Open in urlscan Pro
152.42.230.136 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

80 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

5
IPs

3
Countries

423 kB
Transfer

427 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!