urlscan.io logo urlscan.io
SecurityTrails logo

themusecommands.com Open in urlscan Pro
85.192.31.16  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://themusecommands.com/fqu2x/
Submission: On November 09 via api from US — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 85.192.31.16, located in Russian Federation and belongs to AEZA-AS, GB. The main domain is themusecommands.com.
TLS certificate: Issued by R11 on November 6th 2024. Valid for: 3 months.
This is the only time themusecommands.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
1 9 85.192.31.16 210644 (AEZA-AS)
9 2
Apex Domain
Subdomains		 Transfer
9 themusecommands.com
themusecommands.com
530 KB
9 1
Domain Requested by
9 themusecommands.com 1 redirects themusecommands.com
9 1

This site contains no links.

Subject Issuer Validity Valid
themusecommands.com
R11		 2024-11-06 -
2025-02-04		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://themusecommands.com/fqu2x/
Frame ID: A3E5230E4A9908A2F8CD792BA5640AD3
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Главная

Page URL History Show full URLs

  1. https://themusecommands.com/fqu2x HTTP 301
    https://themusecommands.com/fqu2x/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

530 kB
Transfer

527 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://themusecommands.com/fqu2x HTTP 301
    https://themusecommands.com/fqu2x/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
themusecommands.com/fqu2x/
Redirect Chain
  • https://themusecommands.com/fqu2x
  • https://themusecommands.com/fqu2x/
355 B
759 B 		Document
General
Check archive.org
Download Go to
Full URL
https://themusecommands.com/fqu2x/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.192.31.16 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
Software
stormwall /
Resource Hash
5c75844b5f3bf79f34241a2bbfe28c9df280f208ff40dda36fdb7f30bbeb3ce8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
access-control-max-age
3628800
cache-control
public, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 09 Nov 2024 04:33:17 GMT
etag
W/"163-193037e5030"
last-modified
Wed, 06 Nov 2024 22:00:30 GMT
server
stormwall

Redirect headers

content-length
175
content-type
text/html
date
Sat, 09 Nov 2024 04:33:17 GMT
location
https://themusecommands.com/fqu2x/
server
stormwall
index-57c16cb7.js
themusecommands.com/fqu2x/assets/ 		324 KB
325 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://themusecommands.com/fqu2x/assets/index-57c16cb7.js
Requested by
Host: themusecommands.com
URL: https://themusecommands.com/fqu2x/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.192.31.16 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
Software
stormwall /
Resource Hash
81fd60876bb641d8428dd9f7b5cf842a31abebbd55d5e52a2f2f2ce648e35479

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://themusecommands.com
Referer
https://themusecommands.com/fqu2x/

Response headers

access-control-max-age
3628800
cache-control
public, max-age=0
etag
W/"51039-193037e5030"
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
accept-ranges
bytes
access-control-allow-origin
*
content-length
331833
date
Sat, 09 Nov 2024 04:33:17 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 06 Nov 2024 22:00:30 GMT
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
index-9cadf498.css
themusecommands.com/fqu2x/assets/ 		202 KB
202 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://themusecommands.com/fqu2x/assets/index-9cadf498.css
Requested by
Host: themusecommands.com
URL: https://themusecommands.com/fqu2x/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.192.31.16 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
Software
stormwall /
Resource Hash
9cadf498b62df561306390edfbe3643b77fc4fb0a994c53f00b6c2e86250cc36

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://themusecommands.com/fqu2x/

Response headers

access-control-max-age
3628800
cache-control
public, max-age=0
etag
W/"3271d-193037e5030"
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
accept-ranges
bytes
access-control-allow-origin
*
content-length
206621
date
Sat, 09 Nov 2024 04:33:17 GMT
content-type
text/css; charset=UTF-8
last-modified
Wed, 06 Nov 2024 22:00:30 GMT
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
/
themusecommands.com/socket.io/ 		118 B
468 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://themusecommands.com/socket.io/?path=%2Ffqu2x%2F&EIO=4&transport=polling&t=PCFCgXj
Requested by
Host: themusecommands.com
URL: https://themusecommands.com/fqu2x/assets/index-57c16cb7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.192.31.16 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
Software
stormwall /
Resource Hash
6b4e2b7692fbd1f28d3e0bc9bc16ce9d2410bcb0f2f0ee5b3ff30151c0f96a77

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
*/*
Referer
https://themusecommands.com/fqu2x/

Response headers

access-control-max-age
3628800
cache-control
no-store
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
content-length
118
date
Sat, 09 Nov 2024 04:33:18 GMT
content-type
text/plain; charset=UTF-8
vary
Origin
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
config
themusecommands.com/ 		561 B
264 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://themusecommands.com/config
Requested by
Host: themusecommands.com
URL: https://themusecommands.com/fqu2x/assets/index-57c16cb7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.192.31.16 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
Software
stormwall /
Resource Hash
bd9b8dc5e4936e1d19cb5095a9a6de3cf82859cc2ff7bbbf561a8b5290a7f745

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
Referer
https://themusecommands.com/fqu2x/

Response headers

content-encoding
gzip
date
Sat, 09 Nov 2024 04:33:18 GMT
content-type
text/html
server
stormwall
favicon.ico
themusecommands.com/ 		0
0
/
themusecommands.com/socket.io/ 		2 B
338 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://themusecommands.com/socket.io/?path=%2Ffqu2x%2F&EIO=4&transport=polling&t=PCFCgcb&sid=bsmhP_MLyJEW--TYAA9T
Requested by
Host: themusecommands.com
URL: https://themusecommands.com/fqu2x/assets/index-57c16cb7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.192.31.16 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
Software
stormwall /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
https://themusecommands.com/fqu2x/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
*/*
Content-type
text/plain;charset=UTF-8

Response headers

access-control-max-age
3628800
cache-control
no-store
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
content-length
2
date
Sat, 09 Nov 2024 04:33:18 GMT
content-type
text/html
vary
Origin
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
/
themusecommands.com/socket.io/ 		32 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://themusecommands.com/socket.io/?path=%2Ffqu2x%2F&EIO=4&transport=polling&t=PCFCgcd&sid=bsmhP_MLyJEW--TYAA9T
Requested by
Host: themusecommands.com
URL: https://themusecommands.com/fqu2x/assets/index-57c16cb7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.192.31.16 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
Software
stormwall /
Resource Hash
1ce857ed2001ca3e0486808c664eb3badedf00ad20b18e8b10eb67d17e2afc50

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
*/*
Referer
https://themusecommands.com/fqu2x/

Response headers

access-control-max-age
3628800
cache-control
no-store
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
content-length
32
date
Sat, 09 Nov 2024 04:33:18 GMT
content-type
text/plain; charset=UTF-8
vary
Origin
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
/
themusecommands.com/socket.io/ 		1 B
349 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://themusecommands.com/socket.io/?path=%2Ffqu2x%2F&EIO=4&transport=polling&t=PCFCghZ&sid=bsmhP_MLyJEW--TYAA9T
Requested by
Host: themusecommands.com
URL: https://themusecommands.com/fqu2x/assets/index-57c16cb7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.192.31.16 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
Software
stormwall /
Resource Hash
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
*/*
Referer
https://themusecommands.com/fqu2x/

Response headers

access-control-max-age
3628800
cache-control
no-store
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
content-length
1
date
Sat, 09 Nov 2024 04:33:19 GMT
content-type
text/plain; charset=UTF-8
vary
Origin
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
themusecommands.com
URL
https://themusecommands.com/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| __VUE__

1 Cookies

Domain/Path Name / Value
themusecommands.com/ Name: Auth
Value: 3662e4df29917bfdff8af7f75942e26b

2 Console Messages

Source Level URL
Text
network error URL: https://themusecommands.com/config
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://themusecommands.com/favicon.ico
Message:
Failed to load resource: net::ERR_HTTP2_PROTOCOL_ERROR