whattsapp.xyz Open in urlscan Pro
165.154.225.242 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://whattsapp.xyz/
Submission Tags: falconsandbox
Submission: On September 29 via api (September 29th 2024, 8:51:47 pm UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 165.154.225.242, located in Hong Kong, Hong Kong and belongs to SCLOUDPTELTD-AS Scloud Pte Ltd, SG. The main domain is whattsapp.xyz.
TLS certificate: Issued by R10 on September 29th 2024. Valid for: 3 months.

This is the only time whattsapp.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
12	165.154.225.242 165.154.225.242	142002 (SCLOUDPTE...) (SCLOUDPTELTD-AS Scloud Pte Ltd)
1	2408:4005:30a... 2408:4005:30a:4302:6218:d8d9:db29:5dd2	37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.)
13	3

12 165.154.225.242 (Hong Kong, Hong Kong)

ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG)

whattsapp.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2408:4005:30a:4302:6218:d8d9:db29:5dd2 (China)

ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)

cdn.dcloud.net.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	whattsapp.xyz whattsapp.xyz	723 KB
1	dcloud.net.cn cdn.dcloud.net.cn — Cisco Umbrella Rank: 58452	579 B
13	2

	Domain	Requested by
12	whattsapp.xyz	whattsapp.xyz
1	cdn.dcloud.net.cn	whattsapp.xyz
13	2

This site contains links to these domains. Also see Links.

Domain
faq.whatsapp.com

Subject Issuer	Validity	Valid
whattsapp.xyz R10	`2024-09-29` - `2024-12-28`	3 months	crt.sh
*.dcloud.net.cn Certum Domain Validation CA SHA2	`2024-08-12` - `2025-09-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://whattsapp.xyz/
Frame ID: 294624DEBC0CB066F967BF9F07C9643C
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

723 kB
Transfer

1692 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://faq.whatsapp.com/1317564962315842/?cms_platform=web&lang=zh-HK
Title: 需要登入協助嗎？

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
whattsapp.xyz/ 2 KB
994 B 833ms
271ms Document
text/html 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to

Full URL

https://whattsapp.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

39486f82c9603466da5ec5f29bc1932e6e057fc0aa76bc37eb132b0f6af94e79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Sun, 29 Sep 2024 20:51:41 GMT
etag: W/"66f9bd42-64a"
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 uni.943b8fef.css
whattsapp.xyz/assets/ 6 KB
2 KB 270ms
270ms Stylesheet
text/css 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to

Full URL

https://whattsapp.xyz/assets/uni.943b8fef.css

Requested by

Host: whattsapp.xyz
URL: https://whattsapp.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

943b8fef633f92781196dd64f220ae9593077af3b8dd5ca76a43d49c5ecb397d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whattsapp.xyz/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f9bd42-1992"
expires: Mon, 30 Sep 2024 08:51:41 GMT
date: Sun, 29 Sep 2024 20:51:41 GMT
content-type: text/css
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 index-C99Q1VBB.js Show response
whattsapp.xyz/assets/ 134 KB
56 KB 813ms
812ms Script
application/javascript 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to

Full URL

https://whattsapp.xyz/assets/index-C99Q1VBB.js

Requested by

Host: whattsapp.xyz
URL: https://whattsapp.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

56abc64326e39dcb52074165a09248c9a462e38891e22c884efbfeafaaf30754

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://whattsapp.xyz
Referer: https://whattsapp.xyz/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f9bd42-2198d"
expires: Mon, 30 Sep 2024 08:51:41 GMT
date: Sun, 29 Sep 2024 20:51:41 GMT
content-type: application/javascript
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 index-BJcR9W56.css
whattsapp.xyz/assets/ 365 KB
117 KB 540ms
540ms Stylesheet
text/css 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to

Full URL

https://whattsapp.xyz/assets/index-BJcR9W56.css

Requested by

Host: whattsapp.xyz
URL: https://whattsapp.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

0c95cc236a8e66d93e73d13d80b7e38a88530a9baa1ef138abee87ab936c04b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://whattsapp.xyz
Referer: https://whattsapp.xyz/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f9bd42-5b205"
expires: Mon, 30 Sep 2024 08:51:41 GMT
date: Sun, 29 Sep 2024 20:51:41 GMT
content-type: text/css
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 pages-index-index.ekSOb28T.js Show response
whattsapp.xyz/assets/ 31 KB
17 KB 282ms
281ms Script
application/javascript 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to

Full URL

https://whattsapp.xyz/assets/pages-index-index.ekSOb28T.js

Requested by

Host: whattsapp.xyz
URL: https://whattsapp.xyz/assets/index-C99Q1VBB.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

0cc787a2a7f6e3d3db594f8a53364859801fb9d271922c359616d0a84cec46a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://whattsapp.xyz
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f9bd42-7c11"
expires: Mon, 30 Sep 2024 08:51:42 GMT
date: Sun, 29 Sep 2024 20:51:42 GMT
content-type: application/javascript
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 index-J3kPrT7_.css
whattsapp.xyz/assets/ 603 KB
126 KB 276ms
276ms Stylesheet
text/css 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to

Full URL

https://whattsapp.xyz/assets/index-J3kPrT7_.css

Requested by

Host: whattsapp.xyz
URL: https://whattsapp.xyz/assets/index-C99Q1VBB.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

d8fa3b0a5f48825174ba007721567bb1702c57082c829062c0a0a544dd727867

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whattsapp.xyz/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"66f9bd42-96d7c"
expires: Mon, 30 Sep 2024 08:51:42 GMT
date: Sun, 29 Sep 2024 20:51:42 GMT
content-type: text/css
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ccf8dd29c61715a6364ea9ec36d32c295e82ca837488590130c51cee298b7d3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dcc382764aca43c0541ae7bd54d0f06458d429e05280bcd8fe6de205b08049d0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 34f1c77d2d4a93afb80b6b515a8fabf37013640b8e517bab8aba27e56d82d543

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 tips-D-EE07Ok.png
whattsapp.xyz/assets/ 108 KB
108 KB 275ms
274ms Image
image/png 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://whattsapp.xyz/assets/tips-D-EE07Ok.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

6378f99e32ed42c0317c51a6fc8e95474cc4ab245c2c0f33b92cd30af250c50b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whattsapp.xyz/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
content-encoding: gzip
etag: W/"66f9bd42-1b0a0"
expires: Tue, 29 Oct 2024 20:51:43 GMT
date: Sun, 29 Sep 2024 20:51:43 GMT
content-type: image/png
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 tips-iphone-BvlfYr7f.png
whattsapp.xyz/assets/ 86 KB
87 KB 278ms
278ms Image
image/png 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://whattsapp.xyz/assets/tips-iphone-BvlfYr7f.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

1a459c97f9ae782e2718b8cb73468470dcde46249203d4032dfa0e1921539e5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whattsapp.xyz/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
content-encoding: gzip
etag: W/"66f9bd42-1598f"
expires: Tue, 29 Oct 2024 20:51:43 GMT
date: Sun, 29 Sep 2024 20:51:43 GMT
content-type: image/png
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 tips-android-L7uZwV-6.png
whattsapp.xyz/assets/ 74 KB
75 KB 547ms
546ms Image
image/png 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://whattsapp.xyz/assets/tips-android-L7uZwV-6.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

601f965f190bb7b7235a5366859be6b0dd8ba93d811876a199e337254d6d0e64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whattsapp.xyz/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
content-encoding: gzip
etag: W/"66f9bd42-129a3"
expires: Tue, 29 Oct 2024 20:51:43 GMT
date: Sun, 29 Sep 2024 20:51:43 GMT
content-type: image/png
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b663d86f04c936db61b3a14cf556148cf2918283f4e78b34d4446233e57b9940

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 af-CB9iRKAC.svg
whattsapp.xyz/assets/ 20 KB
9 KB 546ms
546ms Image
image/svg+xml 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://whattsapp.xyz/assets/af-CB9iRKAC.svg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

6b0046ef1180dfb4fc06db1e1b10f918b1bd10dbe53a50c2692dcdbe9e75f4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whattsapp.xyz/

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
etag: W/"66f9bd42-5104"
date: Sun, 29 Sep 2024 20:51:43 GMT
content-type: image/svg+xml
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 qr-video3-TfHew4Ic.jpg
whattsapp.xyz/assets/ 249 KB
125 KB 546ms
546ms Image
image/jpeg 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://whattsapp.xyz/assets/qr-video3-TfHew4Ic.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),

Reverse DNS

Software

nginx /

Resource Hash

f34ec7274f85bb4419393cc0d68b02e388a14c180a759df9fcd1ffdc61ec969a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whattsapp.xyz/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
content-encoding: gzip
etag: W/"66f9bd42-3e50e"
expires: Tue, 29 Oct 2024 20:51:43 GMT
date: Sun, 29 Sep 2024 20:51:43 GMT
content-type: image/jpeg
last-modified: Sun, 29 Sep 2024 20:49:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 404 favicon.ico
whattsapp.xyz/ 548 B
611 B 539ms
539ms Other
text/html 165.154.225.242
SCLOUDPTELTD-AS S...

General

Check archive.org

Show headers Download Go to

Full URL: https://whattsapp.xyz/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 165.154.225.242 Hong Kong, Hong Kong, ASN142002 (SCLOUDPTELTD-AS Scloud Pte Ltd, SG),
Reverse DNS
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whattsapp.xyz/

Response headers

content-length: 548
date: Sun, 29 Sep 2024 20:51:43 GMT
content-type: text/html
server: nginx

GET
H/1.1 200
OK shadow-grey.png
cdn.dcloud.net.cn/img/ 136 B
579 B 1000ms
331ms Image
image/png 2408:4005:30a:4302:6218:d8d9:db29:5dd2
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.dcloud.net.cn/img/shadow-grey.png
Requested by: Host: whattsapp.xyz
URL: https://whattsapp.xyz/assets/index-BJcR9W56.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2408:4005:30a:4302:6218:d8d9:db29:5dd2 , China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://whattsapp.xyz/

Response headers

Cache-Control: max-age=7200
ETag: "5cf8b5bf-88"
Connection: close
Expires: Sun, 29 Sep 2024 22:51:46 GMT
Accept-Ranges: bytes
Content-Length: 136
Date: Sun, 29 Sep 2024 20:51:46 GMT
Content-Type: image/png
Last-Modified: Thu, 06 Jun 2019 06:42:07 GMT
Server: nginx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dcloud.net.cn/	1970-01-21 09:30:03	Name: __uni__uid Value: 2yld0mb5veJmH1HtJ08uAg==

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://whattsapp.xyz/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.dcloud.net.cn
whattsapp.xyz
165.154.225.242
2408:4005:30a:4302:6218:d8d9:db29:5dd2
0c95cc236a8e66d93e73d13d80b7e38a88530a9baa1ef138abee87ab936c04b9
0cc787a2a7f6e3d3db594f8a53364859801fb9d271922c359616d0a84cec46a8
0ccf8dd29c61715a6364ea9ec36d32c295e82ca837488590130c51cee298b7d3
1a459c97f9ae782e2718b8cb73468470dcde46249203d4032dfa0e1921539e5c
34f1c77d2d4a93afb80b6b515a8fabf37013640b8e517bab8aba27e56d82d543
39486f82c9603466da5ec5f29bc1932e6e057fc0aa76bc37eb132b0f6af94e79
56abc64326e39dcb52074165a09248c9a462e38891e22c884efbfeafaaf30754
601f965f190bb7b7235a5366859be6b0dd8ba93d811876a199e337254d6d0e64
6378f99e32ed42c0317c51a6fc8e95474cc4ab245c2c0f33b92cd30af250c50b
6b0046ef1180dfb4fc06db1e1b10f918b1bd10dbe53a50c2692dcdbe9e75f4fe
943b8fef633f92781196dd64f220ae9593077af3b8dd5ca76a43d49c5ecb397d
ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f
b663d86f04c936db61b3a14cf556148cf2918283f4e78b34d4446233e57b9940
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d8fa3b0a5f48825174ba007721567bb1702c57082c829062c0a0a544dd727867
dcc382764aca43c0541ae7bd54d0f06458d429e05280bcd8fe6de205b08049d0
f34ec7274f85bb4419393cc0d68b02e388a14c180a759df9fcd1ffdc61ec969a

whattsapp.xyz Open in urlscan Pro 165.154.225.242 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

723 kBTransfer

1692 kBSize

1 Cookies

1 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

whattsapp.xyz Open in urlscan Pro
165.154.225.242 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

723 kB
Transfer

1692 kB
Size

1
Cookies

13 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!