wsap.od8v1wv.com
Open in
urlscan Pro
188.114.96.3
Malicious Activity!
Public Scan
Submission: On May 19 via manual from HK — Scanned from ES
Summary
TLS certificate: Issued by GTS CA 1P5 on May 17th 2024. Valid for: 3 months.
This is the only time wsap.od8v1wv.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 171.107.86.49 171.107.86.49 | 137693 (CHINATELE...) (CHINATELECOM-GUANGXI-NANNING-IDC CHINATELECOM Guangxi Nanning IDC networkdescr: NanningGuangxi Province) | |
8 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
od8v1wv.com
wsap.od8v1wv.com |
160 KB |
1 |
bdimg.com
apps.bdimg.com — Cisco Umbrella Rank: 165505 |
30 KB |
8 | 2 |
Domain | Requested by | |
---|---|---|
7 | wsap.od8v1wv.com |
wsap.od8v1wv.com
|
1 | apps.bdimg.com |
wsap.od8v1wv.com
|
8 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
od8v1wv.com GTS CA 1P5 |
2024-05-17 - 2024-08-15 |
3 months | crt.sh |
baidu.com GlobalSign RSA OV SSL CA 2018 |
2023-07-06 - 2024-08-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://wsap.od8v1wv.com/
Frame ID: B923C8ABEA7D5AC342876F950E3CC667
Requests: 8 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
wsap.od8v1wv.com/ |
729 B 785 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_O8c89b7d.js
wsap.od8v1wv.com/static/ |
69 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
apps.bdimg.com/libs/jquery/2.1.4/ |
82 KB 30 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_c540d417.js
wsap.od8v1wv.com/static/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_dc840bf3.css
wsap.od8v1wv.com/static/ |
223 KB 68 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_P6ee914b.css
wsap.od8v1wv.com/static/ |
251 KB 61 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_W13b6515.js
wsap.od8v1wv.com/static/ |
17 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
wsap.od8v1wv.com/ |
548 B 553 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| qrcanvas function| $ function| jQuery number| _0xodv function| _0x1fd0 function| _0xed26 function| _0x3083f1 string| version_ function| guid function| sock function| qrcode0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
apps.bdimg.com
wsap.od8v1wv.com
171.107.86.49
188.114.96.3
3f9972840683f831c51b485de796fd6e9516be3c9a2f972054125e100f989de3
5f8b5d9f95879500ab3ab790b6f05b11b45354d8ad6e3f705f78a346e2a44171
68881d617df0672e8673fd6f82e0187cda9f1f6b549d4fa4301eb85ce2289f51
afd6a5f6de40e9e67b55ff6afec66fff4827e775c996ab80c9e964a872a92523
c26794fb32c3bdd244843c5bc7783c0c864bbde03d641ab803d090c156fb72bf
cf51d68251261ee38e04efcb426ca3a0ef62978ed079107b3f78f927c863b7c6
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
de4b3c3d1dc2506b6693f0f98884e1dc074cda9d66cab39b7b48a115fdfc4c0f