nuevowhats.app
76.76.21.21  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
URL:
https://nuevowhats.app/ 3yr old
Submission: On August 17 via api (August 17th 2026, 2:05:05 am UTC) from BE — Scanned from ES Go Pro

Only in urlscan Pro

  • Select different country locations for Private Scans.
  • Use a global network of additional scanning locations and residential IPs for scanning.
  • Interact with pages while you are scanning them.
  • Download files from remote websites.
  • Scan websites on the Tor Network.
Click for more information
Free trials of urlscan Pro are available.
Summary HTTP 4 Redirects  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 76.76.21.21, located in Walnut, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is nuevowhats.app. 3yr old
TLS certificate: Issued by YR2 on July 26th 2026. Valid for: 3mo.
This is the only time nuevowhats.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
3 76.76.21.21 76.76.21.21 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 136.243.156.168 136.243.156.168 24940 (HETZNER-A...) (HETZNER-AS Hetzner Online GmbH)
4 2
Apex Domain
Subdomains		 Transfer
3 nuevowhats.app
nuevowhats.app 3yr old
95 KB
1 ip-api.io
ip-api.io — Cisco Umbrella Rank: 655324 9yr old
318 B
4 2
Domain Requested by
3 nuevowhats.app nuevowhats.app
1 ip-api.io nuevowhats.app
4 2

This site contains no links.

Subject Issuer Validity Valid
nuevowhats.app
YR2		 2026-07-26 -
2026-10-24		 3mo crt.sh
ip-api.io
YR1		 2026-07-02 -
2026-09-30		 3mo crt.sh

This page contains 1 frames:

Primary Page: https://nuevowhats.app/
Frame ID: 9886E2801D1CCB6C7E87FCB207FD7E25
Requests: 4 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.
Full Image

Page Title

Enviar mensajes a WhatsApp sin registrar el número

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

96 kB
Transfer

119 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.
0 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H2 		200
 Primary Request / Show response
nuevowhats.app/ 		25 KB
6 KB 		521ms
110ms 		Document
text/html		 76.76.21.21
Amazon.com
General
Check archive.org
Download Go to
Full URL
https://nuevowhats.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Vercel /
Resource Hash
91c2f65f6f70a770c4f023708269977df41957c1ba318c41396c7a8126a337e3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

access-control-allow-origin
*
age
472182
cache-control
public, max-age=0, must-revalidate
content-disposition
inline
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 17 Aug 2026 02:05:09 GMT
etag
W/"c613e5ba8360c7533e91a97d36617e56"
last-modified
Tue, 11 Aug 2026 14:55:26 GMT
server
Vercel
strict-transport-security
max-age=63072000
x-vercel-cache
HIT
x-vercel-id
cdg1::bzfgc-1786932309081-62e3921d0d9f
GET
H2 		200
 index.cae7b532.css
nuevowhats.app/_astro/ 		8 KB
3 KB 		115ms
70ms 		Stylesheet
text/css		 76.76.21.21
Amazon.com
General
Check archive.org
Download Go to
Full URL
https://nuevowhats.app/_astro/index.cae7b532.css
Requested by
Host: nuevowhats.app
URL: https://nuevowhats.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Vercel /
Resource Hash
cae7b5325019fe7c1bbc289f1426ea1994bf2205148ebe9c9ca82f4273f1cdd2
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://nuevowhats.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=63072000
cache-control
public, max-age=31536000, immutable
content-encoding
br
x-vercel-cache
HIT
etag
W/"d4cf8bc9583dec0ade8b621737a48c89"
age
215974
access-control-allow-origin
*
date
Mon, 17 Aug 2026 02:05:09 GMT
content-disposition
inline; filename="index.cae7b532.css"
content-type
text/css; charset=utf-8
server
Vercel
last-modified
Fri, 14 Aug 2026 14:05:35 GMT
x-vercel-id
cdg1::dfwrd-1786932309268-678920aa759e
GET
H2 		401
 / Show response
ip-api.io/json/ 		79 B
318 B 		376ms
81ms 		Fetch
text/plain		 136.243.156.168
HETZNER-AS Hetzne...
General
Check archive.org
Download Go to
Full URL
https://ip-api.io/json/
Requested by
Host: nuevowhats.app
URL: https://nuevowhats.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
136.243.156.168 Falkenstein, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS
ip-api.io
Software
/
Resource Hash
ef3018a0fa08e6b7cbb5e818e64c5da526f6d7f3aa117358d8af521597794219
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://nuevowhats.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
public, max-age=3600
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
79
date
Mon, 17 Aug 2026 02:05:09 GMT
x-xss-protection
0
content-type
text/plain;charset=UTF-8
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Referer
x-frame-options
DENY
GET
H2 		200
 nuevowhats.png
nuevowhats.app/ 		86 KB
87 KB 		84ms
79ms 		Image
image/png		 76.76.21.21
Amazon.com
General
Check archive.org
Download Go to Show image
Full URL
https://nuevowhats.app/nuevowhats.png
Requested by
Host: nuevowhats.app
URL: https://nuevowhats.app/_astro/index.cae7b532.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.21 Walnut, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Vercel /
Resource Hash
b0fa502976056ad9b9613c59d1f264b70da06afe9f3a03321602dfeb1575b158
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://nuevowhats.app/_astro/index.cae7b532.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=63072000
cache-control
public, max-age=0, must-revalidate
x-vercel-cache
HIT
etag
"a4be512e7195b6b733d9110b408f075d"
age
215973
accept-ranges
bytes
access-control-allow-origin
*
content-length
88534
date
Mon, 17 Aug 2026 02:05:09 GMT
content-disposition
inline; filename="nuevowhats.png"
content-type
image/png
server
Vercel
last-modified
Fri, 14 Aug 2026 14:05:35 GMT
x-vercel-id
cdg1::qr2t6-1786932309367-ef3066cf4fb6

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger) Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.
Click for more information
Free trials of urlscan Pro are available.

1 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| fence

0 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
network error URL: https://ip-api.io/json/
Message:
Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000