![](/screenshots/07f55e67-da5b-4266-bef1-050a57128b33.png)
ttw.whatsaptk.cyou
Open in
urlscan Pro
172.67.188.92
Malicious Activity!
Public Scan
Effective URL: https://ttw.whatsaptk.cyou/
Submission: On June 22 via api from US — Scanned from DE
Summary
TLS certificate: Issued by WE1 on June 18th 2024. Valid for: 3 months.
This is the only time ttw.whatsaptk.cyou was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 172.67.188.92 172.67.188.92 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
whatsaptk.cyou
ttw.whatsaptk.cyou |
209 KB |
10 | 1 |
Domain | Requested by | |
---|---|---|
10 | ttw.whatsaptk.cyou |
ttw.whatsaptk.cyou
|
10 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
whatsaptk.cyou WE1 |
2024-06-18 - 2024-09-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ttw.whatsaptk.cyou/
Frame ID: 3342895201FEF74DFD383C64B8BF74DE
Requests: 12 HTTP requests in this frame
Screenshot
![](/screenshots/07f55e67-da5b-4266-bef1-050a57128b33.png)
Page Title
QR code LoginPage URL History Show full URLs
-
http://ttw.whatsaptk.cyou/
HTTP 307
https://ttw.whatsaptk.cyou/ Page URL
Detected technologies
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ttw.whatsaptk.cyou/
HTTP 307
https://ttw.whatsaptk.cyou/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
ttw.whatsaptk.cyou/ Redirect Chain
|
1 KB 948 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
b81f3f69.css
ttw.whatsaptk.cyou/static/css/ |
1 KB 891 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ed74c755.css
ttw.whatsaptk.cyou/static/css/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d35de392.js
ttw.whatsaptk.cyou/static/js/ |
24 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f31354d5.js
ttw.whatsaptk.cyou/static/js/ |
517 KB 165 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
8cb0399b.css
ttw.whatsaptk.cyou/static/css/ |
0 675 B |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
c65a02c0.js
ttw.whatsaptk.cyou/static/js/ |
0 24 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
efb0b0c2.js
ttw.whatsaptk.cyou/static/js/ |
0 4 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
c65a02c0.js
ttw.whatsaptk.cyou/static/js/ |
82 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
ttw.whatsaptk.cyou/ |
787 B 1 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
85 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| a3_0x368856 function| a3_0x100a63 function| a3_0x5017d7 function| a3_0x399d function| a3_0x5c139e function| a3_0x3d7b function| a3_0x5c4ff3 object| webpackJsonp function| a0_0x1133 function| a0_0x5396 function| _0x11cd3a object| $cookies function| a1_0x5a05 function| a1_0x3f03 function| a1_0x1c805f function| a1_0x231591 function| a1_0x1eca59 function| a1_0x4fc022 function| a1_0x3cb7ec0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ttw.whatsaptk.cyou
172.67.188.92
099a36d4c6594642d2d794431e94712b85599b6960e122b7c1e76b2362a4aff6
49ef8f9f3383ce25457cfa17d4f11e1c76e6bc21856c85f6f6a1888f142be5d7
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
6ad47184b37f307576748d5c619b3c760fc87ecb0f7916b5b427e1a30a0fd25c
759dc14a647618bcae5099437c89998c28a2828fd56784bf1ce88edea1c037fa
8c366f0448ef28db6b2daac87ff13dfa80867c321a10bb65cc4ca7965c087f41
d0cadf240e89340b93df35240e7809039c1c574be05fbe2cf3243e2f487bc9ec
daac8e3f25c1b9279e7027201b648fe7c60d3d0617a5ea96c658a03cef09b76a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eae74f3767a11fc1b6accf9aa631fd71018ddc92f82e2b7bea85778f0db479db