chat-whatsapq.com Open in urlscan Pro
119.18.58.130  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

• http://chat.whatssap.me/x_files/analytics.js.descarga HTTP 302
• http://ww1.whatssap.me/?subid1=5f70d79c-73d3-11eb-bb21-15b009830533 HTTP 301
• https://ww1.whatssap.me:8005/?subid1=5f70d79c-73d3-11eb-bb21-15b009830533

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/	22 KB 8 KB	646ms 467ms	Document text/html	119.18.58.130 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ Protocol HTTP/1.1 Server 119.18.58.130 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS vps.salesvilla.net Software Apache / Resource Hash 4872334957eef886e4b3368589ed699ee30259b2836ecf6fd0b805e158d72f6b Request headers Host chat-whatsapq.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 20 Feb 2021 23:28:43 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Vary Accept-Encoding Content-Encoding gzip Content-Length 8402 Keep-Alive timeout=5, max=75 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	stylesheet.css chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/	14 KB 5 KB	182ms 181ms	Stylesheet text/css	119.18.58.130 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/stylesheet.css Requested by Host: chat-whatsapq.com URL: http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ Protocol HTTP/1.1 Server 119.18.58.130 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS vps.salesvilla.net Software Apache / Resource Hash 1525ff682f8616316d31b26a6f38ce98c0c79bfec35f2ad35695ed41861e7206 Request headers Referer http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 20 Feb 2021 23:28:44 GMT Content-Encoding gzip Last-Modified Wed, 20 Jan 2021 16:08:11 GMT Server Apache Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=74 Content-Length 4612
GET		/ ww1.whatssap.me/ Redirect Chain http://chat.whatssap.me/x_files/analytics.js.descarga http://ww1.whatssap.me/?subid1=5f70d79c-73d3-11eb-bb21-15b009830533 https://ww1.whatssap.me:8005/?subid1=5f70d79c-73d3-11eb-bb21-15b009830533	0 0
GET H/1.1	200 OK	2.js Show response chat-whatsapq.com/KKaTCQxwG0rLBLu6PmZ7wQ/	93 KB 41 KB	356ms 327ms	Script application/javascript	119.18.58.130 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL http://chat-whatsapq.com/KKaTCQxwG0rLBLu6PmZ7wQ/2.js Requested by Host: chat-whatsapq.com URL: http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ Protocol HTTP/1.1 Server 119.18.58.130 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS vps.salesvilla.net Software Apache / Resource Hash 0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8 Request headers Referer http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 20 Feb 2021 23:28:44 GMT Content-Encoding gzip Last-Modified Sun, 18 Oct 2020 18:35:42 GMT Server Apache Vary Accept-Encoding Upgrade h2,h2c Transfer-Encoding chunked Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5, max=75
GET H/1.1	200 OK	1.js Show response chat-whatsapq.com/KKaTCQxwG0rLBLu6PmZ7wQ/	95 KB 42 KB	357ms 328ms	Script application/javascript	119.18.58.130 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL http://chat-whatsapq.com/KKaTCQxwG0rLBLu6PmZ7wQ/1.js Requested by Host: chat-whatsapq.com URL: http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ Protocol HTTP/1.1 Server 119.18.58.130 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS vps.salesvilla.net Software Apache / Resource Hash e76acb5d863d93580337e8a1f53b6ee086a2658f37dfeedd0ad6df8933a49be1 Request headers Referer http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 20 Feb 2021 23:28:44 GMT Content-Encoding gzip Last-Modified Sun, 18 Oct 2020 18:35:42 GMT Server Apache Vary Accept-Encoding Upgrade h2,h2c Transfer-Encoding chunked Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5, max=75
GET H/1.1	200 OK	3.js Show response chat-whatsapq.com/KKaTCQxwG0rLBLu6PmZ7wQ/	82 KB 37 KB	354ms 325ms	Script application/javascript	119.18.58.130 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL http://chat-whatsapq.com/KKaTCQxwG0rLBLu6PmZ7wQ/3.js Requested by Host: chat-whatsapq.com URL: http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ Protocol HTTP/1.1 Server 119.18.58.130 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS vps.salesvilla.net Software Apache / Resource Hash 22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5 Request headers Referer http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 20 Feb 2021 23:28:44 GMT Content-Encoding gzip Last-Modified Sun, 18 Oct 2020 18:35:42 GMT Server Apache Vary Accept-Encoding Upgrade h2,h2c Transfer-Encoding chunked Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5, max=75
GET H2	200	js Show response www.googletagmanager.com/gtag/	98 KB 38 KB	20ms 19ms	Script application/javascript	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-112019461-3 Requested by Host: chat-whatsapq.com URL: http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 76d857b6d9852a9a36029b54b041c4ec4214d63ebbd211d731ae5915b7c1ad6b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 20 Feb 2021 23:28:44 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39291 x-xss-protection 0 last-modified Sat, 20 Feb 2021 21:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sat, 20 Feb 2021 23:28:44 GMT
GET H/1.1	200 OK	30.png chat-whatsapq.com/D25bV7riWGi1q3xYYYxQey/i/	19 KB 20 KB	176ms 176ms	Image image/png	119.18.58.130 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Show image Full URL http://chat-whatsapq.com/D25bV7riWGi1q3xYYYxQey/i/30.png Requested by Host: chat-whatsapq.com URL: http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ Protocol HTTP/1.1 Server 119.18.58.130 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS vps.salesvilla.net Software Apache / Resource Hash 11a5a42df75dcbc52c1eb4446ba57222240dba7f2b39292d611433a019b6419f Request headers Referer http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 20 Feb 2021 23:28:44 GMT Last-Modified Tue, 12 Jan 2021 13:48:52 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=74 Content-Length 19803
GET H/1.1	404 Not Found	icon-chat.png chat-whatsapq.com/img/v4/invite/	741 B 741 B	176ms 176ms	Image text/html	119.18.58.130 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Show image Full URL http://chat-whatsapq.com/img/v4/invite/icon-chat.png Requested by Host: chat-whatsapq.com URL: http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/stylesheet.css Protocol HTTP/1.1 Server 119.18.58.130 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS vps.salesvilla.net Software Apache / Resource Hash 332dd04ae9deb819b7345e6f9d455c1b29b7f828cbb7d2a96afda1a9f3a6b48f Request headers Referer http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/stylesheet.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 20 Feb 2021 23:28:44 GMT Content-Encoding gzip Last-Modified Tue, 21 Apr 2020 19:03:45 GMT Server Apache Vary Accept-Encoding Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=74 Content-Length 457
GET DATA	200 OK	truncated /	157 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fb2ceb00d62c62740a0d175a3a943ce09a66c30c9eb8a6f98760f8bc774b182c Request headers Referer http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H2	200	analytics.js Show response www.google-analytics.com/	46 KB 19 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:80e::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-112019461-3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 05 Feb 2021 21:33:27 GMT server Golfe2 age 5852 date Sat, 20 Feb 2021 21:51:12 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18980 expires Sat, 20 Feb 2021 23:51:12 GMT
POST H3-Q050	200	collect Show response www.google-analytics.com/j/	1 B 67 B	13ms 12ms	XHR text/plain	2a00:1450:4001:80e::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j88&a=700505238&t=pageview&_s=1&dl=http%3A%2F%2Fchat-whatsapq.com%2F8PQRBAcCrR10E0cZSh4JIb%2F&ul=en-us&de=UTF-8&dt=Whatsapp%20Group%20Invite&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=100967730&gjid=1118767578&cid=1361603752.1613863725&tid=UA-112019461-3&_gid=864613763.1613863725&_r=1&gtm=2ou2a1&z=346873461 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Sat, 20 Feb 2021 23:28:44 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin http://chat-whatsapq.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

ww1.whatssap.me

URL

https://ww1.whatssap.me:8005/?subid1=5f70d79c-73d3-11eb-bb21-15b009830533

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| gtag object| dataLayer string| image_save_msg string| no_menu_msg string| smessage function| disableEnterKey function| disable_copy function| disable_copy_ie function| reEnable function| disableSelection function| nocontext object| _0xf3be object| _0xb070 object| objetos function| aleatorio object| rlink string| msgamigo number| shareCountG string| urlpubliMovil string| urlpubliPC string| msg function| setCookie function| getCookie number| c string| g function| fng function| random function| checkZero function| timer1 number| ii number| iy function| hidepop object| citas number| alea object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.chat-whatsapq.com/	1970-01-19 16:19:10	Name: _gid Value: GA1.2.864613763.1613863725
			.chat-whatsapq.com/	1970-01-19 16:17:43	Name: _gat_gtag_UA_112019461_3 Value: 1
			.chat-whatsapq.com/	1970-01-20 09:48:55	Name: _ga Value: GA1.2.1361603752.1613863725
			chat-whatsapq.com/8PQRBAcCrR10E0cZSh4JIb	1969-12-31 23:59:59	Name: invgrupo Value: 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

chat-whatsapq.com
ww1.whatssap.me
www.google-analytics.com
www.googletagmanager.com
ww1.whatssap.me
119.18.58.130
2a00:1450:4001:80e::200e
2a00:1450:4001:827::2008
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8
11a5a42df75dcbc52c1eb4446ba57222240dba7f2b39292d611433a019b6419f
1525ff682f8616316d31b26a6f38ce98c0c79bfec35f2ad35695ed41861e7206
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
332dd04ae9deb819b7345e6f9d455c1b29b7f828cbb7d2a96afda1a9f3a6b48f
4872334957eef886e4b3368589ed699ee30259b2836ecf6fd0b805e158d72f6b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
76d857b6d9852a9a36029b54b041c4ec4214d63ebbd211d731ae5915b7c1ad6b
e76acb5d863d93580337e8a1f53b6ee086a2658f37dfeedd0ad6df8933a49be1
fb2ceb00d62c62740a0d175a3a943ce09a66c30c9eb8a6f98760f8bc774b182c