![](/screenshots/66a98342-5d94-4a96-a838-a3845a0d35d8.png)
qpyyds.1jhbdr.top
Open in
urlscan Pro
104.21.87.168
Malicious Activity!
Public Scan
Submission: On October 22 via manual from HK — Scanned from PT
Summary
TLS certificate: Issued by E1 on October 20th 2023. Valid for: 3 months.
This is the only time qpyyds.1jhbdr.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 104.21.87.168 104.21.87.168 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 163.181.56.225 163.181.56.225 | 24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.) | |
2 | 47.246.46.206 47.246.46.206 | 24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.) | |
1 | 203.107.86.226 203.107.86.226 | 37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.) | |
1 | 172.67.134.59 172.67.134.59 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 6 |
ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)
cdn.staticfile.org |
ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)
collect-v6.51.la |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
1jhbdr.top
qpyyds.1jhbdr.top |
147 KB |
3 |
51.la
sdk.51.la — Cisco Umbrella Rank: 63196 collect-v6.51.la — Cisco Umbrella Rank: 58204 |
35 KB |
1 |
lawrencework.com
8srv.lawrencework.com |
2 KB |
1 |
staticfile.org
cdn.staticfile.org — Cisco Umbrella Rank: 66016 |
33 KB |
0 |
whatsapp.com
Failed
web.whatsapp.com Failed |
|
14 | 5 |
Domain | Requested by | |
---|---|---|
7 | qpyyds.1jhbdr.top |
qpyyds.1jhbdr.top
cdn.staticfile.org |
2 | sdk.51.la |
qpyyds.1jhbdr.top
sdk.51.la |
1 | 8srv.lawrencework.com | |
1 | collect-v6.51.la |
sdk.51.la
|
1 | cdn.staticfile.org |
qpyyds.1jhbdr.top
|
0 | web.whatsapp.com Failed |
qpyyds.1jhbdr.top
|
14 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
wss.f8ddcc.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
1jhbdr.top E1 |
2023-10-20 - 2024-01-18 |
3 months | crt.sh |
*.staticfile.org GeoTrust RSA CN CA G2 |
2023-09-08 - 2024-10-04 |
a year | crt.sh |
*.51.la GlobalSign GCC R3 DV TLS CA 2020 |
2023-04-20 - 2024-05-21 |
a year | crt.sh |
lawrencework.com GTS CA 1P5 |
2023-10-22 - 2024-01-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://qpyyds.1jhbdr.top/
Frame ID: BB075B870062E1B1FFEC61A9E9CA309B
Requests: 14 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: WhatsApp 客户端下载
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
qpyyds.1jhbdr.top/ |
16 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
cdn.staticfile.org/jquery/1.10.2/ |
91 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js-sdk-pro.min.js
sdk.51.la/ |
34 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stylex-ce269a9819ee8f292840728689a22cc5.css
qpyyds.1jhbdr.top/WhatsApp_files/ |
175 KB 43 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-6d34864fd47903428794.css
qpyyds.1jhbdr.top/WhatsApp_files/ |
187 KB 56 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main~.b66100b3486cd1857cd3.css
qpyyds.1jhbdr.top/WhatsApp_files/ |
21 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.fdf0caa2786c3269572d.css
qpyyds.1jhbdr.top/WhatsApp_files/ |
150 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
binary-transparency-manifest-2.2325.3.json
web.whatsapp.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
qpyyds.1jhbdr.top/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
collect
collect-v6.51.la/v6/ |
0 517 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js-sdk-event.min.js
sdk.51.la/event/ |
74 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
fk.php
qpyyds.1jhbdr.top/ |
7 B 465 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
65a7dbbd-8f8a-4866-8e16-2c9580c76d4a.png
8srv.lawrencework.com/qrcodes/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
65a7dbbd-8f8a-4866-8e16-2c9580c76d4a.png
8srv.lawrencework.com/qrcodes/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- web.whatsapp.com
- URL
- https://web.whatsapp.com/binary-transparency-manifest-2.2325.3.json
- Domain
- 8srv.lawrencework.com
- URL
- https://8srv.lawrencework.com/qrcodes/65a7dbbd-8f8a-4866-8e16-2c9580c76d4a.png?1697994863555
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)29 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| LA number| laWaitTime function| guid function| getUUID string| uuid boolean| systemThemeDark object| theme object| systemThemeMode object| systemTheme boolean| darkTheme function| version_ function| _0x2f5769 string| srv number| i_referer number| isEnable function| _0x2bd3 function| _0x4469 function| xorEncryptDecrypt object| ws function| status_callback function| refershQrCode boolean| webdriver string| domain function| LASel object| json number| code string| qrcode_text4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
qpyyds.1jhbdr.top/ | Name: __vtins__3GJDBXA8NtZNVDdc Value: %7B%22sid%22%3A%20%22c4cda131-1d45-5124-8611-5c1bc0ffc583%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201697996659482%2C%20%22ct%22%3A%201697994859482%7D |
|
qpyyds.1jhbdr.top/ | Name: __51uvsct__3GJDBXA8NtZNVDdc Value: 1 |
|
qpyyds.1jhbdr.top/ | Name: __51vcke__3GJDBXA8NtZNVDdc Value: 6a15e2f8-c069-5f62-b084-55b4797169ad |
|
qpyyds.1jhbdr.top/ | Name: __51vuft__3GJDBXA8NtZNVDdc Value: 1697994859487 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
8srv.lawrencework.com
cdn.staticfile.org
collect-v6.51.la
qpyyds.1jhbdr.top
sdk.51.la
web.whatsapp.com
8srv.lawrencework.com
web.whatsapp.com
104.21.87.168
163.181.56.225
172.67.134.59
203.107.86.226
47.246.46.206
16a2b9a2188a6e3f63da07b8fb33aa1a2d274506ca2aaffc96cf3a81557e2555
2cb4b1431b84ec15d35ed83bb927e27e8967d75f4bcd9cc4b25c8d879ae23e18
69acbe3d7c92af1a509b7351cabfac35b356c18eef8c9299f5ac354acfdba079
6fc5249c37fcfcf7dedc3ffae27b212f7f2eb44b9032ed9436c67e1e64ef28bd
775fafc214e32a36e2a39e694322fed097e37d964c9dce65663655b64492d068
79acde4aa0ad3feafd96271141640066d0c52c050724b13272b1ca3d6930f8d1
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
8a636dbd66666f13902713e7bc7d2e1cab497b299f533495759a2c68c459c5a4
927638eed00ada53b754ddd8c200a30ed317d3606f5219d553b2c84eaf992041
c1b4be0b3ea997d411dd62df26481703ff5296a11c57db8cdefdb2a869a900f5
d1f1bfe698f2ffb7b3e7a885a301d58f9554d45df0a31c3e8b53c84b33c80d27
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855