www.chat-whatasqp.com Open in urlscan Pro
108.167.181.244 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
Submission: On April 16 via automatic, source openphish (April 16th 2021, 1:35:40 pm UTC)

Summary HTTP 11 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 5 domains to perform 11 HTTP transactions. The main IP is 108.167.181.244, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is www.chat-whatasqp.com.

This is the only time www.chat-whatasqp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
6	108.167.181.244 108.167.181.244	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1 1	37.48.65.150 37.48.65.150	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	13.248.148.254 13.248.148.254	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
1	119.18.58.130 119.18.58.130	394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
11	6

6 108.167.181.244 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 108-167-181-244.unifiedlayer.com

www.chat-whatasqp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
chat-whatasqp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.48.65.150 (Vinkeveen, Netherlands) 1 redirects

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

chat.whatssap.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.248.148.254 (United States)

ASN16509 (AMAZON-02, US)
PTR: aba1c1ff9d2ec5376.awsglobalaccelerator.com

ww1.whatssap.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 119.18.58.130 (India)

ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
PTR: vps.salesvilla.net

whatsappgroupslinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	chat-whatasqp.com www.chat-whatasqp.com chat-whatasqp.com	134 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	whatssap.me 1 redirects chat.whatssap.me ww1.whatssap.me	396 B
1	whatsappgroupslinks.com whatsappgroupslinks.com	19 KB
1	googletagmanager.com www.googletagmanager.com	37 KB
11	5

	Domain	Requested by
3	chat-whatasqp.com	www.chat-whatasqp.com
3	www.chat-whatasqp.com	www.chat-whatasqp.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	whatsappgroupslinks.com	www.chat-whatasqp.com
1	www.googletagmanager.com	www.chat-whatasqp.com
1	ww1.whatssap.me	www.chat-whatasqp.com
1	chat.whatssap.me	1 redirects
11	7

This site contains links to these domains. Also see Links.

Domain
translate.whatsapp.com

Subject Issuer	Validity	Valid
*.google-analytics.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
Frame ID: 9FDBA68607540FA4BBBC751048D698CA
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

11
Requests

27 %
HTTPS

33 %
IPv6

5
Domains

7
Subdomains

6
IPs

4
Countries

208 kB
Transfer

464 kB
Size

4
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://translate.whatsapp.com/
Title: Help translate WhatsApp into your language

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://chat.whatssap.me/x_files/analytics.js.descarga HTTP 302
http://ww1.whatssap.me/?subid1=96558d60-9eb8-11eb-805f-3de8bcdbe47c

11 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/ 21 KB
8 KB 802ms
496ms Document
text/html 108.167.181.244
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
Protocol: HTTP/1.1
Server: 108.167.181.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 108-167-181-244.unifiedlayer.com
Software: nginx/1.19.5 /
Resource Hash: 55eda04780e8f3bb1d5ab1b7f7e863e101762482ac1bb5a746953c45d5116a55

Request headers

Host: www.chat-whatasqp.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 16 Apr 2021 13:35:19 GMT
Server: nginx/1.19.5
Content-Type: text/html; charset=UTF-8
Content-Length: 8308
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
X-Server-Cache: false

GET
H/1.1 200
OK stylesheet.css
www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/ 14 KB
5 KB 170ms
168ms Stylesheet
text/css 108.167.181.244
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/stylesheet.css
Requested by: Host: www.chat-whatasqp.com
URL: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
Protocol: HTTP/1.1
Server: 108.167.181.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 108-167-181-244.unifiedlayer.com
Software: nginx/1.19.5 /
Resource Hash: 1525ff682f8616316d31b26a6f38ce98c0c79bfec35f2ad35695ed41861e7206

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.chat-whatasqp.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 16 Apr 2021 13:35:19 GMT
Content-Encoding: gzip
Last-Modified: Thu, 08 Apr 2021 07:21:55 GMT
Server: nginx/1.19.5
X-Server-Cache: false
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 4612

GET
H/1.1

200
OK

/ Show response
ww1.whatssap.me/
Redirect Chain

http://chat.whatssap.me/x_files/analytics.js.descarga
http://ww1.whatssap.me/?subid1=96558d60-9eb8-11eb-805f-3de8bcdbe47c

0
0

1278ms
362ms

Script
text/html

13.248.148.254
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://ww1.whatssap.me/?subid1=96558d60-9eb8-11eb-805f-3de8bcdbe47c
Requested by: Host: www.chat-whatasqp.com
URL: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
Protocol: HTTP/1.1
Server: 13.248.148.254 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aba1c1ff9d2ec5376.awsglobalaccelerator.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.chat-whatasqp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

location: http://ww1.whatssap.me/?subid1=96558d60-9eb8-11eb-805f-3de8bcdbe47c
date: Fri, 16 Apr 2021 13:35:19 GMT
cache-control: max-age=0, private, must-revalidate
server: nginx
connection: close
content-length: 11

GET
H/1.1 200
OK 2.js Show response
chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/ 93 KB
41 KB 293ms
272ms Script
application/javascript 108.167.181.244
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/2.js
Requested by: Host: www.chat-whatasqp.com
URL: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
Protocol: HTTP/1.1
Server: 108.167.181.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 108-167-181-244.unifiedlayer.com
Software: nginx/1.19.5 /
Resource Hash: 0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8

Request headers

Referer: http://www.chat-whatasqp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 16 Apr 2021 13:35:19 GMT
Content-Encoding: gzip
Last-Modified: Thu, 08 Apr 2021 07:21:55 GMT
Server: nginx/1.19.5
X-Server-Cache: false
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Transfer-Encoding: chunked
Accept-Ranges: bytes

GET
H/1.1 200
OK 1.js Show response
chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/ 95 KB
42 KB 311ms
290ms Script
application/javascript 108.167.181.244
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/1.js
Requested by: Host: www.chat-whatasqp.com
URL: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
Protocol: HTTP/1.1
Server: 108.167.181.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 108-167-181-244.unifiedlayer.com
Software: nginx/1.19.5 /
Resource Hash: e76acb5d863d93580337e8a1f53b6ee086a2658f37dfeedd0ad6df8933a49be1

Request headers

Referer: http://www.chat-whatasqp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 16 Apr 2021 13:35:20 GMT
Content-Encoding: gzip
Last-Modified: Thu, 08 Apr 2021 07:21:55 GMT
Server: nginx/1.19.5
X-Server-Cache: false
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Transfer-Encoding: chunked
Accept-Ranges: bytes

GET
H/1.1 200
OK 3.js Show response
chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/ 82 KB
37 KB 323ms
301ms Script
application/javascript 108.167.181.244
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/3.js
Requested by: Host: www.chat-whatasqp.com
URL: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
Protocol: HTTP/1.1
Server: 108.167.181.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 108-167-181-244.unifiedlayer.com
Software: nginx/1.19.5 /
Resource Hash: 22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5

Request headers

Referer: http://www.chat-whatasqp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 16 Apr 2021 13:35:20 GMT
Content-Encoding: gzip
Last-Modified: Thu, 08 Apr 2021 07:21:55 GMT
Server: nginx/1.19.5
X-Server-Cache: false
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Transfer-Encoding: chunked
Accept-Ranges: bytes

GET
H3-29 200 js Show response
www.googletagmanager.com/gtag/ 93 KB
37 KB 34ms
32ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-112019461-2

Requested by

Host: www.chat-whatasqp.com
URL: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cc7f32d27487ea758db210116b7309102bf8df9764e35ebcdf7f30eb52f57c8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: http://www.chat-whatasqp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 16 Apr 2021 13:35:20 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37442
x-xss-protection: 0
last-modified: Fri, 16 Apr 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 16 Apr 2021 13:35:20 GMT

GET
H/1.1 200
OK 7.png
whatsappgroupslinks.com/im/ 19 KB
19 KB 530ms
363ms Image
image/png 119.18.58.130
PUBLIC-DOMAIN-REG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://whatsappgroupslinks.com/im/7.png
Requested by: Host: www.chat-whatasqp.com
URL: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/
Protocol: HTTP/1.1
Server: 119.18.58.130 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS: vps.salesvilla.net
Software: Apache /
Resource Hash: 5961a827c539489b64fd6c288949aa8515e902436e3cba9ff339e1fd68680009

Request headers

Referer: http://www.chat-whatasqp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 16 Apr 2021 13:35:20 GMT
Last-Modified: Tue, 13 Apr 2021 07:10:07 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=5, max=75
Content-Length: 19055

GET
H/1.1 404
Not Found icon-chat.png
www.chat-whatasqp.com/img/v4/invite/ 746 B
746 B 164ms
162ms Image
text/html 108.167.181.244
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.chat-whatasqp.com/img/v4/invite/icon-chat.png
Requested by: Host: www.chat-whatasqp.com
URL: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/stylesheet.css
Protocol: HTTP/1.1
Server: 108.167.181.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 108-167-181-244.unifiedlayer.com
Software: nginx/1.19.5 /
Resource Hash: 63c52aa99ca361b59a27e7f51fe5fadffef99e671f8b4f9560fab204219e0666

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.chat-whatasqp.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/stylesheet.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j/stylesheet.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 16 Apr 2021 13:35:20 GMT
Content-Encoding: gzip
Last-Modified: Tue, 23 Apr 2019 06:55:28 GMT
Server: nginx/1.19.5
Vary: Accept-Encoding
Content-Type: text/html
Accept-Ranges: bytes
Content-Length: 462

GET
DATA 200
OK truncated
/ 157 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb2ceb00d62c62740a0d175a3a943ce09a66c30c9eb8a6f98760f8bc774b182c

Request headers

Referer: http://www.chat-whatasqp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 8ms
5ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-112019461-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.chat-whatasqp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 19 Mar 2021 19:22:18 GMT
server: Golfe2
age: 6111
date: Fri, 16 Apr 2021 11:53:29 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19463
expires: Fri, 16 Apr 2021 13:53:29 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 13ms
12ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j89&a=302374899&t=pageview&_s=1&dl=http%3A%2F%2Fwww.chat-whatasqp.com%2FGmpC7iTEl5y85Zu22Fj53j%2F&ul=en-us&de=UTF-8&dt=Whatsapp%20Group%20Invite&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1015645857&gjid=1596894179&cid=502785948.1618580121&tid=UA-112019461-2&_gid=1987093267.1618580121&_r=1&gtm=2ou472&z=30196574

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.chat-whatasqp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 16 Apr 2021 13:35:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://www.chat-whatasqp.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

50 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.chat-whatasqp.com/	1970-01-19 17:36:20	Name: _gat_gtag_UA_112019461_2 Value: 1
.chat-whatasqp.com/	1970-01-19 17:37:46	Name: _gid Value: GA1.2.1987093267.1618580121
.chat-whatasqp.com/	1970-01-20 11:07:32	Name: _ga Value: GA1.2.502785948.1618580121
www.chat-whatasqp.com/GmpC7iTEl5y85Zu22Fj53j	1969-12-31 23:59:59	Name: invgrupo Value: 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

chat-whatasqp.com
chat.whatssap.me
whatsappgroupslinks.com
ww1.whatssap.me
www.chat-whatasqp.com
www.google-analytics.com
www.googletagmanager.com
108.167.181.244
119.18.58.130
13.248.148.254
2a00:1450:4001:810::200e
2a00:1450:4001:82b::2008
37.48.65.150
0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8
1525ff682f8616316d31b26a6f38ce98c0c79bfec35f2ad35695ed41861e7206
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
55eda04780e8f3bb1d5ab1b7f7e863e101762482ac1bb5a746953c45d5116a55
5961a827c539489b64fd6c288949aa8515e902436e3cba9ff339e1fd68680009
63c52aa99ca361b59a27e7f51fe5fadffef99e671f8b4f9560fab204219e0666
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
cc7f32d27487ea758db210116b7309102bf8df9764e35ebcdf7f30eb52f57c8a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e76acb5d863d93580337e8a1f53b6ee086a2658f37dfeedd0ad6df8933a49be1
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4
fb2ceb00d62c62740a0d175a3a943ce09a66c30c9eb8a6f98760f8bc774b182c

www.chat-whatasqp.com Open in urlscan Pro 108.167.181.244 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

27 %HTTPS

33 %IPv6

5 Domains

7 Subdomains

6 IPs

4 Countries

208 kBTransfer

464 kBSize

4 Cookies

1 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

50 JavaScript Global Variables

4 Cookies

Indicators

www.chat-whatasqp.com Open in urlscan Pro
108.167.181.244 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

27 %
HTTPS

33 %
IPv6

5
Domains

7
Subdomains

6
IPs

4
Countries

208 kB
Transfer

464 kB
Size

4
Cookies

11 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!