urlscan.io logo urlscan.io
SecurityTrails logo

hoppergfw.com Open in urlscan Pro
95.142.46.185  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://hoppergfw.com/vu21/
Submission: On March 11 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 95.142.46.185, located in Moscow, Russian Federation and belongs to VDSINA-AS, RU. The main domain is hoppergfw.com.
TLS certificate: Issued by R3 on March 6th 2024. Valid for: 3 months.
This is the only time hoppergfw.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
9 95.142.46.185 48282 (VDSINA-AS)
10 2
Apex Domain
Subdomains		 Transfer
9 hoppergfw.com
hoppergfw.com
719 KB
10 1
Domain Requested by
9 hoppergfw.com hoppergfw.com
10 1

This site contains no links.

Subject Issuer Validity Valid
hoppergfw.com
R3		 2024-03-06 -
2024-06-04		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://hoppergfw.com/vu21/
Frame ID: 91EFCAF57DA2DC5E456E3B746E198F81
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

WhatsApp

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

10
Requests

90 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

719 kB
Transfer

727 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
hoppergfw.com/vu21/ 		1 KB
916 B 		Document
General
Check archive.org
Download Go to
Full URL
https://hoppergfw.com/vu21/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.142.46.185 Moscow, Russian Federation, ASN48282 (VDSINA-AS, RU),
Reverse DNS
v2366182.hosted-by-vdsina.ru
Software
stormwall /
Resource Hash
cf7d8437205c4270a56168b85b0c90380bbc1d7e2f833626f962b41d479d350a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
public, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 11 Mar 2024 13:22:07 GMT
etag
W/"552-18d84725570"
last-modified
Wed, 07 Feb 2024 16:41:42 GMT
server
stormwall
index-c0771505.js
hoppergfw.com/vu21/assets/ 		356 KB
356 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hoppergfw.com/vu21/assets/index-c0771505.js
Requested by
Host: hoppergfw.com
URL: https://hoppergfw.com/vu21/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.142.46.185 Moscow, Russian Federation, ASN48282 (VDSINA-AS, RU),
Reverse DNS
v2366182.hosted-by-vdsina.ru
Software
stormwall /
Resource Hash
6d273438090abd77e4c69a5ebc66b8fca864304ba0cf721221179cbd6d1e8cf8

Request headers

Referer
https://hoppergfw.com/vu21/
Origin
https://hoppergfw.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date
Mon, 11 Mar 2024 13:22:07 GMT
last-modified
Wed, 07 Feb 2024 16:41:42 GMT
server
stormwall
etag
W/"58e07-18d84725570"
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
364039
index-32a16973.css
hoppergfw.com/vu21/assets/ 		360 KB
361 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://hoppergfw.com/vu21/assets/index-32a16973.css
Requested by
Host: hoppergfw.com
URL: https://hoppergfw.com/vu21/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.142.46.185 Moscow, Russian Federation, ASN48282 (VDSINA-AS, RU),
Reverse DNS
v2366182.hosted-by-vdsina.ru
Software
stormwall /
Resource Hash
32a169731cd324d884e95964279be2d3aab6f582c6aded8635b2f58225d29fce

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hoppergfw.com/vu21/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date
Mon, 11 Mar 2024 13:22:07 GMT
last-modified
Wed, 07 Feb 2024 16:41:42 GMT
server
stormwall
etag
W/"5a12c-18d84725570"
content-type
text/css; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
368940
/
hoppergfw.com/socket.io/ 		118 B
269 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hoppergfw.com/socket.io/?type=phone&EIO=4&transport=polling&t=OujhNtc
Requested by
Host: hoppergfw.com
URL: https://hoppergfw.com/vu21/assets/index-c0771505.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.142.46.185 Moscow, Russian Federation, ASN48282 (VDSINA-AS, RU),
Reverse DNS
v2366182.hosted-by-vdsina.ru
Software
stormwall /
Resource Hash
c9a3da2490485724446c92af9b30e2a7632d12af34bb812c7940e431e8570e80

Request headers

Accept
*/*
Referer
https://hoppergfw.com/vu21/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin
http://localhost:5173
date
Mon, 11 Mar 2024 13:22:08 GMT
cache-control
no-store
server
stormwall
content-length
118
vary
Origin
content-type
text/plain; charset=UTF-8
b87f6cc6-a759-463b-87a1-8ea4f8c351a8
https://hoppergfw.com/ 		10 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://hoppergfw.com/b87f6cc6-a759-463b-87a1-8ea4f8c351a8
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2ca3d44191e822500b330ae74a7b981fddc94188da2e683a1e1508fd188d2b1b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Length
10285
Content-Type
/
hoppergfw.com/socket.io/ 		2 B
139 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hoppergfw.com/socket.io/?type=phone&EIO=4&transport=polling&t=OujhNx0&sid=vHSj2u_5lneVoazjAPaE
Requested by
Host: hoppergfw.com
URL: https://hoppergfw.com/vu21/assets/index-c0771505.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.142.46.185 Moscow, Russian Federation, ASN48282 (VDSINA-AS, RU),
Reverse DNS
v2366182.hosted-by-vdsina.ru
Software
stormwall /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Accept
*/*
Referer
https://hoppergfw.com/vu21/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
http://localhost:5173
date
Mon, 11 Mar 2024 13:22:08 GMT
cache-control
no-store
server
stormwall
content-length
2
vary
Origin
content-type
text/html
/
hoppergfw.com/socket.io/ 		32 B
182 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hoppergfw.com/socket.io/?type=phone&EIO=4&transport=polling&t=OujhNx1&sid=vHSj2u_5lneVoazjAPaE
Requested by
Host: hoppergfw.com
URL: https://hoppergfw.com/vu21/assets/index-c0771505.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.142.46.185 Moscow, Russian Federation, ASN48282 (VDSINA-AS, RU),
Reverse DNS
v2366182.hosted-by-vdsina.ru
Software
stormwall /
Resource Hash
07cbfff922dae26bfada784a1d3ac3472abe1726956464c2768cb7c7947398b1

Request headers

Accept
*/*
Referer
https://hoppergfw.com/vu21/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin
http://localhost:5173
date
Mon, 11 Mar 2024 13:22:08 GMT
cache-control
no-store
server
stormwall
content-length
32
vary
Origin
content-type
text/plain; charset=UTF-8
/
hoppergfw.com/socket.io/ 		175 B
326 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hoppergfw.com/socket.io/?type=phone&EIO=4&transport=polling&t=OujhN-N&sid=vHSj2u_5lneVoazjAPaE
Requested by
Host: hoppergfw.com
URL: https://hoppergfw.com/vu21/assets/index-c0771505.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.142.46.185 Moscow, Russian Federation, ASN48282 (VDSINA-AS, RU),
Reverse DNS
v2366182.hosted-by-vdsina.ru
Software
stormwall /
Resource Hash
f671d5f1a3b3954b1213c7c2eca29abdf91dd334e6d5060e1c8692ca054df498

Request headers

Accept
*/*
Referer
https://hoppergfw.com/vu21/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin
http://localhost:5173
date
Mon, 11 Mar 2024 13:22:09 GMT
cache-control
no-store
server
stormwall
content-length
175
vary
Origin
content-type
text/plain; charset=UTF-8
/
hoppergfw.com/socket.io/ 		2 B
139 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hoppergfw.com/socket.io/?type=phone&EIO=4&transport=polling&t=OujhN-N.0&sid=vHSj2u_5lneVoazjAPaE
Requested by
Host: hoppergfw.com
URL: https://hoppergfw.com/vu21/assets/index-c0771505.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.142.46.185 Moscow, Russian Federation, ASN48282 (VDSINA-AS, RU),
Reverse DNS
v2366182.hosted-by-vdsina.ru
Software
stormwall /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Accept
*/*
Referer
https://hoppergfw.com/vu21/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
Content-type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
http://localhost:5173
date
Mon, 11 Mar 2024 13:22:09 GMT
cache-control
no-store
server
stormwall
content-length
2
vary
Origin
content-type
text/html
/
hoppergfw.com/socket.io/ 		1 B
150 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hoppergfw.com/socket.io/?type=phone&EIO=4&transport=polling&t=OujhO1c&sid=vHSj2u_5lneVoazjAPaE
Requested by
Host: hoppergfw.com
URL: https://hoppergfw.com/vu21/assets/index-c0771505.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.142.46.185 Moscow, Russian Federation, ASN48282 (VDSINA-AS, RU),
Reverse DNS
v2366182.hosted-by-vdsina.ru
Software
stormwall /
Resource Hash
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683

Request headers

Accept
*/*
Referer
https://hoppergfw.com/vu21/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

access-control-allow-origin
http://localhost:5173
date
Mon, 11 Mar 2024 13:22:09 GMT
cache-control
no-store
server
stormwall
content-length
1
vary
Origin
content-type
text/plain; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| __VUE_HMR_RUNTIME__ object| __VUE_INSTANCE_SETTERS__ object| devtoolsFormatters object| fastLocalStorage boolean| __VUE__ object| __VUE_DEVTOOLS_HOOK_REPLAY__ object| __SENTRY__ object| __VUE_DEVTOOLS_PLUGINS__

1 Cookies

Domain/Path Name / Value
hoppergfw.com/ Name: Auth
Value: def8e701783fbbeda8e95917a4244d52