3glite.wapka.co Open in urlscan Pro
2606:4700:3035::ac43:c30e Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://3glite.wapka.co/
Effective URL:
https://3glite.wapka.co/
Submission: On February 10 via automatic, source openphish (February 10th 2021, 1:26:13 am UTC)

Summary HTTP 13 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 10 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3035::ac43:c30e, located in United States and belongs to CLOUDFLARENET, US. The main domain is 3glite.wapka.co.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 20th 2020. Valid for: a year.

This is the only time 3glite.wapka.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 3	2606:4700:303... 2606:4700:3035::ac43:c30e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700:303... 2606:4700:3037::ac43:9af5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	88.208.60.53 88.208.60.53	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	2606:4700:303... 2606:4700:3033::6815:3d80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:e4:... 2606:4700:e4::ac40:ab26	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3031::ac43:a9a6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:b4a:1:7:... 2a02:b4a:1:7::9165:1	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
13	10

3 2606:4700:3035::ac43:c30e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

3glite.wapka.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.wapka.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::ac43:9af5 (United States)

ASN13335 (CLOUDFLARENET, US)

adstook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.208.60.53 (Heemstede, Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

pigtre.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::6815:3d80 (United States)

ASN13335 (CLOUDFLARENET, US)

dihlw.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e4::ac40:ab26 (United States)

ASN13335 (CLOUDFLARENET, US)

ndroip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::ac43:a9a6 (United States)

ASN13335 (CLOUDFLARENET, US)

msgose.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:b4a:1:7::9165:1 (Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

gejute.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	wapka.co 1 redirects 3glite.wapka.co m.wapka.co	5 KB
2	fbcdn.net static.xx.fbcdn.net	4 KB
1	gejute.com gejute.com	128 B
1	msgose.com msgose.com	35 KB
1	ndroip.com ndroip.com	18 KB
1	dihlw.com dihlw.com	4 KB
1	pigtre.com pigtre.com	2 KB
1	adstook.com adstook.com	908 B
1	facebook.com facebook.com	1 KB
0	tgpsew.com Failed tgpsew.com Failed
13	10

	Domain	Requested by
2	static.xx.fbcdn.net	3glite.wapka.co
2	3glite.wapka.co	1 redirects
1	gejute.com	msgose.com
1	msgose.com	m.wapka.co
1	ndroip.com	m.wapka.co
1	m.wapka.co	adstook.com
1	dihlw.com	pigtre.com
1	pigtre.com	adstook.com
1	adstook.com	3glite.wapka.co
1	facebook.com	3glite.wapka.co
0	tgpsew.com Failed	ndroip.com
13	11

This site contains links to these domains. Also see Links.

Domain
m.facebook.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-05-20` - `2021-05-20`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-12-22` - `2021-03-21`	3 months	crt.sh
*.pigtre.com ZeroSSL RSA Domain Secure Site CA	`2021-01-16` - `2021-04-16`	3 months	crt.sh
gejute.com ZeroSSL RSA Domain Secure Site CA	`2020-11-23` - `2021-02-21`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://3glite.wapka.co/
Frame ID: CB3F4A4BBDB3BD71C61DF5160F755E45
Requests: 7 HTTP requests in this frame

Frame: https://m.wapka.co/view.html
Frame ID: 39636B9B5B16E4F077C95D8B667F85F2
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://3glite.wapka.co/ HTTP 301
https://3glite.wapka.co/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

13
Requests

85 %
HTTPS

89 %
IPv6

10
Domains

11
Subdomains

10
IPs

3
Countries

72 kB
Transfer

192 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://m.facebook.com/click.php?redir_url=market%3A%2F%2Fdetails%3Fid%3Dcom.facebook.katana%26referrer%3Dutm_reg%253DeDILYPMUMaKwt-JbLxRyjXJ5%26referrer_params%255Blink_source%255D%3Dfb_app_banner&app_id=350685531728&cref=mb&no_fw=1&ref=dbl
Title: Get Facebook for Android and browse faster.

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://3glite.wapka.co/ HTTP 301
https://3glite.wapka.co/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
3glite.wapka.co/
Redirect Chain

http://3glite.wapka.co/
https://3glite.wapka.co/

13 KB
4 KB

354ms
324ms

Document
text/html

2606:4700:3035::ac43:c30e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3glite.wapka.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c30e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.2.24
Resource Hash: 6d0cd8b946829f4d52736356525df028346b2aa42f229c4de2c88aa6f8dd2a6c

Request headers

:method: GET
:authority: 3glite.wapka.co
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 10 Feb 2021 01:25:58 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d62f94b20630db3d9c13e253eb243f93a1612920357; expires=Fri, 12-Mar-21 01:25:57 GMT; path=/; domain=.wapka.co; HttpOnly; SameSite=Lax; Secure WAPKASID=1rk0v58qhqntnhi6abd3p16k8v; path=/; HttpOnly
x-powered-by: PHP/7.2.24
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
cf-request-id: 082b249b4700004c860239a000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Y0mGfBtvPDYwdj3x4cw12RnJU%2B0g5XCvR9Q5K%2FbjhyiMgC6t6va2NRTvwZV3GNfFMmzItUa0O9qXE32QCTdJ%2B%2Br7bEAmzN8t9mV1ubpZRkiCQlTRp4JiNO3nBs0%3D"}],"max_age":604800,"group":"cf-nel"}
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
cf-ray: 61f20a0b9bbe4c86-AMS
content-encoding: br

Redirect headers

Date: Wed, 10 Feb 2021 01:25:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Wed, 10 Feb 2021 02:25:57 GMT
Location: https://3glite.wapka.co/
cf-request-id: 082b249b0600001ed6941f6000000001
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lGn%2B62A8wqkBdYY8DAtZkZp4B7nbCXMK4EFkPgNPqLh21oPbWx4sB04ZEbbi6kzT1hr%2BS62VTm1lkeOFsm11PPfDUF8LP4d7tS7fjikFVXPw1wV04Je%2FMonrOwg%3D"}]}
NEL: {"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 61f20a0b3d0e1ed6-AMS

GET
H2 200 5Zo8s-IGqA1.png
static.xx.fbcdn.net/rsrc.php/v3/y9/r/ 2 KB
2 KB 21ms
6ms Image
image/png 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y9/r/5Zo8s-IGqA1.png

Requested by

Host: 3glite.wapka.co
URL: https://3glite.wapka.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e7462a872d669b5a590c8a2af2222deebb5b883e4878df400a13fc97976011b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://3glite.wapka.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: UKf849sxskE5MpoICQzrjcrlCsM5TqLPFZpia8i6D2J0FfRhMTtSwjf8XynSoUmBPMf4N6dfkrY85Fv5UY40Jw==
x-fb-trip-id: 686109401
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: CLDNjV9SLxnv1bA0Zl2XdQ==
date: Wed, 10 Feb 2021 01:25:58 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1595
x-fb-rlafr: 0
expires: Thu, 03 Feb 2022 19:31:18 GMT

GET
H2 200 WsF6oBbTpTq.png
static.xx.fbcdn.net/rsrc.php/v3/yh/r/ 2 KB
3 KB 21ms
7ms Image
image/png 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/WsF6oBbTpTq.png

Requested by

Host: 3glite.wapka.co
URL: https://3glite.wapka.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9984c0da813619f2ee395a4c8e7843a23d77a2339f14cfb75302bb7c6adb7f2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://3glite.wapka.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: AhQJtpo/KArTQs57PS+L2ndfSz1dnNEqN02zwMfhudDMD/4Bry+FznhjB84R1SA1Y/3ZZ3PsUmPMCm5tbjNYng==
x-fb-trip-id: 686109401
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: 4TJIu59Jgu+KzOAgulS6TQ==
date: Wed, 10 Feb 2021 01:25:58 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 2406
x-fb-rlafr: 0
expires: Thu, 03 Feb 2022 23:20:29 GMT

GET
H2 200 hsts-pixel.gif
facebook.com/security/ 43 B
1 KB 40ms
25ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://facebook.com/security/hsts-pixel.gif

Requested by

Host: 3glite.wapka.co
URL: https://3glite.wapka.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com data: blob: 'self';script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: attachment.fbsbx.com blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://3glite.wapka.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: no-cache
x-fb-debug: 60lFQqWYvjNufJpOPlQlurhFH5/Hd4dvjvtczCTEE1cxlPvs0vnHOyFAGYkBpcI432YKh2Ibz6Kh4fsSvsFeTw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT
date: Wed, 10 Feb 2021 01:25:58 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: image/gif
access-control-allow-origin: *
vary: Origin, Accept-Encoding
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-fb-rlafr: 0
content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
access-control-expose-headers: X-FB-Debug, X-Loader-Length

GET
H2 200 lib.js Show response
adstook.com/wapka/ 461 B
908 B 74ms
24ms Script
application/javascript 2606:4700:3037::ac43:9af5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adstook.com/wapka/lib.js
Requested by: Host: 3glite.wapka.co
URL: https://3glite.wapka.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:9af5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8daab1a0ee701f9fe88b410bada56f62aa332e0ebc4f0432f94d9b47661549e1

Request headers

Referer: https://3glite.wapka.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 10 Feb 2021 01:25:58 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
server: cloudflare
age: 33465
cf-polished: origSize=1663
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9Yv%2BfGpnB6F6yBszGEkGHX8Vh6FX5zMMANBfxYavKKRX3%2Fz2mzhkOQxoT2R01o2%2FN7SxDWW4fZPyIvTTzjmQ8dFVmH2Mxb2ZPfqCdPKNEkrKhWMAw1nfhw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 61f20a0e2a54fa84-AMS
cf-request-id: 082b249cdb0000fa84338d4000000001

GET
H2 200 native.js Show response
pigtre.com/code/ 6 KB
2 KB 49ms
18ms Script
application/javascript 88.208.60.53
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pigtre.com/code/native.js?h=waWQiOjEwNjQ1OTksInNpZCI6MTA2OTI5OCwid2lkIjoxMzkwODcsInNyYyI6Mn0=eyJ
Requested by: Host: adstook.com
URL: https://adstook.com/wapka/lib.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 88.208.60.53 Heemstede, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.17.3 /
Resource Hash: 3d6add2ba0133319af717f5032bd574259c50d418aac66f328582b7efd921904

Request headers

Referer: https://3glite.wapka.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: https://3glite.wapka.co
date: Wed, 10 Feb 2021 01:25:58 GMT
content-encoding: gzip
server: nginx/1.17.3
x-zone: eu
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8

GET
H2 200 sdk.js Show response
dihlw.com/v1/ 11 KB
4 KB 68ms
27ms Script
application/javascript 2606:4700:3033::6815:3d80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dihlw.com/v1/sdk.js?h=waWQiOjEwNjQ1OTksInNpZCI6MTA2OTI5OCwid2lkIjoxMzkwODcsInNyYyI6Mn0=eyJ&d=wapka.io&sw=wevasw.js
Requested by: Host: pigtre.com
URL: https://pigtre.com/code/native.js?h=waWQiOjEwNjQ1OTksInNpZCI6MTA2OTI5OCwid2lkIjoxMzkwODcsInNyYyI6Mn0=eyJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:3d80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d616cc49fd81471147466156e25fa9dc84609db8ce3f4f523944ec804892683

Request headers

Referer: https://3glite.wapka.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 10 Feb 2021 01:25:58 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1591
x-zone: eu
cf-request-id: 082b249d5800004c26912f8000000001
server: cloudflare
etag: W/"PJHHL41mKvDm4aDsasHZf9aeOic"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7138q2KIsLKaQpTFp5pn8Z%2F38iys5JwDxFn4IlLNZFl8evQ22XTnDKyKuXymNMztPFd3ExOwo3nHPNVe0XlwkUmmwhsw4spnvPhfz0Y5FqAKihdda4M%3D"}],"group":"cf-nel"}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: https://wapka.io
cache-control: public, max-age=14400
cf-ray: 61f20a0efcd14c26-AMS

GET
H2 200 view.html Show response
m.wapka.co/ Frame 3963 584 B
530 B 46ms
30ms Document
text/html 2606:4700:3035::ac43:c30e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://m.wapka.co/view.html
Requested by: Host: adstook.com
URL: https://adstook.com/wapka/lib.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c30e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9457b44d28ff9a9afa05ce2553ca0afbecbcc900a03a3f0c266261a77f8a86bf

Request headers

:method: GET
:authority: m.wapka.co
:scheme: https
:path: /view.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3glite.wapka.co/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=d62f94b20630db3d9c13e253eb243f93a1612920357
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://3glite.wapka.co/

Response headers

date: Wed, 10 Feb 2021 01:25:58 GMT
content-type: text/html
last-modified: Thu, 04 Feb 2021 15:19:17 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 082b249d8600004c86acb29000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MEB7bqMJXJ2cBPqNa8n96iR%2FJv%2BfAZFCy71NRmcqAC5tlKlQcf4XNKQBN8o%2BW0b0BxcOUf%2F%2F%2FNhGBjr5ILDgRBJV0zVzcC4usD5KFud2mHt6e4RY4948"}],"max_age":604800,"group":"cf-nel"}
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
cf-ray: 61f20a0f3a484c86-AMS
content-encoding: br

GET
H2 200 waWQiOjEwNjQ1OTksInNpZCI6MTA4Mjc2NSwid2lkIjoxNjgwODMsInNyYyI6Mn0=eyJ.js Show response
ndroip.com/na/ Frame 3963 55 KB
18 KB 56ms
25ms Script
application/javascript 2606:4700:e4::ac40:ab26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ndroip.com/na/waWQiOjEwNjQ1OTksInNpZCI6MTA4Mjc2NSwid2lkIjoxNjgwODMsInNyYyI6Mn0=eyJ.js
Requested by: Host: m.wapka.co
URL: https://m.wapka.co/view.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:ab26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43146ca653db46054f4e057b1843f0dce75e26f82961ac35d39013877d4128a4

Request headers

Referer: https://m.wapka.co/view.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 10 Feb 2021 01:25:58 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
e-tag: e50dc3f92c1beb814bead44ed7554084
age: 1249
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fDcj1WsjhPuDqaraBfFVag%2FMGJjjDtRgUP77h39DveJ%2FRhZQ%2F3vAX27EthiCfrzXgaIeG9jaNI7rV2VUs7DB8NtsrjBDlgCXRTaJSlIiKzSzYg%2F2%2FYvK"}]}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: https://m.wapka.co
cache-control: public, max-age=14400, proxy-revalidate
cf-ray: 61f20a0fab841eda-AMS
cf-request-id: 082b249dc900001eda1b3cc000000001

GET
H2 200 waWQiOjEwNjQ1OTksInNpZCI6MTA4Mjc2NSwid2lkIjoxNjgwODIsInNyYyI6Mn0=eyJ.js Show response
msgose.com/pw/ Frame 3963 102 KB
35 KB 55ms
23ms Script
application/javascript 2606:4700:3031::ac43:a9a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://msgose.com/pw/waWQiOjEwNjQ1OTksInNpZCI6MTA4Mjc2NSwid2lkIjoxNjgwODIsInNyYyI6Mn0=eyJ.js
Requested by: Host: m.wapka.co
URL: https://m.wapka.co/view.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:a9a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ecdd626af24d72cff7be3d507df08dc8c3f7cc019fff57fdd8b273ae1ab58d5

Request headers

Referer: https://m.wapka.co/view.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 10 Feb 2021 01:25:58 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
e-tag: f8a958a89fa95b41e4ad1709d9636e69
age: 1267
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=OaZ%2BSdej9ChekxlsdGK7xGrV%2FYIdaUhlWpGRt4Kh4Eo%2FGgmBXlB%2F%2BGLoZ5UfjFxJj69v82nsdg1D3eovyDWnD0GDO4PXbRvD6whWsne4KnxaRNa780ze"}],"group":"cf-nel"}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: https://m.wapka.co
cache-control: max-age=14400
cf-ray: 61f20a0fa8b61ec6-AMS
cf-request-id: 082b249dc900001ec6cf82d000000001

GET ntload
tgpsew.com/ Frame 3963 0
0

GET
H2 200 wnload Show response
gejute.com/ Frame 3963 0
128 B 41ms
13ms Fetch
application/javascript 2a02:b4a:1:7::9165:1
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://gejute.com/wnload?a=1&e=aeyJwaWQiOjEwNjQ1OTksInNpZCI6MTA4Mjc2NSwid2lkIjoxNjgwODIsImQiOiJtLndhcGthLmNvIiwibGkiOjF9&tz=1&if=1
Requested by: Host: msgose.com
URL: https://msgose.com/pw/waWQiOjEwNjQ1OTksInNpZCI6MTA4Mjc2NSwid2lkIjoxNjgwODIsInNyYyI6Mn0=eyJ.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 2a02:b4a:1:7::9165:1 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://m.wapka.co/view.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 10 Feb 2021 01:25:58 GMT
access-control-allow-credentials: true
server: nginx/1.18.0
content-length: 0
content-type: application/javascript; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: tgpsew.com
URL: https://tgpsew.com/ntload?a=1&e=aeyJwaWQiOjEwNjQ1OTksInNpZCI6MTA4Mjc2NSwid2lkIjoxNjgwODMsImQiOiJtLndhcGthLmNvIiwibGkiOjZ9&tz=1&if=1

Domain: tgpsew.com
URL: https://tgpsew.com/ntload?a=1&e=aeyJwaWQiOjEwNjQ1OTksInNpZCI6MTA4Mjc2NSwid2lkIjoxNjgwODMsImQiOiJtLndhcGthLmNvIiwibGkiOjZ9&tz=1&if=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			3glite.wapka.co/	1969-12-31 23:59:59	Name: WAPKASID Value: 1rk0v58qhqntnhi6abd3p16k8v
			.wapka.co/	1970-01-19 16:45:12	Name: __cfduid Value: d62f94b20630db3d9c13e253eb243f93a1612920357

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3glite.wapka.co
adstook.com
dihlw.com
facebook.com
gejute.com
m.wapka.co
msgose.com
ndroip.com
pigtre.com
static.xx.fbcdn.net
tgpsew.com
tgpsew.com
2606:4700:3031::ac43:a9a6
2606:4700:3033::6815:3d80
2606:4700:3035::ac43:c30e
2606:4700:3037::ac43:9af5
2606:4700:e4::ac40:ab26
2a02:b4a:1:7::9165:1
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
88.208.60.53
3d6add2ba0133319af717f5032bd574259c50d418aac66f328582b7efd921904
43146ca653db46054f4e057b1843f0dce75e26f82961ac35d39013877d4128a4
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
6d0cd8b946829f4d52736356525df028346b2aa42f229c4de2c88aa6f8dd2a6c
8daab1a0ee701f9fe88b410bada56f62aa332e0ebc4f0432f94d9b47661549e1
8ecdd626af24d72cff7be3d507df08dc8c3f7cc019fff57fdd8b273ae1ab58d5
9457b44d28ff9a9afa05ce2553ca0afbecbcc900a03a3f0c266261a77f8a86bf
9984c0da813619f2ee395a4c8e7843a23d77a2339f14cfb75302bb7c6adb7f2d
9d616cc49fd81471147466156e25fa9dc84609db8ce3f4f523944ec804892683
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7462a872d669b5a590c8a2af2222deebb5b883e4878df400a13fc97976011b3

3glite.wapka.co Open in urlscan Pro 2606:4700:3035::ac43:c30e Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

85 %HTTPS

89 %IPv6

10 Domains

11 Subdomains

10 IPs

3 Countries

72 kBTransfer

192 kBSize

2 Cookies

1 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

2 Cookies

Indicators

3glite.wapka.co Open in urlscan Pro
2606:4700:3035::ac43:c30e Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

85 %
HTTPS

89 %
IPv6

10
Domains

11
Subdomains

10
IPs

3
Countries

72 kB
Transfer

192 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!