zzx.gtapssrppyy.cyou
Open in
urlscan Pro
188.114.96.3
Malicious Activity!
Public Scan
Submission: On October 22 via manual from HK — Scanned from PT
Summary
TLS certificate: Issued by GTS CA 1P5 on October 8th 2023. Valid for: 3 months.
This is the only time zzx.gtapssrppyy.cyou was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.21.15.57 104.21.15.57 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
gtapssrppyy.cyou
zzx.gtapssrppyy.cyou |
175 KB |
1 |
zongrep1.icu
sas.zongrep1.icu |
8 KB |
9 | 2 |
Domain | Requested by | |
---|---|---|
8 | zzx.gtapssrppyy.cyou |
zzx.gtapssrppyy.cyou
|
1 | sas.zongrep1.icu |
zzx.gtapssrppyy.cyou
|
9 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
gtapssrppyy.cyou GTS CA 1P5 |
2023-10-08 - 2024-01-06 |
3 months | crt.sh |
sas.zongrep1.icu GTS CA 1P5 |
2023-10-19 - 2024-01-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://zzx.gtapssrppyy.cyou/
Frame ID: 03273097B56CBEA998127D19114B3F68
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
WhatsAppDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
zzx.gtapssrppyy.cyou/ |
9 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stylex.css
zzx.gtapssrppyy.cyou/static/ |
114 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.css
zzx.gtapssrppyy.cyou/static/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap_qr.css
zzx.gtapssrppyy.cyou/static/ |
195 KB 55 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap_main.css
zzx.gtapssrppyy.cyou/static/ |
225 KB 44 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
zzx.gtapssrppyy.cyou/jQuery/ |
91 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.cookie.js
zzx.gtapssrppyy.cyou/jQuery/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
QO4bRJJ0R8RoyZCT1wtNDWasIfengzi.js
sas.zongrep1.icu/ |
18 KB 8 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qrcode.min.js
zzx.gtapssrppyy.cyou/jQuery/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
85 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| version_ function| _0x351f42 function| _0x30110c function| _0x1dbc function| guid function| sock function| _0x3959 function| qrcode function| refreshqrcode function| _0x5bc3eb function| QRCode0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
sas.zongrep1.icu
zzx.gtapssrppyy.cyou
104.21.15.57
188.114.96.3
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
55c173330e36aaceaf268be4fe4421376a4e9eab4ce0de8e32aeb1c75f1181af
588e6de98f73252990ccfe27af1810d5409ec7e905569fbf482abe30489d386d
5f95a290990daa0e2a906bb28fe4bd14211e570ac1b3d120e05ec4566c0246d1
6cf9d93792cdfccd76c36adea0894dc980c336960ee4f0da3acaaa775beb0a6d
9e2e0202b22eb293bdd7c2bb4931b43c8c143bb9cbcf57f9d9e251dc908d40f8
b30ace8966e51f663cd50a51315c5963ace8d931e5a0aca87e7491c466fb8e95
c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36
d3889a9a244c69018e4848bffa27b76845ca2c34813976342d4b122e6533bbca
e0108076470765be9ef1e9b242b8a52ef78c8f4532c7263426abc05ea4b60240
f30fa83cd51dc0dee27ef099447686b30f5d0eabb88bd7826472353321f1c582