www.wjtwlijle.top
Open in
urlscan Pro
104.233.164.16
Malicious Activity!
Public Scan
Submission: On December 21 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on December 19th 2023. Valid for: 3 months.
This is the only time www.wjtwlijle.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
16 | 104.233.164.16 104.233.164.16 | 398993 (PEG-TY) (PEG-TY) | |
2 | 203.107.86.226 203.107.86.226 | 37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.) | |
18 | 2 |
ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)
js.users.51.la | |
ia.51.la |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
wjtwlijle.top
www.wjtwlijle.top |
176 KB |
2 |
51.la
js.users.51.la — Cisco Umbrella Rank: 96686 ia.51.la — Cisco Umbrella Rank: 89111 |
3 KB |
18 | 2 |
Domain | Requested by | |
---|---|---|
16 | www.wjtwlijle.top |
www.wjtwlijle.top
|
1 | ia.51.la |
www.wjtwlijle.top
|
1 | js.users.51.la |
www.wjtwlijle.top
|
18 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
faq.whatsapp.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
wjshgvubkjh4.top R3 |
2023-12-19 - 2024-03-18 |
3 months | crt.sh |
*.users.51.la GlobalSign GCC R3 DV TLS CA 2020 |
2023-04-14 - 2024-05-15 |
a year | crt.sh |
*.51.la GlobalSign GCC R3 DV TLS CA 2020 |
2023-04-20 - 2024-05-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.wjtwlijle.top/
Frame ID: 4D0541B99093D827B0F4EECD17E7098C
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
WhatsAppDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Need login help?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
www.wjtwlijle.top/ |
25 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap_qr-097975c55a8af519e700.css
www.wjtwlijle.top/WhatsApp_files/ |
109 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap_main.css
www.wjtwlijle.top/WhatsApp_files/ |
242 KB 58 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshot.png
www.wjtwlijle.top/ |
905 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qr-video_07f8d2958696dceefa4f4676aeb4663e.jpg
www.wjtwlijle.top/WhatsApp_files/ |
27 KB 27 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
21808099.js
js.users.51.la/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qr-video_07f8d2958696dceefa4f4676aeb4663e.mp4
www.wjtwlijle.top/WhatsApp_files/ |
548 B 696 B |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qr-video_07f8d2958696dceefa4f4676aeb4663e.jpg
www.wjtwlijle.top/WhatsApp_files/ |
27 KB 27 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
go1
ia.51.la/ |
0 317 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshot.png
www.wjtwlijle.top/ |
905 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshot.png
www.wjtwlijle.top/ |
905 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshot.png
www.wjtwlijle.top/ |
905 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshot.png
www.wjtwlijle.top/ |
905 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshot.png
www.wjtwlijle.top/ |
905 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshot.png
www.wjtwlijle.top/ |
905 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshot.png
www.wjtwlijle.top/ |
905 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshot.png
www.wjtwlijle.top/ |
905 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshot.png
www.wjtwlijle.top/ |
905 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture boolean| systemThemeDark object| theme object| systemThemeMode object| systemTheme string| _0xodC object| _0xodC_ function| _0x577f string| version_ function| _0x30f72a function| _0xa2a9 function| _0x1825 object| video1 function| UrlExists function| CheckUrl object| _0x247e3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.wjtwlijle.top/ | Name: __tins__21808099 Value: %7B%22sid%22%3A%201703160980791%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201703162780791%7D |
|
www.wjtwlijle.top/ | Name: __51cke__ Value: |
|
www.wjtwlijle.top/ | Name: __51laig__ Value: 1 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ia.51.la
js.users.51.la
www.wjtwlijle.top
104.233.164.16
203.107.86.226
7a2418b8a2af62be25c4e308780fc92839a50a0f89fe1bc165d2ff7b591fcd58
9e59694b024814c8d9d7cd7509056b668246d69cae6ce8bc2a92bad550a07708
a1387ec03eb42d5b654678edfaa792ac1973c61b8120ec21b2c099b948b06ee8
a658da1f5e53913e7513c1c4297701586ccf6394cd559e7aa011a0ad7daccb00
b91a35b6798a4948fd43cfc5ed9c69f838e1a4da4b792cad783b004a9c91dd41
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f05faab37bf1d278981187857bff40ce2ae9f36a9fcce2135e080075a749d2a1