urlscan.io logo urlscan.io
SecurityTrails logo

whatsapplf.com Open in urlscan Pro
202.79.175.84  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://whatsapplf.com/
Submission: On February 19 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 12 HTTP transactions. The main IP is 202.79.175.84, located in Singapore and belongs to BCPL-SG BGPNET Global ASN, SG. The main domain is whatsapplf.com.
TLS certificate: Issued by R3 on February 18th 2023. Valid for: 3 months.
This is the only time whatsapplf.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
11 202.79.175.84 64050 (BCPL-SG B...)
12 2
Apex Domain
Subdomains		 Transfer
11 whatsapplf.com
whatsapplf.com
323 KB
0 whatsapp.com Failed
web.whatsapp.com Failed
12 2
Domain Requested by
11 whatsapplf.com whatsapplf.com
0 web.whatsapp.com Failed whatsapplf.com
12 2

This site contains links to these domains. Also see Links.

Domain
faq.whatsapp.com
Subject Issuer Validity Valid
whatsapplf.com
R3		 2023-02-18 -
2023-05-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://whatsapplf.com/
Frame ID: A62C643E3500E67683ECE0E84341AC5D
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

WhatsApp

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

92 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

397 kB
Transfer

1793 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
whatsapplf.com/ 		18 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
44c4ded3b51134feb96bb22670cf8e2af6b167348102a8f76f82912b88637346

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Sun, 19 Feb 2023 09:25:19 GMT
ETag
W/"63f09592-493c"
Last-Modified
Sat, 18 Feb 2023 09:08:34 GMT
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
stylex-2d46744708947781f1f33a0069cbc308.css
whatsapplf.com/WhatsApp_files/ 		114 KB
33 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://whatsapplf.com/WhatsApp_files/stylex-2d46744708947781f1f33a0069cbc308.css
Requested by
Host: whatsapplf.com
URL: https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
d3889a9a244c69018e4848bffa27b76845ca2c34813976342d4b122e6533bbca

Request headers

accept-language
en-US,en;q=0.9
Referer
https://whatsapplf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Sun, 19 Feb 2023 09:25:20 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Feb 2023 08:55:37 GMT
Server
nginx
ETag
W/"63f09289-1c673"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
bootstrap_qr-e2b403f65ed52d327e90.css
whatsapplf.com/WhatsApp_files/ 		173 KB
61 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://whatsapplf.com/WhatsApp_files/bootstrap_qr-e2b403f65ed52d327e90.css
Requested by
Host: whatsapplf.com
URL: https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
59d4eb8a3be2027e81bba7da480f0e087a5b97003767549737d40d5196d551cf

Request headers

accept-language
en-US,en;q=0.9
Referer
https://whatsapplf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Sun, 19 Feb 2023 09:25:20 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Feb 2023 08:55:37 GMT
Server
nginx
ETag
W/"63f09289-2b2be"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
bootstrap_main.9d6050e3d2fff5b782d3.css
whatsapplf.com/WhatsApp_files/ 		226 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://whatsapplf.com/WhatsApp_files/bootstrap_main.9d6050e3d2fff5b782d3.css
Requested by
Host: whatsapplf.com
URL: https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
9cbfd4f00c4210688faaecdace3d2877e5c789a7c8d06f1d0c49507b55de6a2b

Request headers

accept-language
en-US,en;q=0.9
Referer
https://whatsapplf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Sun, 19 Feb 2023 09:25:20 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Feb 2023 08:55:36 GMT
Server
nginx
ETag
W/"63f09288-38629"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
jquery.min.js
whatsapplf.com/ 		91 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://whatsapplf.com/jquery.min.js
Requested by
Host: whatsapplf.com
URL: https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
e0108076470765be9ef1e9b242b8a52ef78c8f4532c7263426abc05ea4b60240

Request headers

accept-language
en-US,en;q=0.9
Referer
https://whatsapplf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Sun, 19 Feb 2023 09:25:20 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Feb 2023 09:08:34 GMT
Server
nginx
ETag
W/"63f09592-16bab"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
jquery.cookie.js
whatsapplf.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://whatsapplf.com/jquery.cookie.js
Requested by
Host: whatsapplf.com
URL: https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
55c173330e36aaceaf268be4fe4421376a4e9eab4ce0de8e32aeb1c75f1181af

Request headers

accept-language
en-US,en;q=0.9
Referer
https://whatsapplf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Sun, 19 Feb 2023 09:25:20 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Feb 2023 09:08:34 GMT
Server
nginx
ETag
W/"63f09592-c30"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
qrcode.min.js
whatsapplf.com/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://whatsapplf.com/qrcode.min.js
Requested by
Host: whatsapplf.com
URL: https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36

Request headers

accept-language
en-US,en;q=0.9
Referer
https://whatsapplf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Sun, 19 Feb 2023 09:25:20 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Feb 2023 09:08:34 GMT
Server
nginx
ETag
W/"63f09592-4dd7"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
video.png
whatsapplf.com/WhatsApp_files/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://whatsapplf.com/WhatsApp_files/video.png
Requested by
Host: whatsapplf.com
URL: https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
d980ab372658f4c7c8f07d730ef6dc67e3fb3471f37928274f915c0308850994

Request headers

accept-language
en-US,en;q=0.9
Referer
https://whatsapplf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Sun, 19 Feb 2023 09:25:21 GMT
Last-Modified
Sat, 18 Feb 2023 08:55:37 GMT
Server
nginx
ETag
"63f09289-3f83"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16259
binary-transparency-manifest-2.2232.8.json
web.whatsapp.com/ 		0
0
libsignal-protocol-ee5b8ba.min.js
whatsapplf.com/WhatsApp_files/ 		244 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://whatsapplf.com/WhatsApp_files/libsignal-protocol-ee5b8ba.min.js
Requested by
Host: whatsapplf.com
URL: https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
b32cb4726155800367b1e44af2fd940b77aed84cc9baa11c0381bf35dd993c98

Request headers

accept-language
en-US,en;q=0.9
Referer
https://whatsapplf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Sun, 19 Feb 2023 09:25:21 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Feb 2023 08:55:37 GMT
Server
nginx
ETag
W/"63f09289-3d071"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
runtime.88c356058afe3d58a508.js
whatsapplf.com/WhatsApp_files/ 		15 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://whatsapplf.com/WhatsApp_files/runtime.88c356058afe3d58a508.js
Requested by
Host: whatsapplf.com
URL: https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
cd00a8ee12254d2285a82ea490590610a500c867831301e8d91884f93ca3c564

Request headers

accept-language
en-US,en;q=0.9
Referer
https://whatsapplf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Sun, 19 Feb 2023 09:25:21 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Feb 2023 08:55:37 GMT
Server
nginx
ETag
W/"63f09289-3d1f"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
whatsapp-webclient-login_c09223f0813e7c3adc16476cba2a5d0d.mp4
whatsapplf.com/WhatsApp_files/ 		800 KB
0 		Media
General
Check archive.org
Download Go to
Full URL
https://whatsapplf.com/WhatsApp_files/whatsapp-webclient-login_c09223f0813e7c3adc16476cba2a5d0d.mp4
Requested by
Host: whatsapplf.com
URL: https://whatsapplf.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
202.79.175.84 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://whatsapplf.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Range
bytes=0-

Response headers

Date
Sun, 19 Feb 2023 09:25:21 GMT
Last-Modified
Sat, 18 Feb 2023 08:55:37 GMT
Server
nginx
ETag
"63f09289-ff7b2"
Content-Type
video/mp4
Content-Range
bytes 0-1046449/1046450
Connection
keep-alive
Content-Length
1046450
truncated
/ 		75 KB
75 KB 		Other
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9462066cd31fa7927d08b725df1ef816ef2401a5f565649d6a053207f216877e

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type
application/octet-stream

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
web.whatsapp.com
URL
https://web.whatsapp.com/binary-transparency-manifest-2.2232.8.json

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery function| QRCode function| guid function| sock function| qrcode function| qrcode2 function| refreshqrcode boolean| systemThemeDark object| theme object| systemThemeMode object| systemTheme boolean| darkTheme object| libsignal object| dcodeIO object| webpackChunkwhatsapp_web_client

0 Cookies

3 Console Messages

Source Level URL
Text
javascript error URL: https://whatsapplf.com/
Message:
Access to link element resource at 'https://web.whatsapp.com/binary-transparency-manifest-2.2232.8.json' from origin 'https://whatsapplf.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://web.whatsapp.com/binary-transparency-manifest-2.2232.8.json
Message:
Failed to load resource: net::ERR_FAILED
javascript warning URL: https://whatsapplf.com/
Message:
The resource https://web.whatsapp.com/binary-transparency-manifest-2.2232.8.json was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.