cp.whasiozp.com Open in urlscan Pro
172.67.148.1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwim_cKJ6P6AAxVX2BYFHUdNAIgYABABGgJ0bA&gclid=EAIaIQobChMIpv3Ciej-gAMVV9...
Effective URL:
https://cp.whasiozp.com/
Submission: On August 28 via manual (August 28th 2023, 7:19:27 am UTC) from HK — Scanned from IS

Summary HTTP 23 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 8 domains to perform 23 HTTP transactions. The main IP is 172.67.148.1, located in and belongs to . The main domain is cp.whasiozp.com.
TLS certificate: Issued by GTS CA 1P5 on July 2nd 2023. Valid for: 3 months.

This is the only time cp.whasiozp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
1 1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
8	172.67.197.1 172.67.197.1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	163.181.56.225 163.181.56.225	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
1	104.21.45.65 104.21.45.65	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.148.1 172.67.148.1	() ()
23	5

1 142.250.186.34 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.67.197.1 (United States)

ASN13335 (CLOUDFLARENET, US)

cweb.wworwy.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.181.56.225 (Frankfurt am Main, Germany)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

cdn.staticfile.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.45.65 (None, )

ASN13335 (CLOUDFLARENET, US)

8srv.anscxnyfrtg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.148.1 (None, )

ASN- ()

cp.whasiozp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	wworwy.club cweb.wworwy.club	168 KB
1	whasiozp.com cp.whasiozp.com
1	anscxnyfrtg.com 8srv.anscxnyfrtg.com	2 KB
1	staticfile.org cdn.staticfile.org — Cisco Umbrella Rank: 63118	33 KB
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 150	725 B
0	whatoppjku.com Failed qingtian.whatoppjku.com Failed
0	elemecdn.com Failed npm.elemecdn.com Failed
0	whatsapp.com Failed web.whatsapp.com Failed
23	8

	Domain	Requested by
8	cweb.wworwy.club	cweb.wworwy.club
1	cp.whasiozp.com	cweb.wworwy.club cp.whasiozp.com
1	8srv.anscxnyfrtg.com
1	cdn.staticfile.org	cweb.wworwy.club
1	www.googleadservices.com	1 redirects
0	qingtian.whatoppjku.com Failed	cp.whasiozp.com
0	npm.elemecdn.com Failed	cp.whasiozp.com
0	web.whatsapp.com Failed	cweb.wworwy.club
23	8

This site contains no links.

Subject Issuer	Validity	Valid
wworwy.club GTS CA 1P5	`2023-08-26` - `2023-11-24`	3 months	crt.sh
*.staticfile.org GeoTrust RSA CN CA G2	`2022-09-05` - `2023-10-03`	a year	crt.sh
anscxnyfrtg.com GTS CA 1P5	`2023-08-04` - `2023-11-02`	3 months	crt.sh
whasiozp.com GTS CA 1P5	`2023-07-02` - `2023-09-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cp.whasiozp.com/
Frame ID: 5C5F7F66A1659E16982C984A28606F12
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwim_cKJ6P6AAxVX2BYFHUdNAIgYABABGgJ0bA&gclid=EAIaIQ... HTTP 302
https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE Page URL
https://cp.whasiozp.com/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

23
Requests

48 %
HTTPS

0 %
IPv6

8
Domains

8
Subdomains

5
IPs

3
Countries

203 kB
Transfer

702 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwim_cKJ6P6AAxVX2BYFHUdNAIgYABABGgJ0bA&gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE&ohost=www.google.com&cid=CAASJeRonJ08dy40Kq7iDhLaLyR4FYgCVFhj9ZS6NREcqOgEn2iL7pg&sig=AOD64_2Cyrx6hxtYcNBdVhdxUwlHWjpjAQ&q&adurl&ved=2ahUKEwi6wL2J6P6AAxWqgFYBHU7FCc8Q0Qx6BAgMEAE HTTP 302
https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE Page URL
https://cp.whasiozp.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwim_cKJ6P6AAxVX2BYFHUdNAIgYABABGgJ0bA&gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE&ohost=www.google.com&cid=CAASJeRonJ08dy40Kq7iDhLaLyR4FYgCVFhj9ZS6NREcqOgEn2iL7pg&sig=AOD64_2Cyrx6hxtYcNBdVhdxUwlHWjpjAQ&q&adurl&ved=2ahUKEwi6wL2J6P6AAxWqgFYBHU7FCc8Q0Qx6BAgMEAE HTTP 302
https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
cweb.wworwy.club/
Redirect Chain

https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwim_cKJ6P6AAxVX2BYFHUdNAIgYABABGgJ0bA&gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE&ohost=www.google.com&cid=CAASJeRonJ08d...
https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE

25 KB
10 KB

696ms
440ms

Document
text/html

172.67.197.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3ff129e3a49744ad0c045eb6fe06737d02930eed78b99cfd7cabfe7af7bfea9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7fdac913b956af3f-KEF
content-encoding: br
content-type: text/html
date: Mon, 28 Aug 2023 07:19:21 GMT
last-modified: Sat, 26 Aug 2023 12:57:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ggfQCs4Xer8wlGRrnMo9RCQCKgJ%2Bmla%2B5vjLZ%2B4vDpdN9M2zW4E2ACAVARwbFgwkm%2FmZtpw6qrP7bxDu1D0Z7r3TxhOI88eQ2VK7AubaDEg8kjUx%2BnlOteyJAtLPn1iM2pRI"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

accept-ch: Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Bitness Sec-CH-UA-Full-Version-List Sec-CH-UA-WoW64
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 28 Aug 2023 07:19:20 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://cweb.wworwy.club?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
p3p: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: adclick_server
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK jquery.min.js Show response
cdn.staticfile.org/jquery/1.10.2/ 91 KB
33 KB 688ms
109ms Script
application/javascript 163.181.56.225
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.staticfile.org/jquery/1.10.2/jquery.min.js
Requested by: Host: cweb.wworwy.club
URL: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 163.181.56.225 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://cweb.wworwy.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

X-Log: X-Log
Date: Sun, 27 Aug 2023 13:21:48 GMT
Via: cache23.l2de2[400,399,304-0,M], cache7.l2de2[401,0], ens-cache4.de4[0,0,200-0,H], ens-cache2.de4[2,0]
Content-Encoding: gzip
X-Svr: IO
X-Reqid: IiQAAACoevUjQH8X
Age: 64653
X-Swift-CacheTime: 86400
X-Cache: HIT TCP_MEM_HIT dirn:9:61661242
Content-Transfer-Encoding: binary
Content-Disposition: inline; filename="jquery.min.js"; filename*=utf-8''jquery.min.js
Connection: keep-alive
X-Swift-SaveTime: Sun, 27 Aug 2023 13:21:48 GMT
Content-Length: 32989
Last-Modified: Tue, 16 Feb 2016 04:22:54 GMT
Server: Tengine
Etag: "FuLzYD4jcR9kRvJ4pBHZBWI9ZSAe.gz"
Access-Control-Max-Age: 2592000
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Ali-Swift-Global-Savetime: 1693142508
Access-Control-Expose-Headers: X-Log, X-Reqid
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
X-Qiniu-Zone: 0
Timing-Allow-Origin: *
EagleId: 2ff62b1a16932071619307572e

GET
H2 404 qrcode.min.js
cweb.wworwy.club/ 0
0 441ms
439ms Script
text/html 172.67.197.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cweb.wworwy.club/qrcode.min.js
Requested by: Host: cweb.wworwy.club
URL: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 07:19:21 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=79sDNXzsZPDVWmQn7BLr%2B%2BaRB1mF9g3rdJ7mhwhBPk1BmvAtSWY1f940QYypWzLxjbBNhXmxbH01jMmGkC6m98WE9PXCpTLWAqb9HNPFFr2a%2FL142G%2FxHYtKDhlhqnXroy9o"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 7fdac9168a45af3f-KEF
alt-svc: h3=":443"; ma=86400

GET
H2 200 stylex-ce269a9819ee8f292840728689a22cc5.css
cweb.wworwy.club/WhatsApp_files/ 175 KB
43 KB 811ms
810ms Stylesheet
text/css 172.67.197.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cweb.wworwy.club/WhatsApp_files/stylex-ce269a9819ee8f292840728689a22cc5.css
Requested by: Host: cweb.wworwy.club
URL: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 775fafc214e32a36e2a39e694322fed097e37d964c9dce65663655b64492d068

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 07:19:22 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 17 Aug 2023 19:04:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64de6f2e-2bb72"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5eAnB5By53r3O0p6PTP5ai3WqMhUlDKvY0Ct69PQzsIsriaLNFv3SIVP7adrNKQ74cIXGjVKSo9ysi%2B5p9jK9Vi0PyiXj3tbliaCllMfjRF%2F72f%2BH0vDlF4LRW4HMgvPRqfh"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 7fdac9168a46af3f-KEF
alt-svc: h3=":443"; ma=86400
expires: Mon, 28 Aug 2023 19:19:21 GMT

GET
H2 200 app-6d34864fd47903428794.css
cweb.wworwy.club/WhatsApp_files/ 187 KB
57 KB 797ms
797ms Stylesheet
text/css 172.67.197.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cweb.wworwy.club/WhatsApp_files/app-6d34864fd47903428794.css
Requested by: Host: cweb.wworwy.club
URL: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 69acbe3d7c92af1a509b7351cabfac35b356c18eef8c9299f5ac354acfdba079

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 07:19:22 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 17 Aug 2023 19:04:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64de6f26-2eab4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ngaH8KroIIl1zmgaHzu9gevbkdSiQmx98ea22svOIS3nChe%2BhXgZpT8GrIkLLPRu6h2OclBOHB%2FhqCtBxyKcgHyMJKR9mMqY5enSf02nACiq67ZRweo45BOte9KbHWa46Rbc"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 7fdac9168a47af3f-KEF
alt-svc: h3=":443"; ma=86400
expires: Mon, 28 Aug 2023 19:19:21 GMT

GET
H2 200 main~.b66100b3486cd1857cd3.css
cweb.wworwy.club/WhatsApp_files/ 21 KB
5 KB 444ms
443ms Stylesheet
text/css 172.67.197.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cweb.wworwy.club/WhatsApp_files/main~.b66100b3486cd1857cd3.css
Requested by: Host: cweb.wworwy.club
URL: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a636dbd66666f13902713e7bc7d2e1cab497b299f533495759a2c68c459c5a4

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 07:19:21 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 17 Aug 2023 19:04:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64de6f2c-55b9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kM0knNoh7oFfkAED7N0%2B6P8QTfDPUJPSOaInumXOJNEizX4k55TNjZqZ1UDp%2F9owrXV3O6M0DmMQrtGUwwQOqDYa1g6bjWPEjyGBZmHs03TxF2w4yapz2YHpcztvMZ6JIefd"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 7fdac9168a48af3f-KEF
alt-svc: h3=":443"; ma=86400
expires: Mon, 28 Aug 2023 19:19:21 GMT

GET
H2 200 main.fdf0caa2786c3269572d.css
cweb.wworwy.club/WhatsApp_files/ 150 KB
30 KB 613ms
613ms Stylesheet
text/css 172.67.197.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cweb.wworwy.club/WhatsApp_files/main.fdf0caa2786c3269572d.css
Requested by: Host: cweb.wworwy.club
URL: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79acde4aa0ad3feafd96271141640066d0c52c050724b13272b1ca3d6930f8d1

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 07:19:21 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 17 Aug 2023 19:04:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64de6f2c-257df"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zeYbcPyPpgV%2FxTYsrWCUYY%2BzG3MI6a2LhU%2FGFbnmTC8CKcCZHEvwGniOpShejuT9g82b5SmPa%2FaugO95inABYRcY31eeh5z61F%2B%2B7zZglpdbvxAq2faEZROv22HevqW6OrEO"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 7fdac9168a49af3f-KEF
alt-svc: h3=":443"; ma=86400
expires: Mon, 28 Aug 2023 19:19:21 GMT

GET
H2 200 qr-video_0c6ec69b054fdeb31cf3e5e10290fd8e.png
cweb.wworwy.club/WhatsApp_files/ 16 KB
16 KB 616ms
616ms Image
image/png 172.67.197.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cweb.wworwy.club/WhatsApp_files/qr-video_0c6ec69b054fdeb31cf3e5e10290fd8e.png
Requested by: Host: cweb.wworwy.club
URL: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d980ab372658f4c7c8f07d730ef6dc67e3fb3471f37928274f915c0308850994

Request headers

Referer: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
Origin: https://cweb.wworwy.club
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 07:19:22 GMT
cf-cache-status: MISS
last-modified: Thu, 17 Aug 2023 19:04:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "64de6f2d-3f83"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UeWZS%2FRCGTkN0zDAsWcSum9WBRfpxv5q0lAI%2FxwY3iUHWVTMZ91RgehPAbkmbFbJt8%2BV%2FfD2Xr9L8AttvVIdf6atIovVWq44XI8lTQMoisZrS4H9K7N7MWfIUPSCDOkj55mF"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7fdac91bebfcaf3f-KEF
alt-svc: h3=":443"; ma=86400
content-length: 16259
expires: Wed, 27 Sep 2023 07:19:22 GMT

GET binary-transparency-manifest-2.2325.3.json
web.whatsapp.com/ 0
0

GET
H2 200 main.js Show response
cweb.wworwy.club/ 24 KB
8 KB 254ms
253ms Script
application/javascript 172.67.197.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cweb.wworwy.club/main.js?ver=7.15b
Requested by: Host: cweb.wworwy.club
URL: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a458a2c3f77b0c022ffacf8ed9797606b6cc3c342aa9ac2ce6e03e304cd7a66

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 07:19:22 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 19 Aug 2023 08:48:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64e081c1-60df"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s7B1%2Bo%2FGbR331gpmt9qYdigkvTvYefWUK6LSJy8vzvDyiy4nS%2BPYAXzKmf1GxFGBcdr%2Bg%2BnqA7laK96zqdVIuUh03UFNPkFeym1tsfYxJydazNFghltDCawSOr%2B7HWn%2BBjgh"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 7fdac91babcdaf3f-KEF
alt-svc: h3=":443"; ma=86400
expires: Mon, 28 Aug 2023 19:19:22 GMT

GET
H2 200 81715288-8092-4fef-a3df-af537d046c75.png
8srv.anscxnyfrtg.com/qrcodes/ 2 KB
2 KB 969ms
521ms Image
image/png 104.21.45.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://8srv.anscxnyfrtg.com/qrcodes/81715288-8092-4fef-a3df-af537d046c75.png?1693207164492
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.45.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: b09c3d28be8cacc5a88c53d70093b1258f1413601bbecf0ef8cd62ba5ba1df49

Request headers

accept-language: is-IS,is;q=0.9
Referer: https://cweb.wworwy.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 07:19:25 GMT
cf-cache-status: MISS
last-modified: Mon, 28 Aug 2023 07:18:55 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"6d0-18a3b0286ba"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OCq1hkhEc%2FEEI3mnaaQQNPGXpqz3dik4uhMxgAapwNaTkGE2Q%2BYtqrI26dtoX24XePp4%2F%2BYde%2F%2BtUyaT6JvhPmPwlluRH%2F9RLZ%2FxWyikdN24DAkVFpbXBhyZTSzyxj%2B0%2Bh5P4bMuRA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7fdac92d0cdeaf4b-KEF
alt-svc: h3=":443"; ma=86400
content-length: 1744

GET
H2 200 Primary Request /
cp.whasiozp.com/ 11 KB
0 912ms
456ms Document
text/html 172.67.148.1

General

Check archive.org

Show headers Download Go to

Full URL

https://cp.whasiozp.com/

Requested by

Host: cweb.wworwy.club
URL: https://cweb.wworwy.club/main.js?ver=7.15b

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.148.1 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://cweb.wworwy.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7fdac93adca2af3f-KEF
content-encoding: br
content-security-policy
content-type: text/html;charset=utf-8
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Mon, 28 Aug 2023 07:19:27 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster: ?0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vruR4Vi07hgYhtnjGkO66QltEf32%2BWedZBsf7stnmd2yKAdye1iEVKISMnjPaJd%2Fb5zJ6gZHC2kzG22jl734ZFHCI6EwUkQ3yT%2BwcKLUOhlybxXqFdfGjqLD1%2BxX0oaVK%2Fc%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding, User-Agent, Accept-Language Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: L+B3VcXd0eQR6MMzNGEhHVk1daeJUSlr2bpy8ts5AU6j8S/3LYYClYQKcUdBK4N5AR5BNXMiokGqGPsrc8btRg==
x-frame-options: DENY
x-xss-protection: 0

GET 81715288-8092-4fef-a3df-af537d046c75.png
8srv.anscxnyfrtg.com/qrcodes/ 0
0

GET stylex-ab5c1c8c5b049782577ecc019febecea.css
cp.whasiozp.com/ 0
0

GET app-af367c33bcf644294e0b.css
cp.whasiozp.com/ 0
0

GET layui.css
npm.elemecdn.com/layuicdns@1.1.0/layui/css/ 0
0

GET layui.js
npm.elemecdn.com/layuicdns@1.1.0/layui/ 0
0

GET app.js
qingtian.whatoppjku.com/ 0
0

GET binary-transparency-manifest-2.2335.9.json
cp.whasiozp.com/ 0
0

GET libsignal-protocol-ee5b8ba.min.js
cp.whasiozp.com/ 0
0

GET runtime.ccd01329764b032b998b.js
cp.whasiozp.com/ 0
0

GET vendor1~app.7f14216f970118f62a35.js
cp.whasiozp.com/ 0
0

GET app.007cfdb344cabd1c5678.js
cp.whasiozp.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: web.whatsapp.com
URL: https://web.whatsapp.com/binary-transparency-manifest-2.2325.3.json

Domain: 8srv.anscxnyfrtg.com
URL: https://8srv.anscxnyfrtg.com/qrcodes/81715288-8092-4fef-a3df-af537d046c75.png?1693207167494

Domain: cp.whasiozp.com
URL: https://cp.whasiozp.com/stylex-ab5c1c8c5b049782577ecc019febecea.css

Domain: cp.whasiozp.com
URL: https://cp.whasiozp.com/app-af367c33bcf644294e0b.css

Domain: npm.elemecdn.com
URL: https://npm.elemecdn.com/layuicdns@1.1.0/layui/css/layui.css

Domain: npm.elemecdn.com
URL: https://npm.elemecdn.com/layuicdns@1.1.0/layui/layui.js

Domain: qingtian.whatoppjku.com
URL: https://qingtian.whatoppjku.com/app.js?ver=1.3

Domain: cp.whasiozp.com
URL: https://cp.whasiozp.com/binary-transparency-manifest-2.2335.9.json

Domain: cp.whasiozp.com
URL: https://cp.whasiozp.com/libsignal-protocol-ee5b8ba.min.js

Domain: cp.whasiozp.com
URL: https://cp.whasiozp.com/runtime.ccd01329764b032b998b.js

Domain: cp.whasiozp.com
URL: https://cp.whasiozp.com/vendor1~app.7f14216f970118f62a35.js

Domain: cp.whasiozp.com
URL: https://cp.whasiozp.com/app.007cfdb344cabd1c5678.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.googleadservices.com/pagead/conversion/11312969435/	1970-01-20 16:29:43	Name: Conversion Value: EgwIABUAAAAAHQAAAAAYASC-stq5zKDjy_4BSAFqN0VBSWFJUW9iQ2hNSXB2M0NpZWotZ0FNVlY5Z1dCUjFIVFFDSUVBTVlBeUFBRWdMSkJ2RF9Cd0Vw8Zaxl-j-gAOQAbzJyOX3EZgBAA

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cweb.wworwy.club/qrcode.min.js Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://cweb.wworwy.club/?gclid=EAIaIQobChMIpv3Ciej-gAMVV9gWBR1HTQCIEAMYAyAAEgLJBvD_BwE Message: Access to link element resource at 'https://web.whatsapp.com/binary-transparency-manifest-2.2325.3.json' from origin 'https://cweb.wworwy.club' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://web.whatsapp.com/binary-transparency-manifest-2.2325.3.json Message: Failed to load resource: net::ERR_FAILED
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8srv.anscxnyfrtg.com
cdn.staticfile.org
cp.whasiozp.com
cweb.wworwy.club
npm.elemecdn.com
qingtian.whatoppjku.com
web.whatsapp.com
www.googleadservices.com
8srv.anscxnyfrtg.com
cp.whasiozp.com
npm.elemecdn.com
qingtian.whatoppjku.com
web.whatsapp.com
104.21.45.65
142.250.186.34
163.181.56.225
172.67.148.1
172.67.197.1
0a458a2c3f77b0c022ffacf8ed9797606b6cc3c342aa9ac2ce6e03e304cd7a66
69acbe3d7c92af1a509b7351cabfac35b356c18eef8c9299f5ac354acfdba079
775fafc214e32a36e2a39e694322fed097e37d964c9dce65663655b64492d068
79acde4aa0ad3feafd96271141640066d0c52c050724b13272b1ca3d6930f8d1
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
8a636dbd66666f13902713e7bc7d2e1cab497b299f533495759a2c68c459c5a4
b09c3d28be8cacc5a88c53d70093b1258f1413601bbecf0ef8cd62ba5ba1df49
d3ff129e3a49744ad0c045eb6fe06737d02930eed78b99cfd7cabfe7af7bfea9
d980ab372658f4c7c8f07d730ef6dc67e3fb3471f37928274f915c0308850994

cp.whasiozp.com Open in urlscan Pro 172.67.148.1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

48 %HTTPS

0 %IPv6

8 Domains

8 Subdomains

5 IPs

3 Countries

203 kBTransfer

702 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

5 Console Messages

Indicators

cp.whasiozp.com Open in urlscan Pro
172.67.148.1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

48 %
HTTPS

0 %
IPv6

8
Domains

8
Subdomains

5
IPs

3
Countries

203 kB
Transfer

702 kB
Size

1
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!