urlscan.io logo urlscan.io
SecurityTrails logo

chemiecorp.com Open in urlscan Pro
216.137.176.69  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://chemiecorp.com/
Effective URL: https://chemiecorp.com/WhatsApp.html
Submission Tags: falconsandbox
Submission: On January 09 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 11 HTTP transactions. The main IP is 216.137.176.69, located in United States and belongs to A2HOSTING, US. The main domain is chemiecorp.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 18th 2023. Valid for: 3 months.
This is the only time chemiecorp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
6 216.137.176.69 55293 (A2HOSTING)
1 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:26d... 16509 (AMAZON-02)
1 173.231.16.76 18450 (WEBNX)
1 34.117.186.192 396982 (GOOGLE-CL...)
11 6
6    216.137.176.69 (United States)

ASN55293 (A2HOSTING, US)
PTR: server.almekatechnologies.com
chemiecorp.com
1    2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    2600:9000:26db:6200:10:474e:104a:2961 (United States)

ASN16509 (AMAZON-02, US)
cdn.auth0.com
1    173.231.16.76 (United States)

ASN18450 (WEBNX, US)
PTR: api.ipify.org
api.ipify.org
1    34.117.186.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.186.117.34.bc.googleusercontent.com
ipinfo.io
Apex Domain
Subdomains		 Transfer
6 chemiecorp.com
chemiecorp.com
139 KB
1 ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 6061
604 B
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2685
222 B
1 auth0.com
cdn.auth0.com — Cisco Umbrella Rank: 11995
800 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 708
31 KB
0 pages.dev Failed
yuta.pages.dev Failed
11 6
Domain Requested by
6 chemiecorp.com chemiecorp.com
1 ipinfo.io ajax.googleapis.com
1 api.ipify.org ajax.googleapis.com
1 cdn.auth0.com chemiecorp.com
1 ajax.googleapis.com chemiecorp.com
0 yuta.pages.dev Failed chemiecorp.com
11 6

This site contains links to these domains. Also see Links.

Domain
faq.whatsapp.com
Subject Issuer Validity Valid
chemiecorp.com
cPanel, Inc. Certification Authority		 2023-12-18 -
2024-03-17		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
*.auth0.com
Amazon RSA 2048 M01		 2023-02-24 -
2024-03-24		 a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2023-02-07 -
2024-02-18		 a year crt.sh
ipinfo.io
R3		 2023-12-06 -
2024-03-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://chemiecorp.com/WhatsApp.html
Frame ID: 1CFF3E9A67300403A987EBB09619BAC1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

WhatsApp

Page URL History Show full URLs

  1. https://chemiecorp.com/ Page URL
  2. https://chemiecorp.com/WhatsApp.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

91 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

171 kB
Transfer

679 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://chemiecorp.com/ Page URL
  2. https://chemiecorp.com/WhatsApp.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
chemiecorp.com/ 		951 B
677 B 		Document
General
Check archive.org
Download Go to
Full URL
https://chemiecorp.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.137.176.69 , United States, ASN55293 (A2HOSTING, US),
Reverse DNS
server.almekatechnologies.com
Software
LiteSpeed /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
341
content-type
text/html; charset=UTF-8
date
Tue, 09 Jan 2024 21:13:35 GMT
refresh
1; URL=WhatsApp.html
server
LiteSpeed
strict-transport-security
max-age=63072000; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
unique-1.2.4.min.js
yuta.pages.dev/files/js/ 		0
0
Primary Request WhatsApp.html
chemiecorp.com/ 		14 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://chemiecorp.com/WhatsApp.html
Requested by
Host: chemiecorp.com
URL: https://chemiecorp.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.137.176.69 , United States, ASN55293 (A2HOSTING, US),
Reverse DNS
server.almekatechnologies.com
Software
LiteSpeed /
Resource Hash
496e6555869cc33762e99e4d5599e344770e0ae91b6f57cf11b05fadd94d4288
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-encoding
br
content-length
3974
content-type
text/html
date
Tue, 09 Jan 2024 21:13:36 GMT
last-modified
Sat, 30 Dec 2023 14:40:30 GMT
server
LiteSpeed
strict-transport-security
max-age=63072000; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: chemiecorp.com
URL: https://chemiecorp.com/WhatsApp.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://chemiecorp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Fri, 05 Jan 2024 18:18:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
356095
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 04 Jan 2025 18:18:41 GMT
stylex-7416205700eb56b41e3c100d03e4afc2.css
chemiecorp.com/WhatsApp%20Archivos/ 		219 KB
49 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://chemiecorp.com/WhatsApp%20Archivos/stylex-7416205700eb56b41e3c100d03e4afc2.css
Requested by
Host: chemiecorp.com
URL: https://chemiecorp.com/WhatsApp.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.137.176.69 , United States, ASN55293 (A2HOSTING, US),
Reverse DNS
server.almekatechnologies.com
Software
LiteSpeed /
Resource Hash
294eb2d726feb2a7caccba84f1bcc04d0b6f3e36682040d521498c7d99cf9a7a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://chemiecorp.com/WhatsApp.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 09 Jan 2024 21:13:36 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains
last-modified
Fri, 29 Dec 2023 21:18:02 GMT
server
LiteSpeed
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
50196
expires
Tue, 16 Jan 2024 21:13:36 GMT
app-c1c9f745bb0ae3c63811.css
chemiecorp.com/WhatsApp%20Archivos/ 		205 KB
57 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://chemiecorp.com/WhatsApp%20Archivos/app-c1c9f745bb0ae3c63811.css
Requested by
Host: chemiecorp.com
URL: https://chemiecorp.com/WhatsApp.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.137.176.69 , United States, ASN55293 (A2HOSTING, US),
Reverse DNS
server.almekatechnologies.com
Software
LiteSpeed /
Resource Hash
414db7ceda368d4b45697245afdfa30ebc73092341cb8cdd4a267d397ff6ef8d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://chemiecorp.com/WhatsApp.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 09 Jan 2024 21:13:36 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains
last-modified
Fri, 29 Dec 2023 21:18:02 GMT
server
LiteSpeed
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
58168
expires
Tue, 16 Jan 2024 21:13:36 GMT
main.058972cf635290857867.css
chemiecorp.com/WhatsApp%20Archivos/ 		147 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://chemiecorp.com/WhatsApp%20Archivos/main.058972cf635290857867.css
Requested by
Host: chemiecorp.com
URL: https://chemiecorp.com/WhatsApp.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.137.176.69 , United States, ASN55293 (A2HOSTING, US),
Reverse DNS
server.almekatechnologies.com
Software
LiteSpeed /
Resource Hash
2742cefd3fa89561f5c31c1345d0987bfbf9f1ac3f3c887ee93500c6e3fb7560
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://chemiecorp.com/WhatsApp.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 09 Jan 2024 21:13:36 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains
last-modified
Fri, 29 Dec 2023 21:18:02 GMT
server
LiteSpeed
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
27996
expires
Tue, 16 Jan 2024 21:13:36 GMT
sax.js
chemiecorp.com/WhatsApp%20Archivos/ 		5 KB
728 B 		Script
General
Check archive.org
Download Go to
Full URL
https://chemiecorp.com/WhatsApp%20Archivos/sax.js
Requested by
Host: chemiecorp.com
URL: https://chemiecorp.com/WhatsApp.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.137.176.69 , United States, ASN55293 (A2HOSTING, US),
Reverse DNS
server.almekatechnologies.com
Software
LiteSpeed /
Resource Hash
adc37a024c26b28a27ab0480b1db312c08c69a5e95d5dc439eac4801059900ed
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://chemiecorp.com/WhatsApp.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 09 Jan 2024 21:13:36 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains
last-modified
Sat, 30 Dec 2023 15:39:52 GMT
server
LiteSpeed
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
652
expires
Tue, 16 Jan 2024 21:13:36 GMT
object-assign.min.js
cdn.auth0.com/js/polyfills/1.0/ 		278 B
800 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.auth0.com/js/polyfills/1.0/object-assign.min.js
Requested by
Host: chemiecorp.com
URL: https://chemiecorp.com/WhatsApp.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:6200:10:474e:104a:2961 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2e3281ce824bc83f86243254926e320d7a51fd34e310d76f38ddf5ca4430bcd8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://chemiecorp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-amz-version-id
QnBigF9q9VrtNR8TU_yhfoN9BlecmQ2x
date
Tue, 09 Jan 2024 21:01:12 GMT
via
1.1 19392de11dadb918bd6f24e199ea180e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains
x-amz-cf-pop
MUC50-P3
age
768
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
content-length
278
last-modified
Thu, 08 Jun 2017 20:30:02 GMT
server
AmazonS3
etag
"4dfaafaab07b1c6c2314bfe79a1baa81"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=10800,public
accept-ranges
bytes
x-robots-tag
noindex
x-amz-cf-id
r9HKFi15Vc1Ut0aiE03a5L6_kutBXhLlaz96qD-kOAMnUT2RsROJCQ==
/
api.ipify.org/ 		22 B
222 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=json
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
173.231.16.76 , United States, ASN18450 (WEBNX, US),
Reverse DNS
api.ipify.org
Software
nginx/1.25.1 /
Resource Hash
a04ec3b2d9529b7776095594dd263610b8d78b8428075ee9b1a561a342367541

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://chemiecorp.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 09 Jan 2024 21:13:36 GMT
Server
nginx/1.25.1
Connection
keep-alive
Content-Length
22
Vary
Origin
Content-Type
application/json
/
ipinfo.io/ 		302 B
604 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ipinfo.io/
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.186.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
192.186.117.34.bc.googleusercontent.com
Software
nginx/1.24.0 /
Resource Hash
b0cb8c6fa78419ee65831fee41a468d9da371b616203e1f120075ce62c581559
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://chemiecorp.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 09 Jan 2024 21:13:36 GMT
via
1.1 google
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
nginx/1.24.0
strict-transport-security
max-age=2592000; includeSubDomains
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-envoy-upstream-service-time
3
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
302
x-xss-protection
1; mode=block

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
yuta.pages.dev
URL
https://yuta.pages.dev/files/js/unique-1.2.4.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery string| telegram_bot_id number| chat_id undefined| u_name undefined| pax undefined| pax2 undefined| ip undefined| ip2 function| ready function| sender function| ready1 function| sender1 function| ready3 function| sender3 function| ready2 function| sender2 function| ready4 function| sender4

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN