![](/screenshots/c0a6e923-3a52-4508-bc5a-9ad8512d166e.png)
whstakk.cc
Open in
urlscan Pro
8.218.11.36
Malicious Activity!
Public Scan
Effective URL: https://whstakk.cc/
Submission: On May 10 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on May 9th 2023. Valid for: 3 months.
This is the only time whstakk.cc was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 19 | 8.218.11.36 8.218.11.36 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
19 | 2 |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
whstakk.cc |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
whstakk.cc
1 redirects
whstakk.cc |
358 KB |
0 |
whatsapp.com
Failed
web.whatsapp.com Failed |
|
19 | 2 |
Domain | Requested by | |
---|---|---|
19 | whstakk.cc |
1 redirects
whstakk.cc
|
0 | web.whatsapp.com Failed |
whstakk.cc
|
19 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
faq.whatsapp.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
whstakk.cc R3 |
2023-05-09 - 2023-08-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://whstakk.cc/
Frame ID: 9C2D353F0329C7512C6289F4BF8D91FF
Requests: 20 HTTP requests in this frame
Screenshot
![](/screenshots/c0a6e923-3a52-4508-bc5a-9ad8512d166e.png)
Page Title
WhatsAppPage URL History Show full URLs
-
http://whstakk.cc/
HTTP 301
https://whstakk.cc/ Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: 需要登入帮助吗?
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://whstakk.cc/
HTTP 301
https://whstakk.cc/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
whstakk.cc/ Redirect Chain
|
13 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
stylex-2d46744708947781f1f33a0069cbc308.css
whstakk.cc/WhatsApp_files/ |
114 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap_qr-e2b403f65ed52d327e90.css
whstakk.cc/WhatsApp_files/ |
173 KB 56 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap_main.9d6050e3d2fff5b782d3.css
whstakk.cc/WhatsApp_files/ |
226 KB 44 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
whstakk.cc/WhatsApp_files/ |
91 KB 32 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.cookie.js
whstakk.cc/WhatsApp_files/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qr-video_0c6ec69b054fdeb31cf3e5e10290fd8e.png
whstakk.cc/WhatsApp_files/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
binary-transparency-manifest-2.2232.8.json
web.whatsapp.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
libsignal-protocol-ee5b8ba.min.js
whstakk.cc/WhatsApp_files/ |
244 KB 88 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
runtime.88c356058afe3d58a508.js
whstakk.cc/WhatsApp_files/ |
15 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
75 KB 75 KB |
Other
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qrcode
whstakk.cc/ |
1 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ewm.txt
whstakk.cc//img/ |
0 414 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ewm.gif
whstakk.cc//img/ |
18 KB 18 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ewm.txt
whstakk.cc//img/ |
0 414 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ewm.gif
whstakk.cc//img/ |
18 KB 18 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ewm.txt
whstakk.cc//img/ |
0 414 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ewm.gif
whstakk.cc//img/ |
18 KB 18 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ewm.txt
whstakk.cc//img/ |
0 414 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ewm.gif
whstakk.cc//img/ |
18 KB 18 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- web.whatsapp.com
- URL
- https://web.whatsapp.com/binary-transparency-manifest-2.2232.8.json
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery function| guid function| refreshqrcode function| qrcode function| tz boolean| systemThemeDark object| theme object| systemThemeMode object| systemTheme boolean| darkTheme object| libsignal object| dcodeIO object| webpackChunkwhatsapp_web_client1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
whstakk.cc/ | Name: ZDEDebuggerPresent Value: php,phtml,php3 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
web.whatsapp.com
whstakk.cc
web.whatsapp.com
8.218.11.36
0493d6015e39574e3fcbcaae7f0b99ffc91878ea89f53c143a0d84e45d2d49fe
485e08d8a24137483454e42cc13be549174f28b2dc8f68364d7d5ed65d74f490
58d64bad8f43a6c332a2e1639a566bd482c812b3f892d4aba9ae15be8d06eb8f
59d4eb8a3be2027e81bba7da480f0e087a5b97003767549737d40d5196d551cf
7fa678220e3575e999b49335b847952ed6caf303a8c9843c92a4d9bea350b45c
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
9462066cd31fa7927d08b725df1ef816ef2401a5f565649d6a053207f216877e
b32cb4726155800367b1e44af2fd940b77aed84cc9baa11c0381bf35dd993c98
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
cd00a8ee12254d2285a82ea490590610a500c867831301e8d91884f93ca3c564
d3889a9a244c69018e4848bffa27b76845ca2c34813976342d4b122e6533bbca
d980ab372658f4c7c8f07d730ef6dc67e3fb3471f37928274f915c0308850994
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855