urlscan.io logo urlscan.io
SecurityTrails logo

yun4.cn Open in urlscan Pro
8.218.11.36  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://yun4.cn/
Submission: On May 05 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 19 HTTP transactions. The main IP is 8.218.11.36, located in Central, Hong Kong and belongs to ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN. The main domain is yun4.cn.
This is the only time yun4.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
10 8.218.11.36 45102 (ALIBABA-C...)
19 2
Apex Domain
Subdomains		 Transfer
10 yun4.cn
yun4.cn
www.yun4.cn Failed
375 KB
0 whatsapp.com Failed
web.whatsapp.com Failed
19 2
Domain Requested by
10 yun4.cn yun4.cn
0 www.yun4.cn Failed yun4.cn
0 web.whatsapp.com Failed yun4.cn
19 3

This site contains links to these domains. Also see Links.

Domain
faq.whatsapp.com
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://yun4.cn/
Frame ID: 036C17699BCFEBC4DA98C8A163FD4155
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

WhatsApp

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

1
Countries

450 kB
Transfer

970 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
yun4.cn/ 		13 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://yun4.cn/
Protocol
HTTP/1.1
Server
8.218.11.36 Central, Hong Kong, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Microsoft-IIS/7.5 / PHP/5.4.45 ASP.NET
Resource Hash
633f53ca4e9ade1e829664e8e89bf868e2e7ffc4912da6134ad509dd9aa2bc1b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Encoding
gzip
Content-Length
7078
Content-Type
text/html
Date
Fri, 05 May 2023 13:29:52 GMT
Server
Microsoft-IIS/7.5
Vary
Accept-Encoding
X-Powered-By
PHP/5.4.45 ASP.NET
stylex-2d46744708947781f1f33a0069cbc308.css
yun4.cn/WhatsApp_files/ 		114 KB
40 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://yun4.cn/WhatsApp_files/stylex-2d46744708947781f1f33a0069cbc308.css
Requested by
Host: yun4.cn
URL: http://yun4.cn/
Protocol
HTTP/1.1
Server
8.218.11.36 Central, Hong Kong, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
d3889a9a244c69018e4848bffa27b76845ca2c34813976342d4b122e6533bbca

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://yun4.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date
Fri, 05 May 2023 13:29:52 GMT
Content-Encoding
gzip
Last-Modified
Sun, 05 Mar 2023 15:47:01 GMT
Server
Microsoft-IIS/7.5
ETag
"42b4c9b9794fd91:0"
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
40296
bootstrap_qr-e2b403f65ed52d327e90.css
yun4.cn/WhatsApp_files/ 		173 KB
77 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://yun4.cn/WhatsApp_files/bootstrap_qr-e2b403f65ed52d327e90.css
Requested by
Host: yun4.cn
URL: http://yun4.cn/
Protocol
HTTP/1.1
Server
8.218.11.36 Central, Hong Kong, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
59d4eb8a3be2027e81bba7da480f0e087a5b97003767549737d40d5196d551cf

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://yun4.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date
Fri, 05 May 2023 13:29:52 GMT
Content-Encoding
gzip
Last-Modified
Sun, 05 Mar 2023 15:46:57 GMT
Server
Microsoft-IIS/7.5
ETag
"30f2e0b7794fd91:0"
X-Powered-By
ASP.NET
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
bootstrap_main.9d6050e3d2fff5b782d3.css
yun4.cn/WhatsApp_files/ 		226 KB
66 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://yun4.cn/WhatsApp_files/bootstrap_main.9d6050e3d2fff5b782d3.css
Requested by
Host: yun4.cn
URL: http://yun4.cn/
Protocol
HTTP/1.1
Server
8.218.11.36 Central, Hong Kong, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
0493d6015e39574e3fcbcaae7f0b99ffc91878ea89f53c143a0d84e45d2d49fe

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://yun4.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date
Fri, 05 May 2023 13:29:52 GMT
Content-Encoding
gzip
Last-Modified
Sun, 05 Mar 2023 15:46:57 GMT
Server
Microsoft-IIS/7.5
ETag
"3ce28fb7794fd91:0"
X-Powered-By
ASP.NET
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
jquery.min.js
yun4.cn/WhatsApp_files/ 		91 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://yun4.cn/WhatsApp_files/jquery.min.js
Requested by
Host: yun4.cn
URL: http://yun4.cn/
Protocol
HTTP/1.1
Server
8.218.11.36 Central, Hong Kong, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://yun4.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date
Fri, 05 May 2023 13:29:52 GMT
Content-Encoding
gzip
Last-Modified
Sun, 05 Mar 2023 15:46:58 GMT
Server
Microsoft-IIS/7.5
ETag
"181283b8794fd91:0"
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
41696
jquery.cookie.js
yun4.cn/WhatsApp_files/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://yun4.cn/WhatsApp_files/jquery.cookie.js
Requested by
Host: yun4.cn
URL: http://yun4.cn/
Protocol
HTTP/1.1
Server
8.218.11.36 Central, Hong Kong, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://yun4.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date
Fri, 05 May 2023 13:29:52 GMT
Content-Encoding
gzip
Last-Modified
Sun, 05 Mar 2023 15:46:58 GMT
Server
Microsoft-IIS/7.5
ETag
"24232b8794fd91:0"
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
1635
qr-video_0c6ec69b054fdeb31cf3e5e10290fd8e.png
yun4.cn/WhatsApp_files/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://yun4.cn/WhatsApp_files/qr-video_0c6ec69b054fdeb31cf3e5e10290fd8e.png
Requested by
Host: yun4.cn
URL: http://yun4.cn/
Protocol
HTTP/1.1
Server
8.218.11.36 Central, Hong Kong, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
d980ab372658f4c7c8f07d730ef6dc67e3fb3471f37928274f915c0308850994

Request headers

Referer
http://yun4.cn/
Origin
http://yun4.cn
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date
Fri, 05 May 2023 13:29:52 GMT
Last-Modified
Sun, 05 Mar 2023 15:47:00 GMT
Server
Microsoft-IIS/7.5
ETag
"5a9427b9794fd91:0"
X-Powered-By
ASP.NET
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
16259
binary-transparency-manifest-2.2232.8.json
web.whatsapp.com/ 		0
0
libsignal-protocol-ee5b8ba.min.js
yun4.cn/WhatsApp_files/ 		244 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://yun4.cn/WhatsApp_files/libsignal-protocol-ee5b8ba.min.js
Requested by
Host: yun4.cn
URL: http://yun4.cn/
Protocol
HTTP/1.1
Server
8.218.11.36 Central, Hong Kong, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
b32cb4726155800367b1e44af2fd940b77aed84cc9baa11c0381bf35dd993c98

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://yun4.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date
Fri, 05 May 2023 13:29:52 GMT
Content-Encoding
gzip
Last-Modified
Sun, 05 Mar 2023 15:46:59 GMT
Server
Microsoft-IIS/7.5
ETag
"c22d4b8794fd91:0"
X-Powered-By
ASP.NET
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
runtime.88c356058afe3d58a508.js
yun4.cn/WhatsApp_files/ 		15 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://yun4.cn/WhatsApp_files/runtime.88c356058afe3d58a508.js
Requested by
Host: yun4.cn
URL: http://yun4.cn/
Protocol
HTTP/1.1
Server
8.218.11.36 Central, Hong Kong, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
cd00a8ee12254d2285a82ea490590610a500c867831301e8d91884f93ca3c564

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://yun4.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date
Fri, 05 May 2023 13:29:54 GMT
Content-Encoding
gzip
Last-Modified
Sun, 05 Mar 2023 15:47:00 GMT
Server
Microsoft-IIS/7.5
ETag
"f44176b9794fd91:0"
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
9026
truncated
/ 		75 KB
75 KB 		Other
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9462066cd31fa7927d08b725df1ef816ef2401a5f565649d6a053207f216877e

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://yun4.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type
application/octet-stream
qrcode
yun4.cn/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
http://yun4.cn/qrcode?type=init&uuid=f42a015f-8a0b-4917-8dec-07b37554dd2c&timestamp=1683293395364
Requested by
Host: yun4.cn
URL: http://yun4.cn/WhatsApp_files/jquery.min.js
Protocol
HTTP/1.1
Server
8.218.11.36 Central, Hong Kong, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
58d64bad8f43a6c332a2e1639a566bd482c812b3f892d4aba9ae15be8d06eb8f

Request headers

Accept
*/*
Referer
http://yun4.cn/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date
Fri, 05 May 2023 13:29:54 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
Content-Length
1163
Content-Type
text/html
ewm.txt
www.yun4.cn//img/ 		0
0
ewm.gif
www.yun4.cn//img/ 		0
0
ewm.txt
www.yun4.cn//img/ 		0
0
ewm.gif
www.yun4.cn//img/ 		0
0
ewm.txt
www.yun4.cn//img/ 		0
0
ewm.gif
www.yun4.cn//img/ 		0
0
ewm.txt
www.yun4.cn//img/ 		0
0
ewm.gif
www.yun4.cn//img/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
web.whatsapp.com
URL
https://web.whatsapp.com/binary-transparency-manifest-2.2232.8.json
Domain
www.yun4.cn
URL
https://www.yun4.cn//img/ewm.txt
Domain
www.yun4.cn
URL
https://www.yun4.cn//img/ewm.gif?t=0.20797477042532675
Domain
www.yun4.cn
URL
https://www.yun4.cn//img/ewm.txt
Domain
www.yun4.cn
URL
https://www.yun4.cn//img/ewm.gif?t=0.3595026339386569
Domain
www.yun4.cn
URL
https://www.yun4.cn//img/ewm.txt
Domain
www.yun4.cn
URL
https://www.yun4.cn//img/ewm.gif?t=0.8989355038304394
Domain
www.yun4.cn
URL
https://www.yun4.cn//img/ewm.txt
Domain
www.yun4.cn
URL
https://www.yun4.cn//img/ewm.gif?t=0.7327595957294859

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery function| guid function| refreshqrcode function| qrcode function| tz boolean| systemThemeDark object| theme object| systemThemeMode object| systemTheme boolean| darkTheme object| libsignal object| dcodeIO object| webpackChunkwhatsapp_web_client

1 Cookies

Domain/Path Name / Value
yun4.cn/ Name: ZDEDebuggerPresent
Value: php,phtml,php3

4 Console Messages

Source Level URL
Text
javascript error URL: http://yun4.cn/(Line 3)
Message:
Access to link element resource at 'https://web.whatsapp.com/binary-transparency-manifest-2.2232.8.json' from origin 'http://yun4.cn' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://web.whatsapp.com/binary-transparency-manifest-2.2232.8.json
Message:
Failed to load resource: net::ERR_FAILED
network error URL: http://yun4.cn/qrcode?type=init&uuid=f42a015f-8a0b-4917-8dec-07b37554dd2c&timestamp=1683293395364
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
javascript warning URL: http://yun4.cn/
Message:
The resource https://web.whatsapp.com/binary-transparency-manifest-2.2232.8.json was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.