chatt.wh4tsapps.com
Open in
urlscan Pro
161.35.109.24
Malicious Activity!
Public Scan
Effective URL: https://chatt.wh4tsapps.com/mmndg/
Submission: On December 29 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on December 11th 2021. Valid for: 3 months.
This is the only time chatt.wh4tsapps.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
22 34 | 161.35.109.24 161.35.109.24 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:812::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
16 | 4 |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
34 |
wh4tsapps.com
22 redirects
chatt.wh4tsapps.com |
307 KB |
2 |
google-analytics.com
www.google-analytics.com |
20 KB |
1 |
jquery.com
code.jquery.com |
82 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
61 KB |
16 | 4 |
Domain | Requested by | |
---|---|---|
34 | chatt.wh4tsapps.com |
22 redirects
chatt.wh4tsapps.com
|
2 | www.google-analytics.com |
chatt.wh4tsapps.com
www.googletagmanager.com |
1 | code.jquery.com |
chatt.wh4tsapps.com
|
1 | www.googletagmanager.com |
chatt.wh4tsapps.com
|
16 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
translate.whatsapp.com |
bit.ly |
Subject Issuer | Validity | Valid | |
---|---|---|---|
chatt.wh4tsapps.com R3 |
2021-12-11 - 2022-03-11 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://chatt.wh4tsapps.com/mmndg/
Frame ID: 0D09DACFC5896EB48A001658C4A4E7D6
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
groups of whatsappPage URL History Show full URLs
-
http://chatt.wh4tsapps.com/
HTTP 301
https://chatt.wh4tsapps.com/ HTTP 302
https://chatt.wh4tsapps.com/JPNTRCZtZ8ABLCgem HTTP 301
https://chatt.wh4tsapps.com/JPNTRCZtZ8ABLCgem/ HTTP 302
https://chatt.wh4tsapps.com/mmndg HTTP 301
https://chatt.wh4tsapps.com/mmndg/ Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Help translate WhatsApp into your language
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://chatt.wh4tsapps.com/
HTTP 301
https://chatt.wh4tsapps.com/ HTTP 302
https://chatt.wh4tsapps.com/JPNTRCZtZ8ABLCgem HTTP 301
https://chatt.wh4tsapps.com/JPNTRCZtZ8ABLCgem/ HTTP 302
https://chatt.wh4tsapps.com/mmndg HTTP 301
https://chatt.wh4tsapps.com/mmndg/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://chatt.wh4tsapps.com/animacionjs/jquery.scrollTo.js HTTP 302
- https://chatt.wh4tsapps.com/ HTTP 302
- https://chatt.wh4tsapps.com/uiuhwsuyjs HTTP 301
- https://chatt.wh4tsapps.com/uiuhwsuyjs/ HTTP 302
- https://chatt.wh4tsapps.com/mmndg HTTP 301
- https://chatt.wh4tsapps.com/mmndg/
- https://chatt.wh4tsapps.com/animacionjs/test.js HTTP 302
- https://chatt.wh4tsapps.com/ HTTP 302
- https://chatt.wh4tsapps.com/C58zipls9PK HTTP 302
- https://chatt.wh4tsapps.com/ HTTP 302
- https://chatt.wh4tsapps.com/HxSD38UjfImLt0Bpqws HTTP 301
- https://chatt.wh4tsapps.com/HxSD38UjfImLt0Bpqws/ HTTP 302
- https://chatt.wh4tsapps.com/mmndg HTTP 301
- https://chatt.wh4tsapps.com/mmndg/
- https://chatt.wh4tsapps.com/img/v4/invite/icon-chat.png HTTP 302
- https://chatt.wh4tsapps.com/ HTTP 302
- https://chatt.wh4tsapps.com/FNv15m8cuIU3YrQDF HTTP 301
- https://chatt.wh4tsapps.com/FNv15m8cuIU3YrQDF/ HTTP 302
- https://chatt.wh4tsapps.com/mmndg HTTP 301
- https://chatt.wh4tsapps.com/mmndg/
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
chatt.wh4tsapps.com/mmndg/ Redirect Chain
|
34 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
163 KB 61 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
invite.css
chatt.wh4tsapps.com/js/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js.descarga
chatt.wh4tsapps.com/js/ |
34 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js.descarga
chatt.wh4tsapps.com/js/ |
93 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.js.descarga
chatt.wh4tsapps.com/js/ |
95 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js.descarga
chatt.wh4tsapps.com/js/ |
82 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.11.0.js
code.jquery.com/ |
276 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
chatt.wh4tsapps.com/mmndg/ Redirect Chain
|
34 KB 9 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
chatt.wh4tsapps.com/mmndg/ Redirect Chain
|
34 KB 9 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
images(39)
chatt.wh4tsapps.com/img/ |
8 KB 8 KB |
Image
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
afe0c49fc31b1c02d7206f2dc909b59b%20(1).gif
chatt.wh4tsapps.com/banner/ |
80 KB 80 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
redondear.php
chatt.wh4tsapps.com/ |
45 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 349 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
chatt.wh4tsapps.com/mmndg/ Redirect Chain
|
34 KB 34 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)50 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| gtag object| dataLayer object| google_tag_manager object| google_tag_data object| gaGlobal function| $ function| jQuery function| disableclick string| image_save_msg string| no_menu_msg string| smessage function| disableEnterKey function| disable_copy function| disable_copy_ie function| reEnable function| disableSelection function| nocontext object| _0xb070 object| objetos object| rlink string| msgamigo number| shareCountG string| urlpubliMovil string| urlpubliPC string| msg function| setCookie function| getCookie number| c string| g function| fng function| random function| checkZero function| timer1 number| ii number| iy function| hidepop object| citas number| alea function| ga object| gaplugins function| myFunction string| titulo string| image number| numero_participantes number| numero_im object| participantes number| numero object| imagesd number| numeroi function| onYouTubeIframeAPIReady3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
chatt.wh4tsapps.com/mmndg | Name: invgrupo Value: 0 |
|
.wh4tsapps.com/ | Name: _ga Value: GA1.1.637970520.1640740930 |
|
.wh4tsapps.com/ | Name: _ga_6JQHX93F2N Value: GS1.1.1640740929.1.0.1640740931.0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
chatt.wh4tsapps.com
code.jquery.com
www.google-analytics.com
www.googletagmanager.com
161.35.109.24
2001:4de0:ac18::1:a:2b
2a00:1450:4001:811::2008
2a00:1450:4001:812::200e
0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8
2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
397c7709748635a9692c9370fbf5e075dac0f13c30f9ad9f3a27344769ab4771
4ae30202a10bc7caa768e0762a60a3cfed8fe0ae8604d14382ebd7191b9283d8
736ff80ab874b407e4a37a676cef455e19312298e84594e1b951cd4b7564e476
8316a26a2ca74250b9e63e75c804a40ec5863cce506d0778ad8ce3f81cfb616c
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
ce0343e1d6f489768eeefe022c12181c6a0822e756239851310acf076d23d10c
d4acd6f6f9c7cfb42b4a64c8a876209fd2801b940b6a42418c127938d82e7de9
de522bc485a5ea43300bb8372c142980ca9bb21195c656551297140b3164dd89
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e76acb5d863d93580337e8a1f53b6ee086a2658f37dfeedd0ad6df8933a49be1
e9c8c7026e04ecef051eaf8acf729d4dd3d60c10528a73967ba4fbb65c380262
ff0788452c060c1ce86e3a1915250768d38f40311ad31e21513bdd6772cd7133