URL: http://whatsappsex1.ddns.net/
Submission: On January 14 via automatic, source openphish

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 213.136.78.181, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is whatsappsex1.ddns.net.
This is the only time whatsappsex1.ddns.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
4 213.136.78.181 51167 (CONTABO)
1 2 2a03:2880:f21... 32934 (FACEBOOK)
5 2
Domain
Subdomains
Transfer
4 whatsappsex1.ddns.net
98 KB
1 whatsapp.com
0 B
1 whatsapp.net
167 B
5 3
Domain Requested by
4 whatsappsex1.ddns.net whatsappsex1.ddns.net
1 www.whatsapp.com whatsappsex1.ddns.net
1 www-cdn.whatsapp.net 1 redirects
5 3
Subject / Issuer Validity Valid
*.whatsapp.net
DigiCert SHA2 High Assurance Server CA
2020-12-20 -
2021-03-19
3 months

Screenshot


Detected technologies

Web
Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i


Stats

0
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
7 KB
2 KB
Document
General
Full URL
http://whatsappsex1.ddns.net/
Protocol
HTTP/1.1
Server
213.136.78.181 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi501909.contaboserver.net
Software
LiteSpeed /
Resource Hash
c4a3856611ffbc7fa9f121de376124fceda988c4609523fad6a0f37d2d40c962

Request headers

Host
whatsappsex1.ddns.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Type
text/html
Last-Modified
Tue, 05 Jan 2021 13:04:58 GMT
Accept-Ranges
bytes
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
1973
Date
Thu, 14 Jan 2021 01:17:36 GMT
Server
LiteSpeed
style.build35e635e635e6.css
/css/v4
240 KB
49 KB
Stylesheet
General
Full URL
http://whatsappsex1.ddns.net/css/v4/style.build35e635e635e6.css
Requested by
Host: whatsappsex1.ddns.net
URL: http://whatsappsex1.ddns.net/
Protocol
HTTP/1.1
Server
213.136.78.181 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi501909.contaboserver.net
Software
LiteSpeed /
Resource Hash
5d6ebaa0e5f23c2aafea7f738be1a5c88019121c46f497fe8e6c7af7e5f0db4c

Request headers

Referer
http://whatsappsex1.ddns.net/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 14 Jan 2021 01:17:36 GMT
Content-Encoding
gzip
Last-Modified
Mon, 15 Apr 2019 17:06:44 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
49325
Expires
Thu, 21 Jan 2021 01:17:36 GMT
ngentod.jpg
/img/v4
27 KB
28 KB
Image
General
Full URL
http://whatsappsex1.ddns.net/img/v4/ngentod.jpg
Requested by
Host: whatsappsex1.ddns.net
URL: http://whatsappsex1.ddns.net/
Protocol
HTTP/1.1
Server
213.136.78.181 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi501909.contaboserver.net
Software
LiteSpeed /
Resource Hash
9f5e84d5488231c1bf6db8e128c30e2b8dcd22f8846412ff21c81c1127389f72

Request headers

Referer
http://whatsappsex1.ddns.net/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 14 Jan 2021 01:17:36 GMT
Last-Modified
Tue, 05 Jan 2021 13:05:47 GMT
Server
LiteSpeed
Content-Type
image/jpeg
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
27971
Expires
Thu, 21 Jan 2021 01:17:36 GMT
whatsapp-logo.svg
www.whatsapp.com/img/v4
Redirect Chain
  • https://www-cdn.whatsapp.net/img/v4/whatsapp-logo.svg?v=46fe27fc8
  • https://www.whatsapp.com/img/v4/whatsapp-logo.svg
0
0
Image
General
Full URL
https://www.whatsapp.com/img/v4/whatsapp-logo.svg
Requested by
Host: whatsappsex1.ddns.net
URL: http://whatsappsex1.ddns.net/css/v4/style.build35e635e635e6.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f21c:81c5:face:b00c:0:167 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://whatsappsex1.ddns.net/css/v4/style.build35e635e635e6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

location
https://www.whatsapp.com/img/v4/whatsapp-logo.svg
date
Thu, 14 Jan 2021 01:17:36 GMT
x-fb-trip-id
1679558926
server
proxygen-bolt
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0
content-type
text/plain
icon-chat.png
/img/v4
20 KB
20 KB
Image
General
Full URL
http://whatsappsex1.ddns.net/img/v4/icon-chat.png
Requested by
Host: whatsappsex1.ddns.net
URL: http://whatsappsex1.ddns.net/css/v4/style.build35e635e635e6.css
Protocol
HTTP/1.1
Server
213.136.78.181 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi501909.contaboserver.net
Software
LiteSpeed /
Resource Hash
b6b5990665e9b1e7db462f4f74c4d9517e1e6b315403cdc43150bd26084ea4c4

Request headers

Referer
http://whatsappsex1.ddns.net/css/v4/style.build35e635e635e6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 14 Jan 2021 01:17:36 GMT
Last-Modified
Mon, 15 Apr 2019 17:06:46 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
20384
Expires
Thu, 21 Jan 2021 01:17:36 GMT

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Request 3
  • https://www-cdn.whatsapp.net/img/v4/whatsapp-logo.svg?v=46fe27fc8
  • https://www.whatsapp.com/img/v4/whatsapp-logo.svg

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

0 Cookies