urlscan.io logo urlscan.io
SecurityTrails logo

grup-wa217ym8.infoxyz1.my.id Open in urlscan Pro
2606:4700:3035::ac43:943e  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
Submission: On March 31 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3035::ac43:943e, located in United States and belongs to CLOUDFLARENET, US. The main domain is grup-wa217ym8.infoxyz1.my.id.
TLS certificate: Issued by GTS CA 1P5 on March 20th 2024. Valid for: 3 months.
This is the only time grup-wa217ym8.infoxyz1.my.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
3 2606:4700:303... 13335 (CLOUDFLAR...)
1 169.197.85.95 26548 (PUREVOLTA...)
1 188.40.164.54 24940 (HETZNER-AS)
1 2a03:2880:f21... 32934 (FACEBOOK)
2 2a04:4e42::485 54113 (FASTLY)
2 2606:4700::68... 13335 (CLOUDFLAR...)
10 6
3    2606:4700:3035::ac43:943e (United States)

ASN13335 (CLOUDFLARENET, US)
grup-wa217ym8.infoxyz1.my.id
1    169.197.85.95 (United States)

ASN26548 (PUREVOLTAGE-INC, US)
i.ibb.co
1    188.40.164.54 (Berlin, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.54.164.40.188.clients.your-server.de
s9.gifyu.com
1    2a03:2880:f212:c2:face:b00c:0:1cc9 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
z-p3-static.xx.fbcdn.net
2    2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
2    2606:4700::6810:7daf (United States)

ASN13335 (CLOUDFLARENET, US)
unpkg.com
Apex Domain
Subdomains		 Transfer
3 infoxyz1.my.id
grup-wa217ym8.infoxyz1.my.id
5 KB
2 unpkg.com
unpkg.com — Cisco Umbrella Rank: 725
5 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310
35 KB
1 fbcdn.net
z-p3-static.xx.fbcdn.net — Cisco Umbrella Rank: 85530
2 KB
1 gifyu.com
s9.gifyu.com — Cisco Umbrella Rank: 268918
109 KB
1 ibb.co
i.ibb.co — Cisco Umbrella Rank: 11763
155 KB
10 6
Domain Requested by
3 grup-wa217ym8.infoxyz1.my.id grup-wa217ym8.infoxyz1.my.id
2 unpkg.com cdn.jsdelivr.net
grup-wa217ym8.infoxyz1.my.id
2 cdn.jsdelivr.net grup-wa217ym8.infoxyz1.my.id
cdn.jsdelivr.net
1 z-p3-static.xx.fbcdn.net grup-wa217ym8.infoxyz1.my.id
1 s9.gifyu.com grup-wa217ym8.infoxyz1.my.id
1 i.ibb.co grup-wa217ym8.infoxyz1.my.id
10 6

This site contains links to these domains. Also see Links.

Domain
www.whatsapp.com
Subject Issuer Validity Valid
infoxyz1.my.id
GTS CA 1P5		 2024-03-20 -
2024-06-18		 3 months crt.sh
ibb.co
R3		 2024-02-07 -
2024-05-07		 3 months crt.sh
s9.gifyu.com
R3		 2024-02-14 -
2024-05-14		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2024-01-09 -
2024-04-08		 3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3		 2023-09-27 -
2024-10-28		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-02 -
2024-05-01		 a year crt.sh

This page contains 1 frames:

Primary Page: https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
Frame ID: E886EA01221F82CB2CFFC30A384BC31C
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

WhatsApp Group Invite

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

10
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

312 kB
Transfer

396 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.php
grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/ 		12 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:943e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
775305787a227aa255b68f373e23deab5c68c7a88044b6829092a8257be64c0c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
en-US,en;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
86d40f29cbb442a3-EWR
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sun, 31 Mar 2024 23:18:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F2cuCHMj8vkenLP4bzUKw9dZCIzoXOBnnjS2qyg7iMtTPs9%2BrL9KDUjIoTWAiTDhPRyNZMQrxqMe1J3n3rJBvDTl6Lsw%2BFT9skHqL69Jk28g0ZB74%2F9rlx3WgXuVvbUKsK0AafwPJGhJVVKGzjEBIMPb2qeXLJFauraM"}],"group":"cf-nel","max_age":604800}
server
cloudflare
style.css
grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/assets/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/assets/css/style.css
Requested by
Host: grup-wa217ym8.infoxyz1.my.id
URL: https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:943e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
948c5c032dff4fd6e6f27f4d85ed71cfe4024a93ac30c4ed810fddc78f8843b1

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 23:18:33 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 12 Jan 2024 13:53:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2861
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DtZAAq434GkpVRA22h1B%2BbbRUmB4UBIOC54UDfJL9kn6Y0hXMkUjt5VLFi1azjlfyyTHFFTQFJeIfjicITV2fHxZUuGVl%2BM7TcdK8tVI84NagkTetFdOxJzpMH4idsb1KXDKeK5JYfUsZWyw84FrhMGbkNGjTc6In1pe"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
86d40f2c2cd219bf-EWR
alt-svc
h3=":443"; ma=86400
9429795792947.png
i.ibb.co/gRDdQ9b/ 		155 KB
155 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/gRDdQ9b/9429795792947.png
Requested by
Host: grup-wa217ym8.infoxyz1.my.id
URL: https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.85.95 , United States, ASN26548 (PUREVOLTAGE-INC, US),
Reverse DNS
Software
nginx /
Resource Hash
4256e8caf9b1ec39378834c37f8ce7c3d277bf3c9838890f2f506bb9396f6a1a

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://grup-wa217ym8.infoxyz1.my.id/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 23:18:33 GMT
last-modified
Thu, 02 Jun 2022 17:00:14 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
158442
expires
Thu, 31 Dec 2037 23:55:55 GMT
SFjY4.png
s9.gifyu.com/images/ 		109 KB
109 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s9.gifyu.com/images/SFjY4.png
Requested by
Host: grup-wa217ym8.infoxyz1.my.id
URL: https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.40.164.54 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.54.164.40.188.clients.your-server.de
Software
nginx/1.24.0 (Ubuntu) /
Resource Hash
d85ea4058e89186a0c61d478e435538971435f59abddd31245fb9ed031a2fff9

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://grup-wa217ym8.infoxyz1.my.id/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 23:18:34 GMT
last-modified
Tue, 27 Feb 2024 06:35:02 GMT
server
nginx/1.24.0 (Ubuntu)
accept-ranges
bytes
etag
"65dd8296-1b35f"
content-length
111455
content-type
image/png
lOol7j-zq4u.svg
z-p3-static.xx.fbcdn.net/rsrc.php/yz/r/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://z-p3-static.xx.fbcdn.net/rsrc.php/yz/r/lOol7j-zq4u.svg
Requested by
Host: grup-wa217ym8.infoxyz1.my.id
URL: https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f212:c2:face:b00c:0:1cc9 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
533ef6670e3d9c0e44718d0afa43f2edda11b58586e9da4e8f621145cf84d4d2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://grup-wa217ym8.infoxyz1.my.id/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 23:18:33 GMT
content-encoding
zstd
x-content-type-options
nosniff
content-md5
9fIVygFfpVg3ED6LUZEpTw==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1190
reporting-endpoints
permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=8, rtx=0, c=10, mss=1392, tbw=2763, tp=-1, tpl=-1, uplat=1, ullat=-1
x-fb-debug
kzqGsCoJ5yEzTdTUlESjgOhTVxKz2guPi/17/778Ua38GCDYI3ZKcF/ZhtP37KZ2e7rF6IVgwTMX4avQ5p4Y7g==
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
report-to
{"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
image/svg+xml
access-control-allow-origin
*
origin-agent-cluster
?0
cache-control
public,max-age=31536000,immutable
permissions-policy
accelerometer=(), ambient-light-sensor=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin
*
expires
Mon, 31 Mar 2025 09:40:42 GMT
ionicons.js
cdn.jsdelivr.net/gh/styleiconss/jquery3.6.0@master/ 		1012 B
930 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/styleiconss/jquery3.6.0@master/ionicons.js
Requested by
Host: grup-wa217ym8.infoxyz1.my.id
URL: https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
377ca57bb1eeaa23b60958ef2552015626df047726a02e097467750ce7b6d2d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://grup-wa217ym8.infoxyz1.my.id/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 31 Mar 2024 23:18:33 GMT
x-content-type-options
nosniff
content-encoding
br
age
32536
x-jsd-version
master
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
472
x-served-by
cache-fra-etou8220159-FRA, cache-ewr18175-EWR
x-jsd-version-type
branch
etag
W/"3f4-4PQKaiRUt1JJc3OkAC1EcEmx0Is"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
ionicons.esm.js
unpkg.com/ionicons@5.0.0/dist/ionicons/ 		262 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/ionicons@5.0.0/dist/ionicons/ionicons.esm.js
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/styleiconss/jquery3.6.0@master/ionicons.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
28a06f4491def3fdc69ddefa5c850a2583ff312997aef3498e2f12e384c45115
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://grup-wa217ym8.infoxyz1.my.id/
Origin
https://grup-wa217ym8.infoxyz1.my.id
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 23:18:33 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
1574268
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01HRWFJ5SWQ9JMCKTNK9D88RE7-lga
server
cloudflare
etag
W/"106-2QVIn+WWfE7GzXgXZTPbiG+yGbs"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
86d40f2e5bb1c468-EWR
icon.io.js
cdn.jsdelivr.net/gh/styleiconss/jquery.3.6.0@main/ 		105 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/styleiconss/jquery.3.6.0@main/icon.io.js
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/styleiconss/jquery3.6.0@master/ionicons.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6edda5ae05f52b19ae02a052c1ddb0dda8108725498920862f18590d3a83df8b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://grup-wa217ym8.infoxyz1.my.id/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 31 Mar 2024 23:18:33 GMT
x-content-type-options
nosniff
content-encoding
br
age
20164
x-jsd-version
main
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
34937
x-served-by
cache-fra-eddf8230076-FRA, cache-ewr18175-EWR
x-jsd-version-type
branch
etag
W/"1a4c7-8XYSy5g64QjXJTOeAHA0BdPNoaU"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
p-af480238.js
unpkg.com/ionicons@5.0.0/dist/ionicons/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/ionicons@5.0.0/dist/ionicons/p-af480238.js
Requested by
Host: grup-wa217ym8.infoxyz1.my.id
URL: https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
35a79935107f53fa3b2f923363b50be53bd42e446f64f457c5e74a526bfa29b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://unpkg.com/ionicons@5.0.0/dist/ionicons/ionicons.esm.js
Origin
https://grup-wa217ym8.infoxyz1.my.id
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 23:18:34 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
1583107
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01HRW74QFRDFM4W7230NQY183X-lga
server
cloudflare
etag
W/"232c-uchF0l8mHJgXmaMGCPlWLIIn3tc"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
86d40f2ecc33c468-EWR
logowa.png
grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/assets/images/ 		315 B
674 B 		Other
General
Check archive.org
Download Go to
Full URL
https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/assets/images/logowa.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:943e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 31 Mar 2024 23:18:34 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nVT9nhP6AFJZLPUzU6yIvkZWr%2FYKlWODWypkzBm8ZkiranePB7vl2alXa21sw2AOoYQgEOMbnNYg%2BJCd5P5dNXpSG1DMvSdGei57FwIMri%2BUm%2FqHuQi2p9qogXd4sDgMQ%2BbmW2CBAlGDW5ckdSC3zdUZW2I4hIMigkhR"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
86d40f31d8dd19bf-EWR
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal function| login function| $ function| jQuery function| __sc_import_ionicons

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/assets/images/logowa.png
Message:
Failed to load resource: the server responded with a status of 404 ()