![](/screenshots/f2393992-ffb6-4a1b-a0e9-94a3094e6ec5.png)
grup-wa217ym8.infoxyz1.my.id
Open in
urlscan Pro
2606:4700:3035::ac43:943e
Malicious Activity!
Public Scan
Submission: On March 31 via api from US — Scanned from US
Summary
TLS certificate: Issued by GTS CA 1P5 on March 20th 2024. Valid for: 3 months.
This is the only time grup-wa217ym8.infoxyz1.my.id was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 2606:4700:303... 2606:4700:3035::ac43:943e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 169.197.85.95 169.197.85.95 | 26548 (PUREVOLTA...) (PUREVOLTAGE-INC) | |
1 | 188.40.164.54 188.40.164.54 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 2a03:2880:f21... 2a03:2880:f212:c2:face:b00c:0:1cc9 | 32934 (FACEBOOK) (FACEBOOK) | |
2 | 2a04:4e42::485 2a04:4e42::485 | 54113 (FASTLY) (FASTLY) | |
2 | 2606:4700::68... 2606:4700::6810:7daf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 6 |
ASN13335 (CLOUDFLARENET, US)
grup-wa217ym8.infoxyz1.my.id |
ASN24940 (HETZNER-AS, DE)
PTR: static.54.164.40.188.clients.your-server.de
s9.gifyu.com |
ASN32934 (FACEBOOK, US)
z-p3-static.xx.fbcdn.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
infoxyz1.my.id
grup-wa217ym8.infoxyz1.my.id |
5 KB |
2 |
unpkg.com
unpkg.com — Cisco Umbrella Rank: 725 |
5 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310 |
35 KB |
1 |
fbcdn.net
z-p3-static.xx.fbcdn.net — Cisco Umbrella Rank: 85530 |
2 KB |
1 |
gifyu.com
s9.gifyu.com — Cisco Umbrella Rank: 268918 |
109 KB |
1 |
ibb.co
i.ibb.co — Cisco Umbrella Rank: 11763 |
155 KB |
10 | 6 |
Domain | Requested by | |
---|---|---|
3 | grup-wa217ym8.infoxyz1.my.id |
grup-wa217ym8.infoxyz1.my.id
|
2 | unpkg.com |
cdn.jsdelivr.net
grup-wa217ym8.infoxyz1.my.id |
2 | cdn.jsdelivr.net |
grup-wa217ym8.infoxyz1.my.id
cdn.jsdelivr.net |
1 | z-p3-static.xx.fbcdn.net |
grup-wa217ym8.infoxyz1.my.id
|
1 | s9.gifyu.com |
grup-wa217ym8.infoxyz1.my.id
|
1 | i.ibb.co |
grup-wa217ym8.infoxyz1.my.id
|
10 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.whatsapp.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
infoxyz1.my.id GTS CA 1P5 |
2024-03-20 - 2024-06-18 |
3 months | crt.sh |
ibb.co R3 |
2024-02-07 - 2024-05-07 |
3 months | crt.sh |
s9.gifyu.com R3 |
2024-02-14 - 2024-05-14 |
3 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2024-01-09 - 2024-04-08 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/index.php
Frame ID: E886EA01221F82CB2CFFC30A384BC31C
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/f2393992-ffb6-4a1b-a0e9-94a3094e6ec5.png)
Page Title
WhatsApp Group InviteDetected technologies
Detected patterns
- \.php(?:$|\?)
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Download
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/ |
12 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/assets/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9429795792947.png
i.ibb.co/gRDdQ9b/ |
155 KB 155 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SFjY4.png
s9.gifyu.com/images/ |
109 KB 109 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lOol7j-zq4u.svg
z-p3-static.xx.fbcdn.net/rsrc.php/yz/r/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ionicons.js
cdn.jsdelivr.net/gh/styleiconss/jquery3.6.0@master/ |
1012 B 930 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ionicons.esm.js
unpkg.com/ionicons@5.0.0/dist/ionicons/ |
262 B 549 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon.io.js
cdn.jsdelivr.net/gh/styleiconss/jquery.3.6.0@main/ |
105 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p-af480238.js
unpkg.com/ionicons@5.0.0/dist/ionicons/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logowa.png
grup-wa217ym8.infoxyz1.my.id/vhsfhqpdhdsih6/assets/images/ |
315 B 674 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onpagereveal function| login function| $ function| jQuery function| __sc_import_ionicons0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
grup-wa217ym8.infoxyz1.my.id
i.ibb.co
s9.gifyu.com
unpkg.com
z-p3-static.xx.fbcdn.net
169.197.85.95
188.40.164.54
2606:4700:3035::ac43:943e
2606:4700::6810:7daf
2a03:2880:f212:c2:face:b00c:0:1cc9
2a04:4e42::485
28a06f4491def3fdc69ddefa5c850a2583ff312997aef3498e2f12e384c45115
35a79935107f53fa3b2f923363b50be53bd42e446f64f457c5e74a526bfa29b9
377ca57bb1eeaa23b60958ef2552015626df047726a02e097467750ce7b6d2d4
4256e8caf9b1ec39378834c37f8ce7c3d277bf3c9838890f2f506bb9396f6a1a
533ef6670e3d9c0e44718d0afa43f2edda11b58586e9da4e8f621145cf84d4d2
6edda5ae05f52b19ae02a052c1ddb0dda8108725498920862f18590d3a83df8b
775305787a227aa255b68f373e23deab5c68c7a88044b6829092a8257be64c0c
948c5c032dff4fd6e6f27f4d85ed71cfe4024a93ac30c4ed810fddc78f8843b1
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d85ea4058e89186a0c61d478e435538971435f59abddd31245fb9ed031a2fff9