ScanMalware.com

Security Scan Report: 4176nwuweb.prod-whatsapps.hl.cn

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/2f6058c4-fc17-40ee-afca-ac7f0c4c7327Domain and IP registration (RDAP)/api/v1/rdap/2f6058c4-fc17-40ee-afca-ac7f0c4c7327How often this domain was scanned/api/v1/domain/stats/4176nwuweb.prod-whatsapps.hl.cnScan history for this domain/api/v1/domain/history/4176nwuweb.prod-whatsapps.hl.cn?limit=15
This website contacted 5 IPs in 1 country across 3 domains to perform 29 HTTP transactions. The main domain is prod-whatsapps.hl.cn and was registered 2 months ago.

Submitted URL: https://4176nwuweb.prod-whatsapps.hl.cn/

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Fake WhatsApp Web login page running the linked-device hijack kit (roster- and YARA-confirmed): scanning the QR or pairing code links the victim's WhatsApp account to an attacker's device. Avoid; report.

Risk Factors (5)
Known malicious phishing kit identified by analyst-vetted roster and two YARA rules
Impersonation of WhatsApp's brand and login UI on a non-WhatsApp domain
QR-code / pairing-code linked-device hijack designed for account takeover rather than a credential form
Obfuscated script concealing a threat-feed host (ipapi.co) and beaconing to unranked open-tongji.xyz
Unranked domain not present in Cisco Umbrella top 1M, on a shared hl.cn tenant namespace
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

Domain '4176nwuweb.prod-whatsapps.hl.cn' uses the Chinese country-code top-level domain (.hl.cn) with subdomain '4176nwuweb'. Count 14 characters in 'prod-whatsapps' holding 3 vowels versus ten consonants; it also includes one hyphen. Breaking it apart gives four words: prod, what, s, apps. Median word length comes out to four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://4176nwuweb.prod-whatsapps.hl.cn/

Page Load Overview

5.33s
Total Load Time
216 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:482 chars
Detector Agreement:100%

Website Classification

Primary Category

social media network69% confidence
Type: static
Method: ml+structural

All Detected Categories

social media network
69%
technology software
53%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
923.248.226.85United States
AS138415Yancy Limited
5172.67.69.226Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
523.226.54.28United States
AS138415Yancy Limited
523.248.226.86United States
AS138415Yancy Limited
5104.26.8.44Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
295--

Detected Technologies2

HTTP/3
40%
HSTS
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T14282E8B563B463FC9407DBDDD722E120339E20B9F7924250C6AC4AF495A798CED9B8C4

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:HVNeq045cQ2Hx4OfVoOa4XqaFNZOK+dJhjVe:H3et4adHxT+QqaFLOK+d7jg

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:18325:MEKlYipGFTGdRAAPBKDZEAMjGqABUgADGjiHLLLIYbNxCRACQYkiITbGACW4SBpY0GALpxEwAGGIQsMVtQhiMoiAPjDBsiCi

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ebc3d3d3ffe7e7ff
Perceptual Hash:ed6d9393886c649a
Difference Hash:96161616304c0c10
Wavelet Hash:1b03d3d3dce4e0f0
Color Hash:#35d22d

Other Hashes

Crop Resistant:96161616304c0c10

Scan History

Scan history not available

Unable to load historical scan data