www.wehwah.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 160.153.137.210, located in Scottsdale, United States and belongs to GODADDY-AMS, DE. The main domain is www.wehwah.com.

This is the only time www.wehwah.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 4	160.153.137.210 160.153.137.210	21501 (GODADDY-AMS) (GODADDY-AMS)
1	13.35.254.139 13.35.254.139	16509 (AMAZON-02) (AMAZON-02)
3	2

4 160.153.137.210 (Scottsdale, United States) 2 redirects

ASN21501 (GODADDY-AMS, DE)
PTR: ip-160-153-137-210.ip.secureserver.net

www.wehwah.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.254.139 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-254-139.fra6.r.cloudfront.net

dg6qn11ynnp6a.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	wehwah.com 2 redirects www.wehwah.com	2 KB
1	cloudfront.net dg6qn11ynnp6a.cloudfront.net	31 KB
3	2

	Domain	Requested by
4	www.wehwah.com	2 redirects www.wehwah.com
1	dg6qn11ynnp6a.cloudfront.net	www.wehwah.com
3	2

This site contains no links.

Subject Issuer	Validity	Valid
wehwah.com Go Daddy Secure Certificate Authority - G2	`2019-07-01` - `2020-07-01`	a year	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://www.wehwah.com/wellsfargoadmin/wfad/
Frame ID: 6C5D1C7122250C10B07F4AD7A1D9A1CB
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.wehwah.com/wellsfargoadmin/wfad HTTP 301
http://www.wehwah.com/wellsfargoadmin/wfad/ Page URL

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

32 kB
Transfer

32 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.wehwah.com/wellsfargoadmin/wfad HTTP 301
http://www.wehwah.com/wellsfargoadmin/wfad/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.wehwah.com/wellsfargoadmin/wfad/gen_validatorv2.js HTTP 301
https://www.wehwah.com/wellsfargoadmin/wfad/gen_validatorv2.js

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.wehwah.com/wellsfargoadmin/wfad/
Redirect Chain

http://www.wehwah.com/wellsfargoadmin/wfad
http://www.wehwah.com/wellsfargoadmin/wfad/

1 KB
1 KB

18ms
18ms

Document
text/html

160.153.137.210
GODADDY-AMS

General

Check archive.org

Show headers Download Go to

Full URL

http://www.wehwah.com/wellsfargoadmin/wfad/

Protocol

HTTP/1.1

Server

160.153.137.210 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),

Reverse DNS

ip-160-153-137-210.ip.secureserver.net

Software

/

Resource Hash

cb184293969aa315e2760e9fa58945bd4c58bc5882e553addf2e398188daaf7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: www.wehwah.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Last-Modified: Wed, 11 Dec 2019 03:53:48 GMT
Content-Encoding: gzip
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Type: text/html
X-Cacheable: YES:Forced
Content-Length: 806
Date: Sat, 21 Mar 2020 00:27:12 GMT
Age: 41650
Vary: Accept-Encoding, User-Agent
X-Cache: cached
X-Cache-Hit: HIT
X-Backend: all_requests
Accept-Ranges: none

Redirect headers

Content-Type: text/html; charset=iso-8859-1
X-Cacheable: YES:Forced
Location: http://www.wehwah.com/wellsfargoadmin/wfad/
Content-Encoding: gzip
Content-Length: 208
Accept-Ranges: bytes
Date: Sat, 21 Mar 2020 00:27:12 GMT
Age: 41650
Vary: User-Agent
X-Cache: cached
X-Cache-Hit: HIT
X-Backend: all_requests

GET
H2

404

gen_validatorv2.js
www.wehwah.com/wellsfargoadmin/wfad/
Redirect Chain

http://www.wehwah.com/wellsfargoadmin/wfad/gen_validatorv2.js
https://www.wehwah.com/wellsfargoadmin/wfad/gen_validatorv2.js

0
0

57ms
21ms

Script
text/html

160.153.137.210
GODADDY-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wehwah.com/wellsfargoadmin/wfad/gen_validatorv2.js
Requested by: Host: www.wehwah.com
URL: http://www.wehwah.com/wellsfargoadmin/wfad/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 160.153.137.210 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),
Reverse DNS: ip-160-153-137-210.ip.secureserver.net
Software: /
Resource Hash

Request headers

Referer: http://www.wehwah.com/wellsfargoadmin/wfad/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Date: Sat, 21 Mar 2020 00:27:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: NO:HTTPS Redirect
X-Backend: all_requests
Age: 0
X-Redirect-By: WordPress
Transfer-Encoding: chunked
X-Cache: uncached
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge
X-Cache-Hit: MISS
Content-Type: text/html; charset=UTF-8
Location: https://www.wehwah.com/wellsfargoadmin/wfad/gen_validatorv2.js
Cache-Control: no-transform, no-cache, no-store, must-revalidate
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK wellsfargo200x200.jpg
dg6qn11ynnp6a.cloudfront.net/wp-content/uploads/2016/02/02144636/ 30 KB
31 KB 436ms
394ms Image
image/jpeg 13.35.254.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dg6qn11ynnp6a.cloudfront.net/wp-content/uploads/2016/02/02144636/wellsfargo200x200.jpg
Requested by: Host: www.wehwah.com
URL: http://www.wehwah.com/wellsfargoadmin/wfad/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.254.139 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-254-139.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f2163d39d322368519ce2c0be0df0bd01b4f7b152d1f5b2dc098b3d0ff026be5

Request headers

Referer: http://www.wehwah.com/wellsfargoadmin/wfad/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sat, 21 Mar 2020 00:27:13 GMT
Via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Feb 2016 19:47:16 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA6-C1
ETag: "cd6d0b46a6c8e48e23f70d13e3542805"
X-Cache: Miss from cloudfront
x-amz-version-id: m8hDyIGakBXBPYbHrl5spMo9id6VPdHB
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 31121
X-Amz-Cf-Id: BIbudc6SZopShCiL4afKH2NXJv1vLKWWwgii5rAGo86QJ_5ogYvLmw==
Expires: Fri, 30 Jan 2026 19:46:36 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dg6qn11ynnp6a.cloudfront.net
www.wehwah.com
13.35.254.139
160.153.137.210
cb184293969aa315e2760e9fa58945bd4c58bc5882e553addf2e398188daaf7e
f2163d39d322368519ce2c0be0df0bd01b4f7b152d1f5b2dc098b3d0ff026be5

www.wehwah.com Open in urlscan Pro 160.153.137.210 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

3 Requests

67 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

32 kBTransfer

32 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www.wehwah.com Open in urlscan Pro
160.153.137.210 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

32 kB
Transfer

32 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!