www.huaythai.bet Open in urlscan Pro
184.168.103.18  Malicious Activity! Public Scan

URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Submission: On October 30 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 184.168.103.18, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is www.huaythai.bet.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on June 11th 2021. Valid for: a year.
This is the only time www.huaythai.bet was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

IP Address AS Autonomous System
1 13 184.168.103.18 26496 (AS-26496-...)
12 2
Apex Domain
Subdomains
Transfer
13 huaythai.bet
www.huaythai.bet
135 KB
12 1
Domain Requested by
13 www.huaythai.bet 1 redirects www.huaythai.bet
12 1

This site contains no links.

Subject Issuer Validity Valid
huaythai.bet
Go Daddy Secure Certificate Authority - G2
2021-06-11 -
2022-06-11
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Frame ID: 691534C457C35FC0A8BAA710D689DCDF
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

Sign On to View Your Personal Accounts | Wells Fargo

Page URL History Show full URLs

  1. https://www.huaythai.bet/W-F-J-E/connect.secure/log/present HTTP 301
    https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/ Page URL

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

135 kB
Transfer

158 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.huaythai.bet/W-F-J-E/connect.secure/log/present HTTP 301
    https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Redirect Chain
  • https://www.huaythai.bet/W-F-J-E/connect.secure/log/present
  • https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
8 KB
2 KB
Document
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
8eb602c4598b354a7c62ac6f666e2da5e82ed5797c069ca360d3614758fd9ec3

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

last-modified
Tue, 30 Jun 2020 10:38:06 GMT
etag
"3a0860-1f5e-5a94ac5471f80-gzip"
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-length
2243
content-type
text/html
date
Sat, 30 Oct 2021 04:12:22 GMT
server
Apache

Redirect headers

location
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
content-length
268
content-type
text/html; charset=iso-8859-1
date
Sat, 30 Oct 2021 04:12:22 GMT
server
Apache
global.css
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
20 KB
6 KB
Stylesheet
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/global.css
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
ab78c44d5e86c6f0937d203066ebcadbf50c8d63407564a151bdd03701f40a70

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:22 GMT
content-encoding
gzip
last-modified
Wed, 11 Dec 2019 06:08:04 GMT
server
Apache
etag
"3a08cb-4f7f-59967739e7900-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
6116
enhanced-header.css
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
3 KB
940 B
Stylesheet
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/enhanced-header.css
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
11fd2cc5f2cc82ea984dd99a18390a813349cfecd37077c3f4435974dc379b13

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:22 GMT
content-encoding
gzip
last-modified
Wed, 11 Dec 2019 06:08:04 GMT
server
Apache
etag
"3a08ca-d67-59967739e7900-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
881
wf.css
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
199 B
224 B
Stylesheet
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/wf.css
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
5b38f2f8c09ad0b050e4ec97524f3eb95b8c1fa2cf1b5a922eb4172608e4afc1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:22 GMT
content-encoding
gzip
last-modified
Wed, 11 Dec 2019 06:08:06 GMT
server
Apache
etag
"3a08d7-c7-5996773bcfd80-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
143
enhanced-footer.css
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
2 KB
816 B
Stylesheet
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/enhanced-footer.css
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
704696b05477be71b7dab1e8e56d93f28701966e6d423ddd23f0f2f399dd9199

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:22 GMT
content-encoding
gzip
last-modified
Wed, 11 Dec 2019 06:08:04 GMT
server
Apache
etag
"3a08c9-841-59967739e7900-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
727
content.css
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
795 B
451 B
Stylesheet
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/content.css
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
bf120b51d4e994276dd845c9692f541b29d96a180302db8c200b55d458072606

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:22 GMT
content-encoding
gzip
last-modified
Wed, 11 Dec 2019 06:08:04 GMT
server
Apache
etag
"3a08c8-31b-59967739e7900-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
392
BIM_icon_masthead_wf-logo-white.svg
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
6 KB
6 KB
Image
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/BIM_icon_masthead_wf-logo-white.svg
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
f2f688e65b5ec6a0b1a30207b5f29ce559779125b8169a8aff61095597489153

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:22 GMT
last-modified
Wed, 11 Dec 2019 06:08:04 GMT
server
Apache
accept-ranges
bytes
etag
"3a08c6-1828-59967739e7900"
content-length
6184
content-type
image/svg+xml
BIM_icons_search.svg
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
2 KB
2 KB
Image
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/BIM_icons_search.svg
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
1bbc5b36bd3ca1fe77072424fc4f458b2058217760c8870c7290cfcf8da3b0e6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:22 GMT
last-modified
Wed, 11 Dec 2019 06:08:04 GMT
server
Apache
accept-ranges
bytes
etag
"3a08ae-932-59967739e7900"
content-length
2354
content-type
image/svg+xml
hom.svg
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
91 KB
91 KB
Image
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/hom.svg
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
27e51767000be839c271d64e21add686a6f770809498fb6cd43fe34e56669207

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:22 GMT
last-modified
Wed, 11 Dec 2019 06:08:04 GMT
server
Apache
accept-ranges
bytes
etag
"3a08cc-16a48-59967739e7900"
content-length
92744
content-type
image/svg+xml
svuser.png
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
889 B
950 B
Image
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/svuser.png
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
f7899cfdbc342decc4aeb0bae9ada39bfaa8ae3c687fc72119fca2efdf77dff2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:22 GMT
last-modified
Wed, 11 Dec 2019 06:08:04 GMT
server
Apache
accept-ranges
bytes
etag
"3a08d2-379-59967739e7900"
content-length
889
content-type
image/png
arw.png
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
1 KB
1 KB
Image
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/arw.png
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
df500743bbedcef7623fdf2ef0c05ca411437c6216674271f4cc8b32f910f96d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:22 GMT
last-modified
Wed, 11 Dec 2019 06:08:04 GMT
server
Apache
accept-ranges
bytes
etag
"3a08ad-40c-59967739e7900"
content-length
1036
content-type
image/png
WellsFargoSans_W_Rg.woff2
www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/
22 KB
22 KB
Font
General
Full URL
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/WellsFargoSans_W_Rg.woff2
Requested by
Host: www.huaythai.bet
URL: https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/wf.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.103.18 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-103-18.ip.secureserver.net
Software
Apache /
Resource Hash
ecf9cc76cd1cf5e206fd8407e7db65807bb6ddeec390d0bb9f2f8277cda91f61

Request headers

Referer
https://www.huaythai.bet/W-F-J-E/connect.secure/log/present/jero/wf.css
Origin
https://www.huaythai.bet
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 04:12:23 GMT
last-modified
Wed, 11 Dec 2019 06:08:06 GMT
server
Apache
accept-ranges
bytes
etag
"3a08d6-57e4-5996773bcfd80"
content-length
22500
content-type
font/woff2
truncated
/
839 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b99dead0deb91299630edd2fdc72855aac3836ea262473d47348e218a7744264

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies