wh9.whnehtz.com Open in urlscan Pro
2606:4700:3030::ac43:b8dc Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://wh9.whnehtz.com/
Submission: On December 11 via manual (December 11th 2023, 1:43:54 am UTC) from TW — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 2606:4700:3030::ac43:b8dc, located in United States and belongs to CLOUDFLARENET, US. The main domain is wh9.whnehtz.com.

This is the only time wh9.whnehtz.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger) Generic Cloudflare (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 12	2606:4700:303... 2606:4700:3030::ac43:b8dc		13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2

12 2606:4700:3030::ac43:b8dc (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

wh9.whnehtz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	whnehtz.com 1 redirects wh9.whnehtz.com	141 KB
11	1

	Domain	Requested by
12	wh9.whnehtz.com	1 redirects wh9.whnehtz.com
11	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://wh9.whnehtz.com/
Frame ID: BEC7091B5DDAD7DE10539766EE5DEB37
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WhatsApp

Page URL History Show full URLs

http://wh9.whnehtz.com/ Page URL
http://wh9.whnehtz.com/cdn-cgi/phish-bypass?atok=z4_pRNTFRW2z2lbqX27oVpxa4nYE_qC3OAU8MIMHaNs-170225... HTTP 301
http://wh9.whnehtz.com/ Page URL

Page Statistics

11
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

140 kB
Transfer

482 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://wh9.whnehtz.com/ Page URL
http://wh9.whnehtz.com/cdn-cgi/phish-bypass?atok=z4_pRNTFRW2z2lbqX27oVpxa4nYE_qC3OAU8MIMHaNs-1702259023-0-%2F HTTP 301
http://wh9.whnehtz.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
wh9.whnehtz.com/ 4 KB
2 KB 39ms
19ms Document
text/html 2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://wh9.whnehtz.com/

Protocol

HTTP/1.1

Server

2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3c6bcf0ea2518bb195d45fca08f67d970c1f55e7ce8b7ff4e6dec8103a1767a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-RAY: 833a09cf49cf9b9b-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Mon, 11 Dec 2023 01:43:43 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BsWRVa2pHvcHL6Wh9dCsuHZ6RNHtJD7QdzPCgUZiMVI0P3C%2FCeYvFQ%2BnBDGUqEBgW9czT5KEQBNjGhBut1OcLQSbOUk%2F3Il%2BopLq6xBhQ07Sn1Ksyy1VP67tdtPDC%2Fd%2B29sMGRfycVOe7mJ7sJI%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN

GET
H/1.1 200
OK cf.errors.css
wh9.whnehtz.com/cdn-cgi/styles/ 24 KB
5 KB 9ms
9ms Stylesheet
text/css 2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://wh9.whnehtz.com/cdn-cgi/styles/cf.errors.css

Requested by

Host: wh9.whnehtz.com
URL: http://wh9.whnehtz.com/

Protocol

HTTP/1.1

Server

2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Mon, 11 Dec 2023 01:43:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 01 Dec 2023 15:04:24 GMT
Server: cloudflare
ETag: W/"6569f5f8-5e44"
Transfer-Encoding: chunked
X-Frame-Options: DENY
Content-Type: text/css
Vary: Accept-Encoding
Cache-Control: max-age=7200, public
Connection: keep-alive
CF-RAY: 833a09cf79e69b9b-FRA
Expires: Mon, 11 Dec 2023 03:43:43 GMT

GET
H/1.1 200
OK icon-exclamation.png
wh9.whnehtz.com/cdn-cgi/images/ 452 B
889 B 8ms
8ms Image
image/png 2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://wh9.whnehtz.com/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: wh9.whnehtz.com
URL: http://wh9.whnehtz.com/cdn-cgi/styles/cf.errors.css

Protocol

HTTP/1.1

Server

2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Mon, 11 Dec 2023 01:43:43 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 01 Dec 2023 15:04:24 GMT
Server: cloudflare
ETag: "6569f5f8-1c4"
X-Frame-Options: DENY
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=7200, public
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 833a09cf99fc9b9b-FRA
Content-Length: 452
Expires: Mon, 11 Dec 2023 03:43:43 GMT

GET
H/1.1

200
OK

Primary Request / Show response
wh9.whnehtz.com/
Redirect Chain

http://wh9.whnehtz.com/cdn-cgi/phish-bypass?atok=z4_pRNTFRW2z2lbqX27oVpxa4nYE_qC3OAU8MIMHaNs-1702259023-0-%2F
http://wh9.whnehtz.com/

10 KB
5 KB

520ms
520ms

Document
text/html

2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://wh9.whnehtz.com/
Protocol: HTTP/1.1
Server: 2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: edb8c2f5689459986e223d697b3137e90ea9f7166a071e88778c9ef00d93dcad

Request headers

Referer: http://wh9.whnehtz.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 833a09f0699c9b9b-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 11 Dec 2023 01:43:49 GMT
Last-Modified: Wed, 15 Nov 2023 04:19:21 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jlwb1VqmGNISewjLxYk6NS%2FXeQhYh46NpbUr7oQjSLDsFd8mj4YCn6L%2BbnvTkC5g9DnW1szMieJi4u5S4Wo1Fvu1%2F0KRAWOl%2BO0kFY0Cqh1wTBSq97Lj3pPp5dGJiRpAx9IXFr3EwYflQHI0B14%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400

Redirect headers

CF-RAY: 833a09f059959b9b-FRA
Cache-Control: private, no-cache
Connection: keep-alive
Content-Length: 167
Content-Type: text/html
Date: Mon, 11 Dec 2023 01:43:48 GMT
Location: http://wh9.whnehtz.com/
Server: cloudflare
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

GET
H/1.1 404
Not Found elyjhbuq.css
wh9.whnehtz.com/css/ 0
0 523ms
522ms Stylesheet
text/html 2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://wh9.whnehtz.com/css/elyjhbuq.css
Requested by: Host: wh9.whnehtz.com
URL: http://wh9.whnehtz.com/
Protocol: HTTP/1.1
Server: 2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Mon, 11 Dec 2023 01:43:49 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oX2Zz9DAV06AMzbiId4ZiroNvPOwbX8OOGOg275x8UkAJ2cD7yUtOLM5UoWGkpDksU29fjsjDsLuU52a%2BNVOAQgG7iBXSwx44iOwdXYnIkmpOrLxUDlFJabCJedRKsEOn0RQ0oRZsqFSmZXnR6Y%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html
Vary: Accept-Encoding
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 833a09f3bb5d9b9b-FRA
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK lavrcvcn.css
wh9.whnehtz.com/css/ 91 KB
23 KB 792ms
785ms Stylesheet
text/css 2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://wh9.whnehtz.com/css/lavrcvcn.css
Requested by: Host: wh9.whnehtz.com
URL: http://wh9.whnehtz.com/
Protocol: HTTP/1.1
Server: 2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 455f7bef247c7bd3cad535a636bfc25f89cb3371a728b14f048c21e4b9cc0580

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Mon, 11 Dec 2023 01:43:49 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Last-Modified: Thu, 28 Sep 2023 10:13:27 GMT
Server: cloudflare
ETag: W/"651551c7-16d49"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dKWvRParqcEgBgKSZqGNJ7rZYoIgzzrfw%2FQZqHW8FDGWea0XSzA3yHYn%2BsbAjHuS9nd9x9N7WpAbRuuqz4afEbRFLPiCMYqsKUN0ja3HN%2FitdZX%2BjT09Dz2CgboeXMb%2Fikg2xMRPfnAVi41o5Hg%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=43200
CF-RAY: 833a09f3b8db1db3-FRA
Expires: Mon, 11 Dec 2023 13:43:49 GMT

GET
H/1.1 200
OK zlqogvry.css
wh9.whnehtz.com/css/ 226 KB
54 KB 781ms
774ms Stylesheet
text/css 2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://wh9.whnehtz.com/css/zlqogvry.css
Requested by: Host: wh9.whnehtz.com
URL: http://wh9.whnehtz.com/
Protocol: HTTP/1.1
Server: 2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9cbfd4f00c4210688faaecdace3d2877e5c789a7c8d06f1d0c49507b55de6a2b

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Mon, 11 Dec 2023 01:43:49 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Last-Modified: Thu, 28 Sep 2023 10:13:26 GMT
Server: cloudflare
ETag: W/"651551c6-38629"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15Tkvtw%2FDfbN8P1KVlCB4SsEmaEYuen8OV8azV5MM8c6BYDiRhvEUlgbo7tLmV9whVjdX7bmWHizH6uqeCPoDqFf9buz5Ocs%2FIFHHutKSZqpyOBALrUIAJRYzqQdV%2B3VwuR%2BqPTCw0oSWIGoBX4%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=43200
CF-RAY: 833a09f3bb0830f6-FRA
Expires: Mon, 11 Dec 2023 13:43:49 GMT

GET
H/1.1 200
OK nusanwvi.js Show response
wh9.whnehtz.com/js/ 91 KB
37 KB 774ms
767ms Script
application/javascript 2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://wh9.whnehtz.com/js/nusanwvi.js
Requested by: Host: wh9.whnehtz.com
URL: http://wh9.whnehtz.com/
Protocol: HTTP/1.1
Server: 2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0108076470765be9ef1e9b242b8a52ef78c8f4532c7263426abc05ea4b60240

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Mon, 11 Dec 2023 01:43:49 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Last-Modified: Thu, 28 Sep 2023 10:13:26 GMT
Server: cloudflare
ETag: W/"651551c6-16bab"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EyhROgDy27ca56QjDiHBn4rb7i46zCbk1v7WlRmRh7lU4w4yKqQmWHwjfdkagiJpynoH%2BRqyU5ljBu4QVVckKI7ndxuNpmLD3ZaOJkyYI36rBmfKr7pKJWvxU8Q7NKdBSP1KO1zPpPpxQS7NUsk%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=43200
CF-RAY: 833a09f3bda74dbd-FRA
Expires: Mon, 11 Dec 2023 13:43:49 GMT

GET
H/1.1 200
OK vvhdurae.js Show response
wh9.whnehtz.com/js/ 3 KB
2 KB 536ms
530ms Script
application/javascript 2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://wh9.whnehtz.com/js/vvhdurae.js
Requested by: Host: wh9.whnehtz.com
URL: http://wh9.whnehtz.com/
Protocol: HTTP/1.1
Server: 2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55c173330e36aaceaf268be4fe4421376a4e9eab4ce0de8e32aeb1c75f1181af

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Mon, 11 Dec 2023 01:43:49 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Last-Modified: Thu, 28 Sep 2023 10:13:26 GMT
Server: cloudflare
ETag: W/"651551c6-c30"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ivIDAr%2FpcB7Ir2NEvaC2TE9ckm%2FeMvTBM8%2FLytUMvGCocDtSOCsjCRBroHEHGWVWlsCNc%2FE4wqC5%2B9U0dPZRrqr%2FrsaV8bZDdsd0u2WBFQKonWcY5s382b%2BYubNF1Cbgl58RanMw6VkgQZo8zwo%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=43200
CF-RAY: 833a09f3b89371be-FRA
Expires: Mon, 11 Dec 2023 13:43:49 GMT

GET
H/1.1 200
OK fcktuoif.js Show response
wh9.whnehtz.com/js/ 19 KB
8 KB 651ms
632ms Script
application/javascript 2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://wh9.whnehtz.com/js/fcktuoif.js
Requested by: Host: wh9.whnehtz.com
URL: http://wh9.whnehtz.com/
Protocol: HTTP/1.1
Server: 2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Mon, 11 Dec 2023 01:43:49 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Last-Modified: Thu, 28 Sep 2023 10:13:26 GMT
Server: cloudflare
ETag: W/"651551c6-4dd7"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dadyNffm6KVJltKhN7ZoZHXN72kQ8xeaMAr8oY0aJg4kLT%2FCYpUzNEuGxKsxuyDNq7l4Ok7nkQz1xKW1ziQz%2BYJuL7v9L8Fa7nbDdIdLkmK%2BYkFb%2FJAA8796XdI4t%2F77a%2Fhg4OSDyD%2BQd5qCFGs%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=43200
CF-RAY: 833a09f3d9395b81-VIE
Expires: Mon, 11 Dec 2023 13:43:49 GMT

GET
H/1.1 200
OK qwaiicgb.js Show response
wh9.whnehtz.com/js/ 3 KB
2 KB 1050ms
528ms Script
application/javascript 2606:4700:3030::ac43:b8dc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://wh9.whnehtz.com/js/qwaiicgb.js
Requested by: Host: wh9.whnehtz.com
URL: http://wh9.whnehtz.com/
Protocol: HTTP/1.1
Server: 2606:4700:3030::ac43:b8dc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c659c637ba61f18e01a3aff0c2d8faf8814b2dc74ad2d906e2b51c22bcedce9

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Mon, 11 Dec 2023 01:43:50 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Last-Modified: Tue, 31 Oct 2023 01:49:54 GMT
Server: cloudflare
ETag: W/"65405d42-dc3"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=72yQLB1ViENyx2JpGTFYZwiS8A6xfhyoIDmo2RrjgECIKIU5dFRzTSHkOOc21%2Bm9SBxcJbVwy3uOcZJYP2AWH9DKm1DoPgFtnZZu8WSka2YthsWS2%2FsTLznwEP1Unom2%2Bc0caiUj8%2FzeNzXFNHk%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=43200
CF-RAY: 833a09f6fd7d9b9b-FRA
Expires: Mon, 11 Dec 2023 13:43:49 GMT

GET
DATA 200
OK truncated
/ 85 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4692e35f75eb12f97a925b1ce7da0a41eeede3e90da06a214bbcf416aaf9d730

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://wh9.whnehtz.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger) Generic Cloudflare (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.wh9.whnehtz.com/	1970-01-20 16:52:25	Name: __cf_mw_byp Value: z4_pRNTFRW2z2lbqX27oVpxa4nYE_qC3OAU8MIMHaNs-1702259023-0-/

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://wh9.whnehtz.com/css/elyjhbuq.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

wh9.whnehtz.com
2606:4700:3030::ac43:b8dc
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
1c659c637ba61f18e01a3aff0c2d8faf8814b2dc74ad2d906e2b51c22bcedce9
455f7bef247c7bd3cad535a636bfc25f89cb3371a728b14f048c21e4b9cc0580
4692e35f75eb12f97a925b1ce7da0a41eeede3e90da06a214bbcf416aaf9d730
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
55c173330e36aaceaf268be4fe4421376a4e9eab4ce0de8e32aeb1c75f1181af
9cbfd4f00c4210688faaecdace3d2877e5c789a7c8d06f1d0c49507b55de6a2b
b3c6bcf0ea2518bb195d45fca08f67d970c1f55e7ce8b7ff4e6dec8103a1767a
c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36
e0108076470765be9ef1e9b242b8a52ef78c8f4532c7263426abc05ea4b60240
edb8c2f5689459986e223d697b3137e90ea9f7166a071e88778c9ef00d93dcad
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

wh9.whnehtz.com Open in urlscan Pro 2606:4700:3030::ac43:b8dc Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

11 Requests

0 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

140 kBTransfer

482 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

wh9.whnehtz.com Open in urlscan Pro
2606:4700:3030::ac43:b8dc Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

140 kB
Transfer

482 kB
Size

1
Cookies

11 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!