www.whereismymoney.wtf Open in urlscan Pro
2a09:8280:1::36:6a18:0 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.whereismymoney.wtf/
Submission: On May 22 via automatic, source certstream-suspicious (May 22nd 2024, 2:37:26 am UTC) — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2a09:8280:1::36:6a18:0, located in United States and belongs to FLY, US. The main domain is www.whereismymoney.wtf.
TLS certificate: Issued by R3 on May 22nd 2024. Valid for: 3 months.

This is the only time www.whereismymoney.wtf was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
10	2a09:8280:1::... 2a09:8280:1::36:6a18:0		40509 (FLY) (FLY)
10	1

10 2a09:8280:1::36:6a18:0 (United States)

ASN40509 (FLY, US)

www.whereismymoney.wtf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	whereismymoney.wtf www.whereismymoney.wtf	695 KB
10	1

	Domain	Requested by
10	www.whereismymoney.wtf	www.whereismymoney.wtf
10	1

This site contains no links.

Subject Issuer	Validity	Valid
www.whereismymoney.wtf R3	`2024-05-22` - `2024-08-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.whereismymoney.wtf/
Frame ID: 1BC3F9F1F3EC0DA51647C83E78946A96
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Actual

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

695 kB
Transfer

1611 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.whereismymoney.wtf/	3 KB 1 KB	838ms 249ms	Document text/html	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://www.whereismymoney.wtf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `bda62497c65e842b9f12c759ffcb2412e0e4db976abb1df5c69a39fab42bc564` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers accept-ranges bytes access-control-allow-origin * cache-control public, max-age=0 content-encoding zstd content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin date Wed, 22 May 2024 02:37:20 GMT etag W/"aa2-18f3f5f8a28" fly-request-id 01HYF2J20149N5ZM3DERT5SAKR-ams last-modified Fri, 03 May 2024 16:52:57 GMT ratelimit-limit 500 ratelimit-remaining 499 ratelimit-reset 32 server Fly/ff37a3cc6 (2024-05-21) via 2 fly.io
GET H2	200	index.e2n2xYYD.js Show response www.whereismymoney.wtf/static/js/	1 MB 424 KB	149ms 148ms	Script application/javascript	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://www.whereismymoney.wtf/static/js/index.e2n2xYYD.js Requested by Host: www.whereismymoney.wtf URL: https://www.whereismymoney.wtf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `576799ab741159a2ef67dec22e42ce932ac168138ecfbf809fe2365bbf52045e` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.whereismymoney.wtf/ Origin https://www.whereismymoney.wtf Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 32 content-encoding zstd via 2 fly.io date Wed, 22 May 2024 02:37:20 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:56 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYF2J290H5JA4MTDFRJGVC67-ams etag W/"13072f-18f3f5f8640" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 496
GET H2	200	index.2TAnPdFY.css www.whereismymoney.wtf/static/css/	6 KB 2 KB	146ms 145ms	Stylesheet text/css	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://www.whereismymoney.wtf/static/css/index.2TAnPdFY.css Requested by Host: www.whereismymoney.wtf URL: https://www.whereismymoney.wtf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `b1e605baf2ed39ba6a150b489b3fe60d9a9e014137e57d932fa5a9a27e4ae749` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.whereismymoney.wtf/ Origin https://www.whereismymoney.wtf Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 32 content-encoding zstd via 2 fly.io date Wed, 22 May 2024 02:37:20 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:56 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYF2J290R10ABJ4E8TBQNEC0-ams etag W/"1618-18f3f5f8640" content-type text/css; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 498
GET H2	200	registerSW.js Show response www.whereismymoney.wtf/	134 B 234 B	148ms 148ms	Script application/javascript	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://www.whereismymoney.wtf/registerSW.js Requested by Host: www.whereismymoney.wtf URL: https://www.whereismymoney.wtf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `9742073ef7fc795e7673d98f272992843298426a0ffd8cb3507784df5143608b` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.whereismymoney.wtf/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 32 content-encoding zstd via 2 fly.io date Wed, 22 May 2024 02:37:20 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:57 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYF2J290N4EPP9STV0BDA5KK-ams etag W/"86-18f3f5f8a28" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 497
GET H2	200	Inter-roman.var.vq-Vth46.woff2 www.whereismymoney.wtf/static/media/	222 KB 222 KB	147ms 147ms	Font font/woff2	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://www.whereismymoney.wtf/static/media/Inter-roman.var.vq-Vth46.woff2?v=3.19 Requested by Host: www.whereismymoney.wtf URL: https://www.whereismymoney.wtf/static/css/index.2TAnPdFY.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `17fe38ab302c7e5dbfb5c3d87801092d79be958500db6412ed3bc0f126bd53d3` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.whereismymoney.wtf/static/css/index.2TAnPdFY.css Origin https://www.whereismymoney.wtf Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 31 date Wed, 22 May 2024 02:37:21 GMT via 2 fly.io cross-origin-embedder-policy require-corp ratelimit-limit 500 content-length 227180 last-modified Fri, 03 May 2024 16:52:56 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYF2J32Z58PMJ1ZMCYZ7VKAB-ams etag W/"3776c-18f3f5f8640" content-type font/woff2 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 495
GET H2	200	BackgroundImage.8QJr5Ysu.chunk.js Show response www.whereismymoney.wtf/static/js/	117 KB 39 KB	159ms 158ms	Script application/javascript	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://www.whereismymoney.wtf/static/js/BackgroundImage.8QJr5Ysu.chunk.js Requested by Host: www.whereismymoney.wtf URL: https://www.whereismymoney.wtf/static/js/index.e2n2xYYD.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `51165a0ee4182d93f71ed1d3c5111fbe0123a5946a84e8e12f13e1f22ac4cbf0` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.whereismymoney.wtf/static/js/index.e2n2xYYD.js Origin https://www.whereismymoney.wtf Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 31 content-encoding zstd via 2 fly.io date Wed, 22 May 2024 02:37:21 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:56 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYF2J330JT2TYN2FNDN42C1E-ams etag W/"1d3cc-18f3f5f8640" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 493
GET H2	200	browser-server.Kf_xQo8f.js www.whereismymoney.wtf/static/js/	2 KB 1 KB	160ms 159ms	Other application/javascript	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://www.whereismymoney.wtf/static/js/browser-server.Kf_xQo8f.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `209dfc7018a868172d2731de10613e57d1fda3eb22827cfe325e4e19a7dd4bd1` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.whereismymoney.wtf/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 31 content-encoding zstd via 2 fly.io date Wed, 22 May 2024 02:37:21 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:56 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYF2J3302MTNZ58Q0GQFNYSX-ams etag W/"8a0-18f3f5f8640" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 494
GET H2	200	favicon.ico www.whereismymoney.wtf/	15 KB 4 KB	145ms 144ms	Other image/x-icon	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://www.whereismymoney.wtf/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `8934b6301f853ec67afdcfe14673134ceb0178fd802c3b3f9aa1b6d1cc82b1fb` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.whereismymoney.wtf/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 31 content-encoding zstd via 2 fly.io date Wed, 22 May 2024 02:37:21 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:57 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYF2J3517Z62XVVV9HV506VR-ams etag W/"3aee-18f3f5f8a28" content-type image/x-icon access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 491
GET H2	200	favicon.ico www.whereismymoney.wtf/	15 KB 84 B	150ms 149ms	Other image/x-icon	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://www.whereismymoney.wtf/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `8934b6301f853ec67afdcfe14673134ceb0178fd802c3b3f9aa1b6d1cc82b1fb` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.whereismymoney.wtf/bootstrap Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 30 date Wed, 22 May 2024 02:37:22 GMT via 2 fly.io content-encoding zstd cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:57 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYF2J4EKPCZKSS1CBY3DAB2S-ams etag W/"3aee-18f3f5f8a28" content-type image/x-icon access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 450
GET H2	200	favicon.ico www.whereismymoney.wtf/	15 KB 82 B	160ms 159ms	Other image/x-icon	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://www.whereismymoney.wtf/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `8934b6301f853ec67afdcfe14673134ceb0178fd802c3b3f9aa1b6d1cc82b1fb` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.whereismymoney.wtf/login Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 29 date Wed, 22 May 2024 02:37:23 GMT via 2 fly.io content-encoding zstd cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:57 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYF2J4W94GEQ4XD7A1CW6YQ8-ams etag W/"3aee-18f3f5f8a28" content-type image/x-icon access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 443

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://www.whereismymoney.wtf/login Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.whereismymoney.wtf
2a09:8280:1::36:6a18:0
17fe38ab302c7e5dbfb5c3d87801092d79be958500db6412ed3bc0f126bd53d3
209dfc7018a868172d2731de10613e57d1fda3eb22827cfe325e4e19a7dd4bd1
51165a0ee4182d93f71ed1d3c5111fbe0123a5946a84e8e12f13e1f22ac4cbf0
576799ab741159a2ef67dec22e42ce932ac168138ecfbf809fe2365bbf52045e
8934b6301f853ec67afdcfe14673134ceb0178fd802c3b3f9aa1b6d1cc82b1fb
9742073ef7fc795e7673d98f272992843298426a0ffd8cb3507784df5143608b
b1e605baf2ed39ba6a150b489b3fe60d9a9e014137e57d932fa5a9a27e4ae749
bda62497c65e842b9f12c759ffcb2412e0e4db976abb1df5c69a39fab42bc564

www.whereismymoney.wtf Open in urlscan Pro 2a09:8280:1::36:6a18:0 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

695 kBTransfer

1611 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.whereismymoney.wtf Open in urlscan Pro
2a09:8280:1::36:6a18:0 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

695 kB
Transfer

1611 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions