urlscan.io logo urlscan.io
SecurityTrails logo

wfl.kwi.mybluehost.me Open in urlscan Pro
50.87.227.169  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://wfl.kwi.mybluehost.me/ope/wallet.php
Submission: On March 12 via manual from IL — Scanned from IL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 50.87.227.169, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is wfl.kwi.mybluehost.me.
TLS certificate: Issued by R3 on February 15th 2024. Valid for: 3 months.
This is the only time wfl.kwi.mybluehost.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Crypto (Crypto Exchange) Opensea (Crypto)

Domain & IP information

IP Address AS Autonomous System
5 50.87.227.169 46606 (UNIFIEDLA...)
5 2
Apex Domain
Subdomains		 Transfer
5 mybluehost.me
wfl.kwi.mybluehost.me
703 KB
5 1
Domain Requested by
5 wfl.kwi.mybluehost.me wfl.kwi.mybluehost.me
5 1
Subject Issuer Validity Valid
www.wfl.kwi.mybluehost.me
R3		 2024-02-15 -
2024-05-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://wfl.kwi.mybluehost.me/ope/wallet.php
Frame ID: F45867F931D0A5F01ECD5B275C137D11
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login | OpenSea

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1004 kB
Transfer

1246 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request wallet.php
wfl.kwi.mybluehost.me/ope/ 		809 KB
587 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wfl.kwi.mybluehost.me/ope/wallet.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.227.169 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2407.bluehost.com
Software
nginx/1.21.6 /
Resource Hash
345a7e1f85956f9d2388ec6a3870e1d15e225d996c965f31c36575498d72129d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language
he-IL,he;q=0.9

Response headers

cache-control
max-age=7200
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 12 Mar 2024 17:09:54 GMT
expires
Tue, 12 Mar 2024 19:09:53 GMT
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
server
nginx/1.21.6
vary
Accept-Encoding
x-endurance-cache-level
2
x-newfold-cache-level
2
x-nginx-cache
WordPress
x-server-cache
false
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8ae5fefbaeebd874dfebfc4b5ef2a251005ae26b0a7cb9bd531a1c131c44f6ad

Request headers

accept-language
he-IL,he;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b93b9165269362989e2855d0bf0ae232d7193a45c43627b2d03b26d7eb98263b

Request headers

Referer
Origin
https://wfl.kwi.mybluehost.me
accept-language
he-IL,he;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c

Request headers

Referer
Origin
https://wfl.kwi.mybluehost.me
accept-language
he-IL,he;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		141 KB
141 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
23cd2c17288f62185da41d5ad8e418b65d4068b022217bd885398fb584092857

Request headers

Referer
Origin
https://wfl.kwi.mybluehost.me
accept-language
he-IL,he;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		65 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a0b0bbbb5b7b0c903f39703faec03c9f1d923d5ed3ea8d769fdef4cff94462a3

Request headers

Referer
Origin
https://wfl.kwi.mybluehost.me
accept-language
he-IL,he;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/ 		65 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
69c3f287652cedc8ffe13c2424d9009f2636cfb541b96ff01722c001ba332a98

Request headers

Referer
Origin
https://wfl.kwi.mybluehost.me
accept-language
he-IL,he;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
font/woff
metamask-alternative.png
wfl.kwi.mybluehost.me/ope/files/ 		61 KB
61 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wfl.kwi.mybluehost.me/ope/files/metamask-alternative.png
Requested by
Host: wfl.kwi.mybluehost.me
URL: https://wfl.kwi.mybluehost.me/ope/wallet.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.227.169 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2407.bluehost.com
Software
Apache /
Resource Hash
5e45e1bc3b0e1c17fc51b0cc145a1f99bb0dd93959afa62d7166204dbcecdd3c

Request headers

accept-language
he-IL,he;q=0.9
Referer
https://wfl.kwi.mybluehost.me/ope/wallet.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date
Tue, 12 Mar 2024 17:09:55 GMT
x-nginx-cache
WordPress
last-modified
Fri, 14 Jan 2022 00:58:50 GMT
server
Apache
x-newfold-cache-level
2
x-endurance-cache-level
2
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
62154
expires
Wed, 12 Mar 2025 17:09:55 GMT
truncated
/ 		11 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f1e60c2a2d01520a2e4d593226b158ab6f1caa9e0eb1908dd08d516af59bdea

Request headers

accept-language
he-IL,he;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
56f27987ad3ced2c98776375e3e0554ec3e49d9d30585eb3274723963eed3d70

Request headers

accept-language
he-IL,he;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
image/webp
trust-alternative.png
wfl.kwi.mybluehost.me/ope/files/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wfl.kwi.mybluehost.me/ope/files/trust-alternative.png
Requested by
Host: wfl.kwi.mybluehost.me
URL: https://wfl.kwi.mybluehost.me/ope/wallet.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.227.169 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2407.bluehost.com
Software
Apache /
Resource Hash
dbc6b5512ca6a2fc08f2af7f246d300c7b0ffce7da57bed015f2830a4239f515

Request headers

accept-language
he-IL,he;q=0.9
Referer
https://wfl.kwi.mybluehost.me/ope/wallet.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date
Tue, 12 Mar 2024 17:09:55 GMT
x-nginx-cache
WordPress
last-modified
Fri, 14 Jan 2022 00:58:52 GMT
server
Apache
x-newfold-cache-level
2
x-endurance-cache-level
2
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
5498
expires
Wed, 12 Mar 2025 17:09:55 GMT
cro.png
wfl.kwi.mybluehost.me/ope/files/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wfl.kwi.mybluehost.me/ope/files/cro.png
Requested by
Host: wfl.kwi.mybluehost.me
URL: https://wfl.kwi.mybluehost.me/ope/wallet.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.227.169 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2407.bluehost.com
Software
Apache /
Resource Hash
497efbadb415ad5dd815532463cf41f99df435547030a05622c59c868930fc1a

Request headers

accept-language
he-IL,he;q=0.9
Referer
https://wfl.kwi.mybluehost.me/ope/wallet.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date
Tue, 12 Mar 2024 17:09:55 GMT
x-nginx-cache
WordPress
last-modified
Fri, 14 Jan 2022 06:00:46 GMT
server
Apache
x-newfold-cache-level
2
x-endurance-cache-level
2
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
19148
expires
Wed, 12 Mar 2025 17:09:55 GMT
hardware.jpg
wfl.kwi.mybluehost.me/ope/files/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wfl.kwi.mybluehost.me/ope/files/hardware.jpg
Requested by
Host: wfl.kwi.mybluehost.me
URL: https://wfl.kwi.mybluehost.me/ope/wallet.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.227.169 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2407.bluehost.com
Software
Apache /
Resource Hash
ed41eebc222b66d7499fd22cb60e3ae1574a6cc9a0d5fd2e8550490e55b19673

Request headers

accept-language
he-IL,he;q=0.9
Referer
https://wfl.kwi.mybluehost.me/ope/wallet.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date
Tue, 12 Mar 2024 17:09:55 GMT
x-nginx-cache
WordPress
last-modified
Fri, 14 Jan 2022 08:56:16 GMT
server
Apache
x-newfold-cache-level
2
x-endurance-cache-level
2
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
31928
expires
Wed, 12 Mar 2025 17:09:55 GMT
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d79ac289a5efb3158ff63a02ee4dbe102a69890f69302bce8ef05c989d4d4e76

Request headers

accept-language
he-IL,he;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b0b43e548e691662dac85b1dc159d148a273d5cb9139f3fcf457cdeebe7bdf3f

Request headers

Referer
Origin
https://wfl.kwi.mybluehost.me
accept-language
he-IL,he;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491

Request headers

Referer
Origin
https://wfl.kwi.mybluehost.me
accept-language
he-IL,he;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Content-Type
font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange) Opensea (Crypto)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| myFunction function| yourFunction function| herFunction function| hisFunction function| thisFunction function| thatFunction

0 Cookies