whereismymoney.wtf Open in urlscan Pro
2a09:8280:1::36:6a18:0 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://whereismymoney.wtf/
Submission: On May 26 via api (May 26th 2024, 3:13:10 am UTC) from BE — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2a09:8280:1::36:6a18:0, located in United States and belongs to FLY, US. The main domain is whereismymoney.wtf.
TLS certificate: Issued by R3 on May 22nd 2024. Valid for: 3 months.

This is the only time whereismymoney.wtf was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
10	2a09:8280:1::... 2a09:8280:1::36:6a18:0		40509 (FLY) (FLY)
10	1

10 2a09:8280:1::36:6a18:0 (United States)

ASN40509 (FLY, US)

whereismymoney.wtf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	whereismymoney.wtf whereismymoney.wtf	694 KB
10	1

	Domain	Requested by
10	whereismymoney.wtf	whereismymoney.wtf
10	1

This site contains no links.

Subject Issuer	Validity	Valid
whereismymoney.wtf R3	`2024-05-22` - `2024-08-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://whereismymoney.wtf/
Frame ID: D8AC90CD91FA50D0C52EE6429FBA3532
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Actual

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

694 kB
Transfer

1611 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response whereismymoney.wtf/	3 KB 1 KB	411ms 312ms	Document text/html	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://whereismymoney.wtf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `bda62497c65e842b9f12c759ffcb2412e0e4db976abb1df5c69a39fab42bc564` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers accept-ranges bytes access-control-allow-origin * cache-control public, max-age=0 content-encoding zstd content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin date Sun, 26 May 2024 03:13:05 GMT etag W/"aa2-18f3f5f8a28" fly-request-id 01HYSE6CE34GF63C4GZVFN968C-ams last-modified Fri, 03 May 2024 16:52:57 GMT ratelimit-limit 500 ratelimit-remaining 498 ratelimit-reset 8 server Fly/ff37a3cc6 (2024-05-21) via 2 fly.io
GET H2	200	index.e2n2xYYD.js Show response whereismymoney.wtf/static/js/	1 MB 424 KB	146ms 145ms	Script application/javascript	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://whereismymoney.wtf/static/js/index.e2n2xYYD.js Requested by Host: whereismymoney.wtf URL: https://whereismymoney.wtf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `576799ab741159a2ef67dec22e42ce932ac168138ecfbf809fe2365bbf52045e` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://whereismymoney.wtf/ Origin https://whereismymoney.wtf Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 8 content-encoding zstd via 2 fly.io date Sun, 26 May 2024 03:13:05 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:56 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYSE6CR9VXH29CMKD94XGWJT-ams etag W/"13072f-18f3f5f8640" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 497
GET H2	200	index.2TAnPdFY.css whereismymoney.wtf/static/css/	6 KB 2 KB	165ms 164ms	Stylesheet text/css	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://whereismymoney.wtf/static/css/index.2TAnPdFY.css Requested by Host: whereismymoney.wtf URL: https://whereismymoney.wtf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `b1e605baf2ed39ba6a150b489b3fe60d9a9e014137e57d932fa5a9a27e4ae749` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://whereismymoney.wtf/ Origin https://whereismymoney.wtf Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 8 content-encoding zstd via 2 fly.io date Sun, 26 May 2024 03:13:05 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:56 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYSE6CR9MGXFGBEJZPBX21TK-ams etag W/"1618-18f3f5f8640" content-type text/css; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 495
GET H2	200	registerSW.js Show response whereismymoney.wtf/	134 B 206 B	155ms 155ms	Script application/javascript	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://whereismymoney.wtf/registerSW.js Requested by Host: whereismymoney.wtf URL: https://whereismymoney.wtf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `9742073ef7fc795e7673d98f272992843298426a0ffd8cb3507784df5143608b` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://whereismymoney.wtf/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 8 content-encoding zstd via 2 fly.io date Sun, 26 May 2024 03:13:05 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:57 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYSE6CR9GZCWN32K7RY17NQA-ams etag W/"86-18f3f5f8a28" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 496
GET H2	200	browser-server.Kf_xQo8f.js whereismymoney.wtf/static/js/	2 KB 1 KB	144ms 144ms	Other application/javascript	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://whereismymoney.wtf/static/js/browser-server.Kf_xQo8f.js Requested by Host: whereismymoney.wtf URL: https://whereismymoney.wtf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `209dfc7018a868172d2731de10613e57d1fda3eb22827cfe325e4e19a7dd4bd1` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://whereismymoney.wtf/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 7 content-encoding zstd via 2 fly.io date Sun, 26 May 2024 03:13:06 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:56 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYSE6DEKGT5XPERAGCQQAPMA-ams etag W/"8a0-18f3f5f8640" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 494
GET H2	200	Inter-roman.var.vq-Vth46.woff2 whereismymoney.wtf/static/media/	222 KB 222 KB	152ms 151ms	Font font/woff2	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://whereismymoney.wtf/static/media/Inter-roman.var.vq-Vth46.woff2?v=3.19 Requested by Host: whereismymoney.wtf URL: https://whereismymoney.wtf/static/css/index.2TAnPdFY.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `17fe38ab302c7e5dbfb5c3d87801092d79be958500db6412ed3bc0f126bd53d3` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://whereismymoney.wtf/static/css/index.2TAnPdFY.css Origin https://whereismymoney.wtf Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 7 date Sun, 26 May 2024 03:13:06 GMT via 2 fly.io cross-origin-embedder-policy require-corp ratelimit-limit 500 content-length 227180 last-modified Fri, 03 May 2024 16:52:56 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYSE6DG8350175RQPWPSX9V9-ams etag W/"3776c-18f3f5f8640" content-type font/woff2 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 492
GET H2	200	BackgroundImage.8QJr5Ysu.chunk.js Show response whereismymoney.wtf/static/js/	117 KB 39 KB	156ms 155ms	Script application/javascript	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://whereismymoney.wtf/static/js/BackgroundImage.8QJr5Ysu.chunk.js Requested by Host: whereismymoney.wtf URL: https://whereismymoney.wtf/static/js/index.e2n2xYYD.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `51165a0ee4182d93f71ed1d3c5111fbe0123a5946a84e8e12f13e1f22ac4cbf0` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://whereismymoney.wtf/static/js/index.e2n2xYYD.js Origin https://whereismymoney.wtf Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 7 content-encoding zstd via 2 fly.io date Sun, 26 May 2024 03:13:06 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:56 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYSE6DG8ZER83RE2TFF6VPC5-ams etag W/"1d3cc-18f3f5f8640" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 491
GET H2	200	favicon.ico whereismymoney.wtf/	15 KB 4 KB	157ms 156ms	Other image/x-icon	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://whereismymoney.wtf/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `8934b6301f853ec67afdcfe14673134ceb0178fd802c3b3f9aa1b6d1cc82b1fb` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://whereismymoney.wtf/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 7 content-encoding zstd via 2 fly.io date Sun, 26 May 2024 03:13:06 GMT cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:57 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYSE6DG8JDCEZ84NJV5P6CZ9-ams etag W/"3aee-18f3f5f8a28" content-type image/x-icon access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 490
GET H2	200	favicon.ico whereismymoney.wtf/	15 KB 84 B	146ms 146ms	Other image/x-icon	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://whereismymoney.wtf/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `8934b6301f853ec67afdcfe14673134ceb0178fd802c3b3f9aa1b6d1cc82b1fb` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://whereismymoney.wtf/bootstrap Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 5 date Sun, 26 May 2024 03:13:07 GMT via 2 fly.io content-encoding zstd cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:57 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYSE6EWNSXN3THTR3F4Q9A66-ams etag W/"3aee-18f3f5f8a28" content-type image/x-icon access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 448
GET H2	200	favicon.ico whereismymoney.wtf/	15 KB 83 B	143ms 143ms	Other image/x-icon	2a09:8280:1::36:6a18:0 FLY
General Check archive.org Show headers Download Go to Full URL https://whereismymoney.wtf/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a09:8280:1::36:6a18:0 , United States, ASN40509 (FLY, US), Reverse DNS Software Fly/ff37a3cc6 (2024-05-21) / Resource Hash `8934b6301f853ec67afdcfe14673134ceb0178fd802c3b3f9aa1b6d1cc82b1fb` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://whereismymoney.wtf/login Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ratelimit-reset 5 date Sun, 26 May 2024 03:13:07 GMT via 2 fly.io content-encoding zstd cross-origin-embedder-policy require-corp ratelimit-limit 500 last-modified Fri, 03 May 2024 16:52:57 GMT server Fly/ff37a3cc6 (2024-05-21) cross-origin-opener-policy same-origin fly-request-id 01HYSE6F6PCEHY4WTJ0DBRT42D-ams etag W/"3aee-18f3f5f8a28" content-type image/x-icon access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes ratelimit-remaining 443

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://whereismymoney.wtf/login Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

whereismymoney.wtf
2a09:8280:1::36:6a18:0
17fe38ab302c7e5dbfb5c3d87801092d79be958500db6412ed3bc0f126bd53d3
209dfc7018a868172d2731de10613e57d1fda3eb22827cfe325e4e19a7dd4bd1
51165a0ee4182d93f71ed1d3c5111fbe0123a5946a84e8e12f13e1f22ac4cbf0
576799ab741159a2ef67dec22e42ce932ac168138ecfbf809fe2365bbf52045e
8934b6301f853ec67afdcfe14673134ceb0178fd802c3b3f9aa1b6d1cc82b1fb
9742073ef7fc795e7673d98f272992843298426a0ffd8cb3507784df5143608b
b1e605baf2ed39ba6a150b489b3fe60d9a9e014137e57d932fa5a9a27e4ae749
bda62497c65e842b9f12c759ffcb2412e0e4db976abb1df5c69a39fab42bc564

whereismymoney.wtf Open in urlscan Pro 2a09:8280:1::36:6a18:0 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

694 kBTransfer

1611 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

whereismymoney.wtf Open in urlscan Pro
2a09:8280:1::36:6a18:0 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

694 kB
Transfer

1611 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions