www.wallectssync.io Open in urlscan Pro
18.193.26.52 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://wallectssync.io/
Effective URL:
https://www.wallectssync.io/
Submission: On November 16 via manual (November 16th 2021, 5:56:44 pm UTC) from US — Scanned from DE

Summary HTTP 1 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 18.193.26.52, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.wallectssync.io.
TLS certificate: Issued by DigiCert TLS Hybrid ECC SHA384 2020 CA1 on March 9th 2021. Valid for: a year.

This is the only time www.wallectssync.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Crypto (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
2 2	167.99.246.105 167.99.246.105	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	18.193.26.52 18.193.26.52	16509 (AMAZON-02) (AMAZON-02)
1	2

2 167.99.246.105 (Frankfurt am Main, Germany) 2 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

wallectssync.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.193.26.52 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-193-26-52.eu-central-1.compute.amazonaws.com

www.wallectssync.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	wallectssync.io 2 redirects wallectssync.io www.wallectssync.io	760 KB
1	1

	Domain	Requested by
2	wallectssync.io	2 redirects
1	www.wallectssync.io
1	2

This site contains links to these domains. Also see Links.

Domain
walletsyncdapps.com
ethereum.foundation
labs.consensys.net
gitcoin.co
rainbow.me
trustwallet.com
www.argent.xyz
walleth.org
gnosis-safe.io

Subject Issuer	Validity	Valid
*.netlify.app DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-03-09` - `2022-03-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.wallectssync.io/
Frame ID: 351C983894DE632023A4E421D58E711F
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WalletSync

Page URL History Show full URLs

http://wallectssync.io/ HTTP 301
https://wallectssync.io/ HTTP 301
https://www.wallectssync.io/ Page URL

Page Statistics

1
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

759 kB
Transfer

1575 kB
Size

0
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://walletsyncdapps.com/

Search URL Search Domain Scan URL

URL: https://walletsyncdapps.com/wallet
Title: mobile wallets

Search URL Search Domain Scan URL

URL: https://ethereum.foundation/

Search URL Search Domain Scan URL

URL: https://labs.consensys.net/

Search URL Search Domain Scan URL

URL: https://gitcoin.co/grants/275/walletconnect

Search URL Search Domain Scan URL

URL: https://rainbow.me/
Title: Rainbow

Search URL Search Domain Scan URL

URL: https://trustwallet.com/
Title: Trust

Search URL Search Domain Scan URL

URL: https://www.argent.xyz/
Title: Argent

Search URL Search Domain Scan URL

URL: https://walleth.org/
Title: Walleth

Search URL Search Domain Scan URL

URL: https://gnosis-safe.io/
Title: Gnosis

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://wallectssync.io/ HTTP 301
https://wallectssync.io/ HTTP 301
https://www.wallectssync.io/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
13 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.wallectssync.io/
Redirect Chain

http://wallectssync.io/
https://wallectssync.io/
https://www.wallectssync.io/

1 MB
759 KB

645ms
401ms

Document
text/html

18.193.26.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.wallectssync.io/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.193.26.52 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-193-26-52.eu-central-1.compute.amazonaws.com

Software

Netlify /

Resource Hash

dffad7b4d8835c00cfca79c7ea6735c3485ae0ae92f6fc174258fecb677a4edf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

cache-control: public, max-age=0, must-revalidate
content-type: text/html; charset=UTF-8
date: Tue, 16 Nov 2021 17:56:33 GMT
etag: "8f5e0bc3da01d81891b5be1a57d6f4fd-ssl-df"
strict-transport-security: max-age=31536000
x-nf-request-id: 01FMMY9CCMB2FM9T8T9Z0GJVPW
vary: Accept-Encoding
age: 0
server: Netlify
content-encoding: br

Redirect headers

cache-control: public, max-age=0, must-revalidate
content-length: 43
content-type: text/plain
date: Tue, 16 Nov 2021 17:56:32 GMT
strict-transport-security: max-age=31536000
location: https://www.wallectssync.io/
server: Netlify
age: 2
x-nf-request-id: 01FMMY9C0Q1CDKSKYF7KH7KHNV

GET
DATA 200
OK truncated
/ 30 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ddbbc4d334ae15a5da0da4653ebcf1f236cb93fb8ce2e3358de88904712d96f8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 309 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 500345a8fba59d6d64db35c0f48e0fd042c2a34b892a9f71fd30ccfc1ebdffe0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03f48087ff3205bf2a159c64b70f41210e39783e8b422e60ba7fbcbc3962d943

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 75 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 59fe730c8da0af1d8c08193af1fa477da4960940a94e2e772ec743e03253ed2e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 12 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4b9bd35a8fb122e376336a1dc01cc76f55d4b708f1ea24f2777139effecc5d4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 22 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2e4a7b4b020e2822694880cdecc65e35972e7f961db8596912f92b8fe2af1d40

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c7260d3a03b17e68dc0b4983409158852404b56b9e4dfdd4f3724189a07dcc3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f15e7081b4e4bb8fff620e68684d3f7b2f6ad5b10bc2784a584d51f22a2d4131

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 37d02e6539ffef6542a6d5706b7739c2a6daa87a3407837e34a2f7b985cf449f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7b389e0b889cd221bc580878107936fa484f6fd5cb8a7ac8690d032a11d07ab8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1d2eb2b8a525252519c0265f7e872e4b9f8f5849e3ebc33d3f22fcdfb2bfb20a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 789 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5731aec280c4724f2db7bf0c6d3b1e6517c5cd2de6ba5cce3e0debe6a611757

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 859 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0cf177f1dc3baf9ecfdd52b02db04e3d1d19fa2d6ed3ec4b42f05b50c721793f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

wallectssync.io
www.wallectssync.io
167.99.246.105
18.193.26.52
03f48087ff3205bf2a159c64b70f41210e39783e8b422e60ba7fbcbc3962d943
0cf177f1dc3baf9ecfdd52b02db04e3d1d19fa2d6ed3ec4b42f05b50c721793f
1d2eb2b8a525252519c0265f7e872e4b9f8f5849e3ebc33d3f22fcdfb2bfb20a
2e4a7b4b020e2822694880cdecc65e35972e7f961db8596912f92b8fe2af1d40
37d02e6539ffef6542a6d5706b7739c2a6daa87a3407837e34a2f7b985cf449f
4c7260d3a03b17e68dc0b4983409158852404b56b9e4dfdd4f3724189a07dcc3
500345a8fba59d6d64db35c0f48e0fd042c2a34b892a9f71fd30ccfc1ebdffe0
59fe730c8da0af1d8c08193af1fa477da4960940a94e2e772ec743e03253ed2e
7b389e0b889cd221bc580878107936fa484f6fd5cb8a7ac8690d032a11d07ab8
d4b9bd35a8fb122e376336a1dc01cc76f55d4b708f1ea24f2777139effecc5d4
d5731aec280c4724f2db7bf0c6d3b1e6517c5cd2de6ba5cce3e0debe6a611757
ddbbc4d334ae15a5da0da4653ebcf1f236cb93fb8ce2e3358de88904712d96f8
dffad7b4d8835c00cfca79c7ea6735c3485ae0ae92f6fc174258fecb677a4edf
f15e7081b4e4bb8fff620e68684d3f7b2f6ad5b10bc2784a584d51f22a2d4131

www.wallectssync.io Open in urlscan Pro 18.193.26.52 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

1 Requests

0 %HTTPS

0 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

759 kBTransfer

1575 kBSize

0 Cookies

10 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www.wallectssync.io Open in urlscan Pro
18.193.26.52 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

759 kB
Transfer

1575 kB
Size

0
Cookies

1 HTTP transactions
13 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!