Domain > wtfismyip.com

More information on this domain is in AlienVault OTX

Files that talk to wtfismyip.com

MD5	A/V
d3b1afeee13e5c0144dab4c7b0f8dd78	[Backdoor.Swrort]
ba6fcea833bbffeec7456b4da1fbd7b5
3b1940d675673a718114b372f8d177e8
86fc5040c8c717f88078b5fd362e065b
b73fee03a645694393c859ea0be31719
7ff6bd13beceebc9df5982422b4efb0d
c27b90309c929b6cf16b2cec3edb1914	[HW32.Packed.8C82] [Trojan-FJJV!C27B90309C92] [Win32.Trojan.WisdomEyes.16070401.9500.9932] [Heur.AdvML.B] [Ransom_HPCERBER.SMJ] [Win32.Trojan.Raasj.Auto] [Trojan.DownLoader22.63827] [BehavesLike.Win32.Malware.dc] [Trojan.Zusy.D34714]
f78d37308ff9f44068a093920b275232	[HEUR_JSRANSOM.O2] [HEUR.JS.Trojan.b] [Js.Trojan.Raas.Auto]
b5de2950294cc3e70ab54778e3908ba5	[HW32.Packed.22B8] [Trojan/W32.Trickster.304174] [Artemis!B5DE2950294C] [Ransom_HPCERBER.SMJ] [Win32.Trojan.WisdomEyes.16070401.9500.9888] [Ransom_HPCERBER.SMJ] [Trojan.Win32.Trickster.bq] [Troj.W32.Trickster!c] [Trojan.DownLoader22.63827] [BehavesLike.Win32.Malware.dc] [Troj/Injecto-LE] [TR/Dropper.VB.giome] [Trojan/Win32.Trickster] [Trojan:Win32/Totbrick.C] [Win32/TrickBot.A] [W32/TrickBot.A!tr]
50a4a9be4395d0708379a74ce45608f1	[Trojan.TrickBot] [Uds.Dangerousobject.Multi!c] [Win32.Trojan.WisdomEyes.16070401.9500.9987] [TROJ_TRICKBOT.D] [Trojan.Win32.Trickster.bg] [Trojan.PWS.Spy.20372] [backdoor.win32.bifrose.aci] [BehavesLike.Win32.VBObfus.dc] [Troj/Injecto-KV] [TR/Dropper.VB.gmzmy] [Trojan/Win32.Trickster.C1705114] [Artemis!50A4A9BE4395] [Trojan.Win32.Injector]

Whois

Property	Value
Email	CRUOHO@GMAIL.COM
NameServer	NS2.WTFISMYIP.COM
Created	2003-05-19 00:00:00
Changed	2015-06-03 00:00:00
Expires	2019-05-19 00:00:00
Registrar	ENOM, INC.

DNS Resolutions

Date	IP Address
2015-02-19	54.200.182.206 (ClassC)
2019-07-25	198.27.74.146 (ClassC)
2019-11-28	69.195.159.158 (ClassC)
2022-05-11	63.141.246.34 (ClassC)
2023-08-15	95.217.228.176 (ClassC)
2023-11-13	15.204.2.228 (ClassC)
2024-10-05	108.181.15.129 (ClassC)
2025-07-10	198.27.70.99 (ClassC)
2025-10-14	142.44.215.161 (ClassC)
2025-10-18	65.108.75.112 (ClassC)
2025-12-29	138.201.134.231 (ClassC)
2026-01-18	23.158.72.62 (ClassC)

HTTP/1.1 200 OKCache-Control: no-cache, no-store, max-age0, must-revalidateContent-Security-Policy: default-src none; img-src wtfismyip.com myip.wtf; script-src ipv4.wtfismyip.com wtfismyip.com myip.w

!DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.01 Transitional//EN http://www.w3.org/TR/html4/loose.dtd>html>head>link relcanonical hrefhttps://wtfismyip.com/>link relicon hreffavicon.ico typeimage/x-icon>link relshortcut icon hreffavicon.ico typeimage/x-icon>meta nameviewport contentwidthdevice-width, initial-scale1.0>meta namemsvalidate.01 content2FAFC220324DC28BC604C74AF6A73153>meta namegoogle-site-verification contentH3adQkdAhp3ae5Oq6hSz9VsRKcGJPhYuAdbt_sW7qJo />meta namekeywords contentwtf, my ip>meta namedescription contentTells you WTF your IP address is>title>WTF is my IP?!?!??/title>style typetext/css mediascreen>*{font-family:sans-serif;margin:0;padding:0}body{background:#fff}a{text-decoration:none}a:hover{color:#f90}#merryfuckingchristmas{color:green}#main{position:relative;top:20px}#main h1{font-size:40px;font-weight:400;line-height:40px;letter-spacing:-1px;padding:20px 0}#main h2{font-size:24px;font-weight:700;letter-spacing:-1px;padding:2px 0}#main p{font-size:15px;font-family:monospace;line-height:20px;margin:0 0 20px}#main ul{padding:0 0 0 20px}#main li{list-style-type:square;font-size:15px;line-height:10px;margin:0 0 10px}#sidebar{position:relative;top:40px;border-top:1px solid #ccc;text-align:center;width:300px;margin-right:auto;margin-left:auto;padding:20px 20px 0 0}#sidebar h2{text-transform:uppercase;font-size:13px;color:#333;letter-spacing:1px;line-height:20px}#sidebar ul{list-style-type:none;margin:20px 0}#sidebar li{font-size:14px;line-height:20px}.blah{margin-bottom:3px}a:link,a:visited,#tor{color:#f30}.halb{padding:20px}#local{position:relative;top:20px}#local h1{font-size:40px;font-weight:400;line-height:40px;letter-spacing:-1px;padding:20px 0}#local h2{font-size:24px;font-weight:700;letter-spacing:-1px;padding:2px 0}#local p{font-size:15px;line-height:20px;margin:0 0 20px}#local ul{padding:0 0 0 20px}#local li{list-style-type:square;font-size:15px;line-height:10px;margin:0 0 10px}@media (prefers-color-scheme: dark){body{background:#000; color:#fff} #sidebar h2{color:whitesmoke}}/style>/script

Subdomains

Date	Domain	IP
ns1.wtfismyip.com	2024-02-19	3.231.180.250
NS2.WTFISMYIP.COM	2026-01-18	158.101.39.95
ns4.wtfismyip.com	2021-05-29	129.146.154.12
ipv4.wtfismyip.com	2021-02-24	207.231.106.130
xml.wtfismyip.com	2024-10-08	108.181.15.129
ipv4.xml.wtfismyip.com	2024-09-28	108.181.15.129
json.wtfismyip.com	2024-09-17	108.181.15.129
ipv4.json.wtfismyip.com	2023-08-04	95.217.228.176
stun.wtfismyip.com	2025-08-27	198.27.70.99
text.wtfismyip.com	2025-06-27	198.27.70.99
ipv4.text.wtfismyip.com	2025-01-28	65.108.75.112
www.wtfismyip.com	2023-11-01	15.204.2.228

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > wtfismyip.com

Is this malicious?

Reports

Files that talk to wtfismyip.com

Whois

DNS Resolutions

Port 80

Port 443

Subdomains