www.wtfpl.net - URL scan, 14 Aug 2026
MalwareAnalyzer by Cyble scanned www.wtfpl.net and returned a unknown verdict (score -6). The page resolved to 193.200.42.162 on Hivane Association in FR. The domain was registered 5434 days ago through Scaleway SAS. 8 domains and 1 IP were contacted, over 9 HTTP requests. 2 malware samples communicate with this URL. The request followed 3 redirects before landing. This is a point-in-time observation from 14 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -6) · Confidence 12%
- Scanned URL:
http://sam.zoy.org/wtfpl/ - Domain: www.wtfpl.net · IP: 193.200.42.162 · AS34019 · FR
- Server: Apache/2.4.68 (Debian)
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: Scaleway SAS · domain age 5434 days · created 2011-09-27
- TLS issuer: C=US, O=Let's Encrypt, CN=YE2 · valid to Oct 9 20: · subject CN=wtfpl.net
- HTTP requests captured: 9
- Scan tier: fast · observed 2026-08-14 16:51:31 UTC
Redirect chain
http://sam.zoy.org/wtfpl/https://sam.zoy.org/wtfpl/http://www.wtfpl.net/https://www.wtfpl.net/
Malware communicating with this URL (2)
These samples were observed contacting or being served from www.wtfpl.net. Each links to its full analysis.
- f96015543a8000c00cdee75ab4ba334b270eaf0e5093e68bdc2fbd0d05fc41ac - referenced ·
f96015543a8000c00cdee75ab4ba334b· first seen 2026-08-14 - 4110c8d1f595e6b95bcd642d81d93cc092ce9b04d1e715401c658c52bdedf251 - referenced ·
4110c8d1f595e6b95bcd642d81d93cc0· first seen 2026-08-13
Antivirus & YARA (0 of 44 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
- Cross-host redirect chain
Detected technologies
- Apache
- WordPress
- jQuery
Contacted infrastructure
- 193.200.42.162 - AS34019 Hivane Association (France)
Observed indicators
- www.wtfpl.net
- platform.twitter.com
- connect.facebook.net
- apis.google.com
- static.ak.fbcdn.net
- platform.linkedin.com
- twitter.com
- www.facebook.com
- 193.200.42.162
- https://www.wtfpl.net/
- https://www.wtfpl.net/wp-content/themes/bones/favicon.ico
- https://www.wtfpl.net/xmlrpc.php
- https://www.wtfpl.net/wp-includes/css/dist/block-library/style.min.css
- https://www.wtfpl.net/wp-content/themes/bones/library/css/style.css
- https://www.wtfpl.net/wp-content/themes/bones/library/css/ie.css
- https://www.wtfpl.net/wp-content/themes/bones/library/js/libs/modernizr.custom.min.js
- https://www.wtfpl.net/wp-includes/js/jquery/jquery.min.js
- https://www.wtfpl.net/wp-includes/js/jquery/jquery-migrate.min.js
- https://www.wtfpl.net/wp-json/
- https://www.wtfpl.net/wp-json/wp/v2/pages/17
Other scans of www.wtfpl.net (2)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 21 Aug 2026 - unknown
- 13 Aug 2026 - unknown
Questions about www.wtfpl.net
- Is www.wtfpl.net safe?
- The scan of www.wtfpl.net on 14 Aug 2026 reached no verdict either way (score -6). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with www.wtfpl.net?
- 2 analysed samples communicate with this URL.
- How was www.wtfpl.net checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of www.wtfpl.net
Scanned on MalwareAnalyzer by Cyble · Open interactive scan