Security Report: app.bookflow.sh - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e2cf3c9f-787a-4091-a9ea-99c937cf786b Domain and IP registration (RDAP)/api/v1/rdap/e2cf3c9f-787a-4091-a9ea-99c937cf786bHow often this domain was scanned/api/v1/domain/stats/app.bookflow.sh Scan history for this domain/api/v1/domain/history/app.bookflow.sh?limit=15

This website contacted 8 IPs in 3 countries across 10 domains to perform 174 HTTP transactions. The main domain is bookflow.sh and was registered 8 months ago.

Submitted URL: https://app.bookflow.sh/?ref=WYCKF

Effective URL:

https://app.bookflow.sh/trade/BTC_USD?collateral=USD

Redirected

AI Security Verdict

Moderate Risk

Confidence: 62%

Risk Score

Crypto prop-trading app self-branded 'Upscale' on app.bookflow.sh. Recent, unranked domain and an unverified high-yield funding offer warrant caution, but no credential/payment form, no Indicators of Compromise and no malware or phishing evidence were found.

Risk Factors (3)

Displayed product name ('Upscale') does not match the hosting domain (bookflow.sh) on an unranked, recent-registration domain

High-yield 'prop trading / funded account up to $400,000 with no KYC' offer paid for in crypto is a high-risk financial category with no verifiable corporate identity on the page

No visible legal, company or contact information supporting the claimed trading firm

Safety Factors (5)

No credential or payment form on the page (0 password, 0 disguised-password, 0 payment fields)

No Indicators of Compromise, no hunting rule malware patterns, no known phishing kit in the roster

No cross-origin credential submission or credential exfiltration; all JavaScript served from the site's own domain

Domain is 253 days old and the page serves substantive trading-application content rather than a bare credential-harvesting page

Third-party references (Google/Facebook sign-in endpoints, Sentry/PostHog telemetry) are standard SDK integrations, not brand impersonation

Domain age information unavailable

Details

Page Title

73939.1447 USD | BTC/USD

Scan Type

public

Favicon Hash

MMH3: -1374578520

MD5: f4ac8282bce43913f44d7ec0493a559e

Domain Name Analysis

Within the .sh country-code top-level domain, 'app.bookflow.sh' is registered with subdomain 'app'. The second-level label 'bookflow' is 8 characters long containing three vowels alongside five consonants. Word splitting yields 2 words: book, flow. Median word length is four characters. No strong language cues emerged from the frequency lists.

Screenshot

" upscale” Accounts Trade Tournaments Tools v BTC USD price $73,951.1 10.34% Funding -8.015% Nextfunding 94:11:51 im 5m 15m ın D “| (lb = | fi Indicators | | pyTH & stork sae ~| & & | 02 BTC-5-CRYPT...

Page Load Overview

1.72s

Total Load Time

3.3 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:592 chars

Detector Agreement:100%

Website Classification

Primary Category

cryptocurrency blockchain76% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

cryptocurrency blockchain

76%

finance banking

38%

gambling betting

31%

corporate

25%

Detected Features

Products

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
27	185.178.208.226	Russia	AS57724Ddos-guard Ltd
21	160.202.131.221	Frankfurt am Main, Hesse, Germany	AS396356Latitude.sh
21	142.251.127.84Google · CDN	United States	AS15169Google LLC
21	157.240.0.6Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
21	95.129.236.1	Russia	AS57724Ddos-guard Ltd
21	3.132.50.174Aws · CLOUD	Columbus, Ohio, United States	AS16509Amazon.com, Inc.
21	3.135.70.216Aws · CLOUD	Columbus, Ohio, United States	AS16509Amazon.com, Inc.
21	157.240.0.35Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
174	8	-	-