trustwallet-app.lojasonlinectt.pt Open in urlscan Pro
54.74.168.81 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://trustwallet-upgrade.blogspot.cl/
Effective URL:
https://trustwallet-app.lojasonlinectt.pt/403/
Submission: On October 01 via automatic, source openphish (October 1st 2023, 3:15:33 pm UTC) — Scanned from DE

Summary HTTP 19 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 8 IPs in 4 countries across 8 domains to perform 19 HTTP transactions. The main IP is 54.74.168.81, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is trustwallet-app.lojasonlinectt.pt.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 12th 2023. Valid for: a year.

This is the only time trustwallet-app.lojasonlinectt.pt was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Trustwallet (Crypto)

Domain & IP information

	IP Address	AS Autonomous System
1 2	2a00:1450:400... 2a00:1450:4001:803::2001	15169 (GOOGLE) (GOOGLE)
2	54.74.168.81 54.74.168.81	16509 (AMAZON-02) (AMAZON-02)
5	167.88.168.124 167.88.168.124	14956 (ROUTERHOS...) (ROUTERHOSTING)
2	2a04:4e42:200... 2a04:4e42:200::649	54113 (FASTLY) (FASTLY)
1	162.19.58.161 162.19.58.161	16276 (OVH) (OVH)
1	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
1	185.221.87.23 185.221.87.23	54113 (FASTLY) (FASTLY)
19	8

2 2a00:1450:4001:803::2001 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

trustwallet-upgrade.blogspot.cl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trustwallet-upgrade.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.74.168.81 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-74-168-81.eu-west-1.compute.amazonaws.com

trustwallet-app.lojasonlinectt.pt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 167.88.168.124 (Dallas, United States)

ASN14956 (ROUTERHOSTING, US)

sudisk.merseine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.58.161 (France)

ASN16276 (OVH, FR)
PTR: ns3096669.ip-162-19-58.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.221.87.23 (Ireland)

ASN54113 (FASTLY, US)

bam.eu01.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	merseine.com sudisk.merseine.com	163 KB
2	jquery.com code.jquery.com — Cisco Umbrella Rank: 1243	60 KB
2	lojasonlinectt.pt trustwallet-app.lojasonlinectt.pt	17 KB
1	nr-data.net bam.eu01.nr-data.net — Cisco Umbrella Rank: 10328	478 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 969	16 KB
1	ibb.co i.ibb.co — Cisco Umbrella Rank: 10068	55 KB
1	blogspot.com trustwallet-upgrade.blogspot.com	15 KB
1	blogspot.cl 1 redirects trustwallet-upgrade.blogspot.cl	298 B
19	8

	Domain	Requested by
5	sudisk.merseine.com	trustwallet-app.lojasonlinectt.pt sudisk.merseine.com
2	code.jquery.com	trustwallet-app.lojasonlinectt.pt
2	trustwallet-app.lojasonlinectt.pt	trustwallet-upgrade.blogspot.com trustwallet-app.lojasonlinectt.pt
1	bam.eu01.nr-data.net	js-agent.newrelic.com
1	js-agent.newrelic.com	trustwallet-app.lojasonlinectt.pt
1	i.ibb.co	trustwallet-app.lojasonlinectt.pt
1	trustwallet-upgrade.blogspot.com
1	trustwallet-upgrade.blogspot.cl	1 redirects
19	8

This site contains links to these domains. Also see Links.

Domain
github.com
instagram.com
twitter.com
reddit.com

Subject Issuer	Validity	Valid
misc-sni.blogspot.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.lojasonlinectt.pt Sectigo RSA Domain Validation Secure Server CA	`2023-01-12` - `2024-01-12`	a year	crt.sh
sudisk.merseine.com R3	`2023-08-18` - `2023-11-16`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
ibb.co R3	`2023-08-10` - `2023-11-08`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-04-13` - `2024-05-14`	a year	crt.sh
*.eu01.nr-data.net DigiCert TLS RSA SHA256 2020 CA1	`2022-11-18` - `2023-12-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://trustwallet-app.lojasonlinectt.pt/403/
Frame ID: C0A9CE75C8F3CDAB5C9967D12CBB343E
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DApps | Decentralized Applications | DApp Mobile Browser | Trust Wallet

Page URL History Show full URLs

https://trustwallet-upgrade.blogspot.cl/ HTTP 302
https://trustwallet-upgrade.blogspot.com/ Page URL
https://trustwallet-app.lojasonlinectt.pt/403/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

68 %
HTTPS

29 %
IPv6

8
Domains

8
Subdomains

8
IPs

4
Countries

327 kB
Transfer

1288 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/trustwallet

Search URL Search Domain Scan URL

URL: https://instagram.com/trustwallet

Search URL Search Domain Scan URL

URL: https://twitter.com/trustwallet

Search URL Search Domain Scan URL

URL: https://reddit.com/r/trustapp

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://trustwallet-upgrade.blogspot.cl/ HTTP 302
https://trustwallet-upgrade.blogspot.com/ Page URL
https://trustwallet-app.lojasonlinectt.pt/403/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://trustwallet-upgrade.blogspot.cl/ HTTP 302
https://trustwallet-upgrade.blogspot.com/

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/
trustwallet-upgrade.blogspot.com/
Redirect Chain

https://trustwallet-upgrade.blogspot.cl/
https://trustwallet-upgrade.blogspot.com/

70 KB
15 KB

561ms
527ms

Document
text/html

2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://trustwallet-upgrade.blogspot.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: gzip
content-length: 15222
content-type: text/html; charset=UTF-8
date: Sun, 01 Oct 2023 15:15:26 GMT
etag: W/"6fb9936ed5b00d8d79765dfdd38293234ed0c1e459973cd3eebc08a6674e7749"
expires: Sun, 01 Oct 2023 15:15:26 GMT
last-modified: Sat, 30 Sep 2023 17:07:04 GMT
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: gzip
content-length: 186
content-security-policy: frame-ancestors 'self'
content-type: text/html; charset=UTF-8
date: Sun, 01 Oct 2023 15:15:26 GMT
expires: Sun, 01 Oct 2023 15:15:26 GMT
location: https://trustwallet-upgrade.blogspot.com/
server: GSE
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 404 Primary Request / Show response
trustwallet-app.lojasonlinectt.pt/403/ 49 KB
17 KB 234ms
102ms Document
text/html 54.74.168.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trustwallet-app.lojasonlinectt.pt/403/
Requested by: Host: trustwallet-upgrade.blogspot.com
URL: https://trustwallet-upgrade.blogspot.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 54.74.168.81 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-74-168-81.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f2110a5572b6fa0089cd93974b2ea3fbd4ab8e675dcb5cfc4be3744caf3f37cc

Request headers

Referer: https://trustwallet-upgrade.blogspot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 01 Oct 2023 15:15:27 GMT
server: nginx
vary: Accept-Encoding
x-platform: Lojas Online CTT
x-shopkit-environment: production

GET
H2 404 404.js
sudisk.merseine.com/js/ 0
0 716ms
408ms Script
text/html 167.88.168.124
ROUTERHOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://sudisk.merseine.com/js/404.js
Requested by: Host: trustwallet-app.lojasonlinectt.pt
URL: https://trustwallet-app.lojasonlinectt.pt/403/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 167.88.168.124 Dallas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trustwallet-app.lojasonlinectt.pt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 105ms
33ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: trustwallet-app.lojasonlinectt.pt
URL: https://trustwallet-app.lojasonlinectt.pt/403/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trustwallet-app.lojasonlinectt.pt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sun, 01 Oct 2023 15:15:27 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 935227
x-cache: HIT, HIT
content-length: 30875
x-served-by: cache-lga21931-LGA, cache-fra-eddf8230138-FRA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1696173327.243978,VS0,VE0
etag: W/"28feccc0-15d9d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 11, 430402

GET
H2 200 main.css
sudisk.merseine.com/css/ 231 KB
32 KB 716ms
408ms Stylesheet
text/css 167.88.168.124
ROUTERHOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://sudisk.merseine.com/css/main.css
Requested by: Host: trustwallet-app.lojasonlinectt.pt
URL: https://trustwallet-app.lojasonlinectt.pt/403/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 167.88.168.124 Dallas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 506ed17afcae7a1ae7afebc9d172bde30b269887f07026402851f291eb3a16a2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trustwallet-app.lojasonlinectt.pt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sun, 01 Oct 2023 15:15:27 GMT
content-encoding: br
last-modified: Fri, 18 Aug 2023 20:32:59 GMT
server: nginx
etag: W/"64dfd57b-39cca"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 jquery-3.7.0.min.js Show response
code.jquery.com/ 85 KB
30 KB 105ms
33ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.7.0.min.js
Requested by: Host: trustwallet-app.lojasonlinectt.pt
URL: https://trustwallet-app.lojasonlinectt.pt/403/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trustwallet-app.lojasonlinectt.pt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sun, 01 Oct 2023 15:15:27 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1371128
x-cache: HIT, HIT
content-length: 30308
x-served-by: cache-lga13623-LGA, cache-fra-eddf8230138-FRA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1696173327.243971,VS0,VE0
etag: W/"28feccc0-155a6"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 23, 43980

GET
H2 200 bip39.min.js Show response
sudisk.merseine.com/ 647 KB
114 KB 579ms
272ms Script
application/javascript 167.88.168.124
ROUTERHOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://sudisk.merseine.com/bip39.min.js
Requested by: Host: trustwallet-app.lojasonlinectt.pt
URL: https://trustwallet-app.lojasonlinectt.pt/403/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 167.88.168.124 Dallas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 25cff2544c524fb620035c07ce083d3ffaa84b9cf535dcc6f92d17f0eab060bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trustwallet-app.lojasonlinectt.pt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sun, 01 Oct 2023 15:15:27 GMT
content-encoding: br
last-modified: Fri, 18 Aug 2023 20:31:32 GMT
server: nginx
etag: W/"64dfd524-a1a6a"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 seeds.png
i.ibb.co/L1rFgLY/ 55 KB
55 KB 264ms
43ms Image
image/png 162.19.58.161
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/L1rFgLY/seeds.png
Requested by: Host: trustwallet-app.lojasonlinectt.pt
URL: https://trustwallet-app.lojasonlinectt.pt/403/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.161 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096669.ip-162-19-58.eu
Software: nginx /
Resource Hash: cdf93cd95ba9cf0fca4b027fc9b0487901c8fa07ee43531995c2b521f56897c9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trustwallet-app.lojasonlinectt.pt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sun, 01 Oct 2023 15:15:27 GMT
last-modified: Fri, 29 Sep 2023 20:14:00 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 56436
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 trust_logotype.svg
sudisk.merseine.com/fonts/ 14 KB
14 KB 143ms
143ms Image
image/svg+xml 167.88.168.124
ROUTERHOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sudisk.merseine.com/fonts/trust_logotype.svg
Requested by: Host: sudisk.merseine.com
URL: https://sudisk.merseine.com/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 167.88.168.124 Dallas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 61ea304b4cef90b7cbdeb0ca437f90128bd4e52323e19a86e7ea6a50d568d1c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sudisk.merseine.com/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sun, 01 Oct 2023 15:15:28 GMT
last-modified: Fri, 18 Aug 2023 20:35:27 GMT
server: nginx
etag: "64dfd60f-391d"
x-powered-by: PleskLin
content-type: image/svg+xml
accept-ranges: bytes
content-length: 14621

GET
H2 200 flags.png
sudisk.merseine.com/images/ 4 KB
4 KB 149ms
149ms Image
image/png 167.88.168.124
ROUTERHOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sudisk.merseine.com/images/flags.png
Requested by: Host: sudisk.merseine.com
URL: https://sudisk.merseine.com/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 167.88.168.124 Dallas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: d875556135e6cd96c417240f22d3744feede77b33fa93287c553193fed04233e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sudisk.merseine.com/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sun, 01 Oct 2023 15:15:28 GMT
last-modified: Fri, 18 Aug 2023 20:34:46 GMT
server: nginx
etag: "64dfd5e6-eac"
x-powered-by: PleskLin
content-type: image/png
accept-ranges: bytes
content-length: 3756

GET IBMPlexSans-Medium.woff2
sudisk.merseine.com/fonts/ 0
0

GET IBMPlexSans-Bold.woff2
sudisk.merseine.com/fonts/ 0
0

GET
H2 404 socials.svg
trustwallet-app.lojasonlinectt.pt/403/fonts/ 0
0 123ms
122ms Other
text/html 54.74.168.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trustwallet-app.lojasonlinectt.pt/403/fonts/socials.svg
Requested by: Host: trustwallet-app.lojasonlinectt.pt
URL: https://trustwallet-app.lojasonlinectt.pt/403/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 54.74.168.81 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-74-168-81.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trustwallet-app.lojasonlinectt.pt/403/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sun, 01 Oct 2023 15:15:28 GMT
content-encoding: gzip
x-shopkit-environment: production
server: nginx
x-platform: Lojas Online CTT
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: max-age=0

GET IBMPlexSans-Regular.woff2
sudisk.merseine.com/fonts/ 0
0

GET IBMPlexSans-Regular.woff
sudisk.merseine.com/fonts/ 0
0

GET IBMPlexSans-Bold.woff
sudisk.merseine.com/fonts/ 0
0

GET IBMPlexSans-Medium.woff
sudisk.merseine.com/fonts/ 0
0

GET
H2 200 nr-rum-1.242.0.min.js Show response
js-agent.newrelic.com/ 44 KB
16 KB 90ms
27ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-rum-1.242.0.min.js

Requested by

Host: trustwallet-app.lojasonlinectt.pt
URL: https://trustwallet-app.lojasonlinectt.pt/403/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

467942d7490565f9eeffb703101620ee5a56c38f57312919d5a74cab073779eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trustwallet-app.lojasonlinectt.pt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-amz-version-id: ZbbGSpfDbusF6mSs7Sl2uV56L034ouIe
content-encoding: br
via: 1.1 varnish
date: Sun, 01 Oct 2023 15:15:29 GMT
strict-transport-security: max-age=300
x-amz-request-id: WZZTE5YMWC5D2K82
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 15733
x-amz-id-2: jJzhd2T1nTmkBkfCoamJiYB2YGUXn1R2PBAC8IEHPTzqaJq8jQ0e2fAJTuivuWPWfErHP6HxpeE=
x-served-by: cache-fra-eddf8230040-FRA
last-modified: Tue, 26 Sep 2023 03:02:38 GMT
server: AmazonS3
x-timer: S1696173329.008412,VS0,VE0
etag: "7443b88e37d38843fd5e2ddf0fdc5d9e"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 5672

POST
H/1.1 200
OK NRJS-d5234c50e0eeda7318c Show response
bam.eu01.nr-data.net/1/ 40 B
478 B 197ms
48ms XHR
text/plain 185.221.87.23
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.eu01.nr-data.net/1/NRJS-d5234c50e0eeda7318c?a=30685175,30685176&v=1.242.0&to=MhBSZQoZChJVUkdYDAtacVIMEQsPG1JGQhcKGG8FSExLCFpVVkk%3D&rst=2126&ck=0&s=0bf11387eee7ca44&ref=https://trustwallet-app.lojasonlinectt.pt/403/&ap=27&be=235&fe=1781&dc=930&at=HldRE0IDGRw%3D&perf=%7B%22timing%22:%7B%22of%22:1696173326917,%22n%22:0,%22f%22:0,%22dn%22:3,%22dne%22:27,%22c%22:27,%22s%22:73,%22ce%22:133,%22rq%22:133,%22rp%22:235,%22rpe%22:236,%22di%22:1164,%22ds%22:1164,%22de%22:1165,%22dc%22:2012,%22l%22:2012,%22le%22:2016%7D,%22navigation%22:%7B%7D%7D&fp=1042&fcp=1042
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-rum-1.242.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.221.87.23 , Ireland, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: 24c98b3653a1a89489a370d23ab35375bba6bf386f5c2cf8a34f59f1ee7ab2ee

Request headers

Referer: https://trustwallet-app.lojasonlinectt.pt/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
content-type: text/plain

Response headers

date: Sun, 01 Oct 2023 15:15:29 GMT
server: istio-envoy
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://trustwallet-app.lojasonlinectt.pt
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 40
x-served-by: cache-fra-eddf8230060-FRA

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sudisk.merseine.com
URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Medium.woff2

Domain: sudisk.merseine.com
URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Bold.woff2

Domain: sudisk.merseine.com
URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Regular.woff2

Domain: sudisk.merseine.com
URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Regular.woff

Domain: sudisk.merseine.com
URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Bold.woff

Domain: sudisk.merseine.com
URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Medium.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Trustwallet (Crypto)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.trustwallet-app.lojasonlinectt.pt/	1970-01-20 15:10:59	Name: ctt_683224e2 Value: a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%222d3af10685a3373c22b5ebe2ddf5351c%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A14%3A%22193.32.248.250%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A116%3A%22Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.5938.132%20Safari%2F537.36%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1696173327%3Bs%3A9%3A%22user_data%22%3Bs%3A0%3A%22%22%3B%7D11ebf92846c001625a057cc44209646c595b22fc

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://trustwallet-app.lojasonlinectt.pt/403/ Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://sudisk.merseine.com/js/404.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://trustwallet-app.lojasonlinectt.pt/403/fonts/socials.svg#social_twitter Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://trustwallet-app.lojasonlinectt.pt/403/ Message: Access to font at 'https://sudisk.merseine.com/fonts/IBMPlexSans-Regular.woff2' from origin 'https://trustwallet-app.lojasonlinectt.pt' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Regular.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://trustwallet-app.lojasonlinectt.pt/403/ Message: Access to font at 'https://sudisk.merseine.com/fonts/IBMPlexSans-Bold.woff2' from origin 'https://trustwallet-app.lojasonlinectt.pt' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Bold.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://trustwallet-app.lojasonlinectt.pt/403/ Message: Access to font at 'https://sudisk.merseine.com/fonts/IBMPlexSans-Medium.woff2' from origin 'https://trustwallet-app.lojasonlinectt.pt' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Medium.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://trustwallet-app.lojasonlinectt.pt/403/ Message: Access to font at 'https://sudisk.merseine.com/fonts/IBMPlexSans-Regular.woff' from origin 'https://trustwallet-app.lojasonlinectt.pt' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Regular.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://trustwallet-app.lojasonlinectt.pt/403/ Message: Access to font at 'https://sudisk.merseine.com/fonts/IBMPlexSans-Medium.woff' from origin 'https://trustwallet-app.lojasonlinectt.pt' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Medium.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://trustwallet-app.lojasonlinectt.pt/403/ Message: Access to font at 'https://sudisk.merseine.com/fonts/IBMPlexSans-Bold.woff' from origin 'https://trustwallet-app.lojasonlinectt.pt' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://sudisk.merseine.com/fonts/IBMPlexSans-Bold.woff Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam.eu01.nr-data.net
code.jquery.com
i.ibb.co
js-agent.newrelic.com
sudisk.merseine.com
trustwallet-app.lojasonlinectt.pt
trustwallet-upgrade.blogspot.cl
trustwallet-upgrade.blogspot.com
sudisk.merseine.com
151.101.130.137
162.19.58.161
167.88.168.124
185.221.87.23
2a00:1450:4001:803::2001
2a04:4e42:200::649
54.74.168.81
24c98b3653a1a89489a370d23ab35375bba6bf386f5c2cf8a34f59f1ee7ab2ee
25cff2544c524fb620035c07ce083d3ffaa84b9cf535dcc6f92d17f0eab060bd
467942d7490565f9eeffb703101620ee5a56c38f57312919d5a74cab073779eb
506ed17afcae7a1ae7afebc9d172bde30b269887f07026402851f291eb3a16a2
61ea304b4cef90b7cbdeb0ca437f90128bd4e52323e19a86e7ea6a50d568d1c8
cdf93cd95ba9cf0fca4b027fc9b0487901c8fa07ee43531995c2b521f56897c9
d875556135e6cd96c417240f22d3744feede77b33fa93287c553193fed04233e
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
f2110a5572b6fa0089cd93974b2ea3fbd4ab8e675dcb5cfc4be3744caf3f37cc
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

trustwallet-app.lojasonlinectt.pt Open in urlscan Pro 54.74.168.81 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

68 %HTTPS

29 %IPv6

8 Domains

8 Subdomains

8 IPs

4 Countries

327 kBTransfer

1288 kBSize

1 Cookies

4 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

15 Console Messages

Security Headers

Indicators

trustwallet-app.lojasonlinectt.pt Open in urlscan Pro
54.74.168.81 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

68 %
HTTPS

29 %
IPv6

8
Domains

8
Subdomains

8
IPs

4
Countries

327 kB
Transfer

1288 kB
Size

1
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!