lgin-uphoolds.livenewzus.com Open in urlscan Pro
162.144.4.239 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://lgin-uphoolds.livenewzus.com/?entity=4201580
Effective URL:
https://lgin-uphoolds.livenewzus.com/?entity=4201580
Submission: On November 29 via manual (November 29th 2022, 7:59:53 pm UTC) from IN — Scanned from DE

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 162.144.4.239, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is lgin-uphoolds.livenewzus.com.
TLS certificate: Issued by R3 on November 22nd 2022. Valid for: 3 months.

This is the only time lgin-uphoolds.livenewzus.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Uphold (Crypto)

Domain & IP information

	IP Address		AS Autonomous System
1 9	162.144.4.239 162.144.4.239		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
8	1

9 162.144.4.239 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-144-4-239.unifiedlayer.com

lgin-uphoolds.livenewzus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	livenewzus.com 1 redirects lgin-uphoolds.livenewzus.com	174 KB
8	1

	Domain	Requested by
9	lgin-uphoolds.livenewzus.com	1 redirects lgin-uphoolds.livenewzus.com
8	1

This site contains links to these domains. Also see Links.

Domain
wallet.uphold.com

Subject Issuer	Validity	Valid
www.metmask-lgona.livenewzus.com R3	`2022-11-22` - `2023-02-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lgin-uphoolds.livenewzus.com/?entity=4201580
Frame ID: A7654190C1E172E49053C6F95878451D
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Uphold | Login - Uphold | Login

Page URL History Show full URLs

http://lgin-uphoolds.livenewzus.com/?entity=4201580 HTTP 301
https://lgin-uphoolds.livenewzus.com/?entity=4201580 Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

173 kB
Transfer

424 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://wallet.uphold.com/login
Title: Uphold login

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://lgin-uphoolds.livenewzus.com/?entity=4201580 HTTP 301
https://lgin-uphoolds.livenewzus.com/?entity=4201580 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response lgin-uphoolds.livenewzus.com/ Redirect Chain http://lgin-uphoolds.livenewzus.com/?entity=4201580 https://lgin-uphoolds.livenewzus.com/?entity=4201580	37 KB 12 KB	741ms 361ms	Document text/html	162.144.4.239 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lgin-uphoolds.livenewzus.com/?entity=4201580 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.144.4.239 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-144-4-239.unifiedlayer.com Software Apache / Resource Hash `505bf4e86be70122bf2f396b7e0d1c3b7f33c74fd6c951d72c7713d006103aa9` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=7200 content-encoding gzip content-length 11498 content-type text/html; charset=UTF-8 date Tue, 29 Nov 2022 19:59:46 GMT expires Tue, 29 Nov 2022 21:59:46 GMT link <https://lgin-uphoolds.livenewzus.com/wp-json/>; rel="https://api.w.org/", <https://lgin-uphoolds.livenewzus.com/wp-json/wp/v2/pages/11>; rel="alternate"; type="application/json", <https://lgin-uphoolds.livenewzus.com/>; rel=shortlink server Apache vary Accept-Encoding x-endurance-cache-level 2 x-nginx-cache WordPress x-server-cache false x-ua-compatible IE=edge Redirect headers Cache-Control max-age=7200 Content-Length 0 Content-Type text/html; charset=UTF-8 Date Tue, 29 Nov 2022 19:59:44 GMT Expires Tue, 29 Nov 2022 21:59:45 GMT Location https://lgin-uphoolds.livenewzus.com/?entity=4201580 Server nginx/1.23.2 X-Endurance-Cache-Level 2 X-Redirect-By WordPress X-Server-Cache false X-UA-Compatible IE=edge X-nginx-cache WordPress
GET H2	200	style.min.css lgin-uphoolds.livenewzus.com/wp-includes/css/dist/block-library/	93 KB 17 KB	202ms 202ms	Stylesheet text/css	162.144.4.239 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lgin-uphoolds.livenewzus.com/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1 Requested by Host: lgin-uphoolds.livenewzus.com URL: https://lgin-uphoolds.livenewzus.com/?entity=4201580 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.144.4.239 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-144-4-239.unifiedlayer.com Software Apache / Resource Hash `c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a` Request headers accept-language de-DE,de;q=0.9 Referer https://lgin-uphoolds.livenewzus.com/?entity=4201580 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Tue, 29 Nov 2022 19:59:47 GMT content-encoding gzip x-nginx-cache WordPress last-modified Sat, 12 Nov 2022 02:26:46 GMT server Apache vary Accept-Encoding x-endurance-cache-level 2 content-type text/css cache-control max-age=2592000 accept-ranges bytes expires Thu, 29 Dec 2022 19:59:47 GMT
GET H2	200	classic-themes.min.css lgin-uphoolds.livenewzus.com/wp-includes/css/	217 B 248 B	198ms 197ms	Stylesheet text/css	162.144.4.239 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lgin-uphoolds.livenewzus.com/wp-includes/css/classic-themes.min.css?ver=1 Requested by Host: lgin-uphoolds.livenewzus.com URL: https://lgin-uphoolds.livenewzus.com/?entity=4201580 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.144.4.239 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-144-4-239.unifiedlayer.com Software Apache / Resource Hash `5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5` Request headers accept-language de-DE,de;q=0.9 Referer https://lgin-uphoolds.livenewzus.com/?entity=4201580 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Tue, 29 Nov 2022 19:59:47 GMT content-encoding gzip x-nginx-cache WordPress last-modified Wed, 26 Oct 2022 00:15:16 GMT server Apache vary Accept-Encoding x-endurance-cache-level 2 content-type text/css cache-control max-age=2592000 accept-ranges bytes content-length 189 expires Thu, 29 Dec 2022 19:59:47 GMT
GET H2	200	style.min.css lgin-uphoolds.livenewzus.com/wp-content/themes/sinatra/assets/css/	159 KB 43 KB	211ms 211ms	Stylesheet text/css	162.144.4.239 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lgin-uphoolds.livenewzus.com/wp-content/themes/sinatra/assets/css/style.min.css?ver=1.2.1 Requested by Host: lgin-uphoolds.livenewzus.com URL: https://lgin-uphoolds.livenewzus.com/?entity=4201580 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.144.4.239 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-144-4-239.unifiedlayer.com Software Apache / Resource Hash `e6bd1abee148e880a6b7671f78751376ffe43be71d51e6d0c3324f45b745442d` Request headers accept-language de-DE,de;q=0.9 Referer https://lgin-uphoolds.livenewzus.com/?entity=4201580 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Tue, 29 Nov 2022 19:59:47 GMT content-encoding gzip x-nginx-cache WordPress last-modified Tue, 22 Nov 2022 08:58:29 GMT server Apache vary Accept-Encoding x-endurance-cache-level 2 content-type text/css cache-control max-age=2592000 accept-ranges bytes expires Thu, 29 Dec 2022 19:59:47 GMT
GET H2	200	dynamic-styles.css lgin-uphoolds.livenewzus.com/wp-content/uploads/sinatra/	17 KB 5 KB	192ms 192ms	Stylesheet text/css	162.144.4.239 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lgin-uphoolds.livenewzus.com/wp-content/uploads/sinatra/dynamic-styles.css?ver=1669395097 Requested by Host: lgin-uphoolds.livenewzus.com URL: https://lgin-uphoolds.livenewzus.com/?entity=4201580 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.144.4.239 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-144-4-239.unifiedlayer.com Software Apache / Resource Hash `e352d18523d5d334abbe19c325dd5cadcb67826b52345d95dbed6709d7e0096a` Request headers accept-language de-DE,de;q=0.9 Referer https://lgin-uphoolds.livenewzus.com/?entity=4201580 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Tue, 29 Nov 2022 19:59:47 GMT content-encoding gzip x-nginx-cache WordPress last-modified Fri, 25 Nov 2022 16:51:37 GMT server Apache vary Accept-Encoding x-endurance-cache-level 2 content-type text/css cache-control max-age=2592000 accept-ranges bytes content-length 5024 expires Thu, 29 Dec 2022 19:59:47 GMT
GET H2	200	uphold-login-crypto-1024x644.jpg lgin-uphoolds.livenewzus.com/wp-content/uploads/2022/11/	85 KB 86 KB	370ms 369ms	Image image/jpeg	162.144.4.239 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://lgin-uphoolds.livenewzus.com/wp-content/uploads/2022/11/uphold-login-crypto-1024x644.jpg Requested by Host: lgin-uphoolds.livenewzus.com URL: https://lgin-uphoolds.livenewzus.com/?entity=4201580 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.144.4.239 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-144-4-239.unifiedlayer.com Software Apache / Resource Hash `c8c4dfc2ed32d92ac29ac4605b25919a45923a919c0de07343e8e0083a2d3bf3` Request headers accept-language de-DE,de;q=0.9 Referer https://lgin-uphoolds.livenewzus.com/?entity=4201580 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Tue, 29 Nov 2022 19:59:47 GMT x-nginx-cache WordPress last-modified Tue, 22 Nov 2022 09:04:22 GMT server Apache x-endurance-cache-level 2 content-type image/jpeg cache-control max-age=31536000 accept-ranges bytes content-length 87193 expires Wed, 29 Nov 2023 19:59:47 GMT
GET H2	200	wp-emoji-release.min.js Show response lgin-uphoolds.livenewzus.com/wp-includes/js/	18 KB 5 KB	549ms 549ms	Script application/javascript	162.144.4.239 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lgin-uphoolds.livenewzus.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1 Requested by Host: lgin-uphoolds.livenewzus.com URL: https://lgin-uphoolds.livenewzus.com/?entity=4201580 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.144.4.239 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-144-4-239.unifiedlayer.com Software Apache / Resource Hash `5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782` Request headers accept-language de-DE,de;q=0.9 Referer https://lgin-uphoolds.livenewzus.com/?entity=4201580 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Tue, 29 Nov 2022 19:59:47 GMT content-encoding gzip x-nginx-cache WordPress last-modified Tue, 12 Apr 2022 16:26:24 GMT server Apache vary Accept-Encoding x-endurance-cache-level 2 content-type application/javascript cache-control max-age=21600 accept-ranges bytes content-length 5321 expires Wed, 30 Nov 2022 01:59:47 GMT
GET H2	200	sinatra.min.js Show response lgin-uphoolds.livenewzus.com/wp-content/themes/sinatra/assets/js/	16 KB 5 KB	547ms 547ms	Script application/javascript	162.144.4.239 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lgin-uphoolds.livenewzus.com/wp-content/themes/sinatra/assets/js/sinatra.min.js?ver=1.2.1 Requested by Host: lgin-uphoolds.livenewzus.com URL: https://lgin-uphoolds.livenewzus.com/?entity=4201580 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.144.4.239 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-144-4-239.unifiedlayer.com Software Apache / Resource Hash `4c0c143d44cd8f9372535a1774206d5cefc2472dc5b34eed351e243b32e48348` Request headers accept-language de-DE,de;q=0.9 Referer https://lgin-uphoolds.livenewzus.com/?entity=4201580 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36 Response headers date Tue, 29 Nov 2022 19:59:47 GMT content-encoding gzip x-nginx-cache WordPress last-modified Tue, 22 Nov 2022 08:58:29 GMT server Apache vary Accept-Encoding x-endurance-cache-level 2 content-type application/javascript cache-control max-age=21600 accept-ranges bytes content-length 5207 expires Wed, 30 Nov 2022 01:59:47 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Uphold (Crypto)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lgin-uphoolds.livenewzus.com
162.144.4.239
4c0c143d44cd8f9372535a1774206d5cefc2472dc5b34eed351e243b32e48348
505bf4e86be70122bf2f396b7e0d1c3b7f33c74fd6c951d72c7713d006103aa9
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a
c8c4dfc2ed32d92ac29ac4605b25919a45923a919c0de07343e8e0083a2d3bf3
e352d18523d5d334abbe19c325dd5cadcb67826b52345d95dbed6709d7e0096a
e6bd1abee148e880a6b7671f78751376ffe43be71d51e6d0c3324f45b745442d

lgin-uphoolds.livenewzus.com Open in urlscan Pro 162.144.4.239 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

173 kBTransfer

424 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

lgin-uphoolds.livenewzus.com Open in urlscan Pro
162.144.4.239 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

173 kB
Transfer

424 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!