uphold_logiin_us.godaddysites.com
Open in
urlscan Pro
13.248.243.5
Malicious Activity!
Public Scan
Submission: On December 29 via automatic, source openphish — Scanned from US
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 13th 2024. Valid for: a year.
This is the only time uphold_logiin_us.godaddysites.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Uphold (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 13.248.243.5 13.248.243.5 | 16509 (AMAZON-02) (AMAZON-02) | |
2 29 | 23.212.249.79 23.212.249.79 | 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.) | |
2 | 2600:1408:ec0... 2600:1408:ec00:2e::1735:bb0 | 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.) | |
2 | 2600:1408:ec0... 2600:1408:ec00:281::228b | 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.) | |
32 | 4 |
ASN16509 (AMAZON-02, US)
PTR: a16e665f42988324c.awsglobalaccelerator.com
uphold_logiin_us.godaddysites.com |
ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-212-249-79.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
events.api.secureserver.net |
ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
csp.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
29 |
wsimg.com
2 redirects
img1.wsimg.com — Cisco Umbrella Rank: 10742 |
266 KB |
4 |
secureserver.net
events.api.secureserver.net — Cisco Umbrella Rank: 13900 csp.secureserver.net — Cisco Umbrella Rank: 13675 |
588 B |
1 |
godaddysites.com
uphold_logiin_us.godaddysites.com |
5 KB |
32 | 3 |
Domain | Requested by | |
---|---|---|
29 | img1.wsimg.com |
2 redirects
uphold_logiin_us.godaddysites.com
img1.wsimg.com |
2 | csp.secureserver.net |
img1.wsimg.com
|
2 | events.api.secureserver.net |
img1.wsimg.com
|
1 | uphold_logiin_us.godaddysites.com | |
32 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.godaddysites.com Go Daddy Secure Certificate Authority - G2 |
2024-09-13 - 2025-10-15 |
a year | crt.sh |
*.wsimg.com Starfield Secure Certificate Authority - G2 |
2024-09-19 - 2025-10-21 |
a year | crt.sh |
*.api.secureserver.net Starfield Secure Certificate Authority - G2 |
2024-07-15 - 2025-08-16 |
a year | crt.sh |
*.secureserver.net Starfield Secure Certificate Authority - G2 |
2024-10-17 - 2025-11-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://uphold_logiin_us.godaddysites.com/
Frame ID: F97ECB554A10507A5E39C0EA067C960B
Requests: 32 HTTP requests in this frame
Screenshot
Page Title
Uphold | LoginDetected technologies
GoDaddy Website Builder (CMS) ExpandDetected patterns
RequireJS (JavaScript Frameworks) Expand
Detected patterns
- require.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js HTTP 301
- https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
- https://img1.wsimg.com/traffic-assets/js/tccl-tti.min.js HTTP 301
- https://img1.wsimg.com/signals/js/clients/tti/tti.min.js
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
uphold_logiin_us.godaddysites.com/ |
18 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UX.4.28.0.js
img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/ |
307 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
league-spartan.css
img1.wsimg.com/blobby/go/font/LeagueSpartan/ |
330 B 708 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rs=w:1240,cg:true
img1.wsimg.com/isteam/ip/20f73a1b-6868-4b80-ba7e-4a88a40d70b3/uphold%20login.png/:/cr=t:0%25,l:0%25,w:100%25,h:100%25/ |
32 KB 33 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
img1.wsimg.com/blobby/go/20f73a1b-6868-4b80-ba7e-4a88a40d70b3/gpub/4f0f7c60b3646b2c/ |
59 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scc-c2.min.js
img1.wsimg.com/signals/js/clients/scc-c2/ Redirect Chain
|
103 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tti.min.js
img1.wsimg.com/signals/js/clients/tti/ Redirect Chain
|
21 KB 8 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-layout13-Theme-publish-Theme-101917f4.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-_rollupPluginBabelHelpers-5f52e4cb.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
583 B 827 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-defaultSocialIconPack-91835b99.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
23 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-humanisticFilled-231afaba.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-index-d15d4cb0.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
876 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-index3-3515635e.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
237 KB 57 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-legacyOverrides-17961cd1.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
324 B 706 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-loaders-fffeeba5.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-overlayTypes-e1dbe765.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
437 B 785 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-themeOverrides-e736c017.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
842 B 870 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Carousel-3d82957b.js
img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/lib/components/ |
24 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ColorSwatch-4196a0a9.js
img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/lib/components/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-dataAids-6a839d53.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-index2-5a810c82.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-navigationDrawer-27f5f1f5.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
221 B 637 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-searchFormLocations-c86f2a99.js
img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/ |
304 B 693 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_commonjsHelpers-67085353.js
img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/c/ |
960 B 962 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_react_commonjs-external-a1351e34.js
img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/c/ |
266 B 659 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_rollupPluginBabelHelpers-8ce54c82.js
img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/c/ |
586 B 827 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
interopRequireDefault-c83974f7.js
img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/c/ |
390 B 718 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
event
events.api.secureserver.net/t/1/tl/ |
43 B 294 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
event
events.api.secureserver.net/t/1/tl/ |
43 B 294 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rs=w:32,h:32,m
img1.wsimg.com/isteam/ip/20f73a1b-6868-4b80-ba7e-4a88a40d70b3/favicon/475d22cb-cab6-41a8-978d-b678fbd389bb.png/:/ |
886 B 1 KB |
Other
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
web
csp.secureserver.net/eventbus/ |
0 0 |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
web
csp.secureserver.net/eventbus/ |
0 0 |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Uphold (Crypto)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| trackingEnabledForType function| logTcclEvent function| radpack object| networkInfo object| _trfq object| _trfd function| define object| Core object| React object| ReactDOM function| keyMirror function| _ object| PropTypes object| Dials function| cxs object| t object| wsb object| _tcclInternal object| _expDataLayer object| _signalsDataLayer object| scc-c2 object| global object| tti4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
uphold_logiin_us.godaddysites.com/ | Name: dps_site_id Value: us-east-1 |
|
.godaddysites.com/ | Name: _tccl_visitor Value: 7890d084-c7c5-425f-99e1-a2c520ed7205 |
|
.godaddysites.com/ | Name: _tccl_visit Value: 7890d084-c7c5-425f-99e1-a2c520ed7205 |
|
.godaddysites.com/ | Name: _scc_session Value: pc=1&C_TOUCH=2024-12-29T13:08:34.128Z |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors 'self' godaddy.com *.godaddy.com |
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
csp.secureserver.net
events.api.secureserver.net
img1.wsimg.com
uphold_logiin_us.godaddysites.com
13.248.243.5
23.212.249.79
2600:1408:ec00:281::228b
2600:1408:ec00:2e::1735:bb0
010083b88e95f18cefdb90796acce02073e91fc8dfefb27a7f5f3f75529e4906
03f278836505e268d8b286774cf646016c5cc65bf893b7541be1a2a63cc66d4c
0fe26f07b9e5d49590f55d31cbc381ca9337850f89b09940e3b384fcd6d26464
14bebd40a585e9fed02fbcd81d368af65a8d3e4be495d6caad1e839499809547
16d88542cc7ca86a4c6ad346b78f5d4b6ba2ec54bf7fbc53ca38aab92064a0da
1fcdecc8856c921591b63ece8e3ee69b85dc1bb020247dae20fe7c3b3779a94e
265995eb76326e95613750f6f6570b850f5c22280d262de9b9632a16ceb98b9b
2a2fbba7ba603306f1ef3c661ab56a2e87458f08902f4fd83f0abc95e1018e24
3b54aeacfda01be53800632989a82f6f5a7f92e927159a37a4324b38d3dffef8
3c37a4aa3cf6aaae6921a4b750c0e4f81fd338d6878be90b0faf2f921039cb23
3d7e7552e3801941a408c504aa732223fe2bed5d12e248680847d772182cb639
45faaa17694e6ba660358ac8005e4a87eeeb817d99ba2a2e8e6684a591eefdbc
513864fd4ebd1926f3e1e78b436a90c2bc3a5d16835b50415e7b318d7deec2a2
5712a0dcf37ac601a9e017fba9f9276c9206a730adf495186421af66d4b3f49e
604281887cd770ed21601933e9636a7a9c8a57a30d7d796ae7d760eef64d5089
72c6df194818462d86074eaf05fc75f13cabc26431999b329e51a0c26a9f4c81
7727f84eac14fe82243924684b431eeefa12f779c0cabc62f684db7d3aab8369
7de5a32743f81905a983e9090602d9c4a9fb77d4e99180168c67ed78a57ab41a
8128f61384f5b224dca6e712704e0cb0a12b2189087564ac0e3058d1f7f6c3ef
b08c2864ec27736c507b1ca4b3a225a19147841b861cd8494daf95fa370fe639
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4c48b77bbe6bbacf7d16bdaa81f5509fb8ea0fbfddfbf2d12307f7a88518846
bae437dbefe58377d88c9d579db7c59f4202f3fbf88866d0005fb375be6b2cd7
c818b56446ae5a8d0466fc9c51d85104584e36f6d8b1c77e08a2d354e845e2cd
d8dfb9af8f69c377a9345e326b57437fcd40d12825c484b2c9e345ebe1270deb
dae89c4d8697dc845428a11c2bde64334ab65738ee97f598414d857b5d9d3fd2
df2bb9597a554b46bd807cfd97ec6e3f7194ccc218b95d7f1e899657c1cf9fcc
e8a5463ff98210d3017deee55d5a287ad01aaa11dbe7deb7d07f7d15d7f609f2
ed9ffa2fba5ecc75af2f99e6ebadd5b927086f258037c2a848e94449cc579991