![](/screenshots/50704217-9fe6-44c2-ac19-2bdc2cc989cc.png)
updatmywallets.com
Open in
urlscan Pro
54.37.93.155
Malicious Activity!
Public Scan
Effective URL: https://updatmywallets.com/import/
Submission: On April 28 via manual from MA — Scanned from CA
Summary
TLS certificate: Issued by R3 on April 28th 2023. Valid for: 3 months.
This is the only time updatmywallets.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Metamask (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 35.227.225.220 35.227.225.220 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 51.195.74.10 51.195.74.10 | 16276 (OVH) (OVH) | |
10 | 54.37.93.155 54.37.93.155 | 16276 (OVH) (OVH) | |
1 | 2607:f8b0:402... 2607:f8b0:4020:806::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:402... 2607:f8b0:4020:805::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2607:f8b0:402... 2607:f8b0:4020:805::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:9000:20e... 2600:9000:20ed:c800:c:7d55:b3c0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:402... 2607:f8b0:4020:806::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 18.195.235.189 18.195.235.189 | 16509 (AMAZON-02) (AMAZON-02) | |
17 | 7 |
ASN15169 (GOOGLE, US)
PTR: 220.225.227.35.bc.googleusercontent.com
email.ritualgym.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-235-189.eu-central-1.compute.amazonaws.com
etherodkada.matomo.cloud |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
updatmywallets.com
updatmywallets.com |
215 KB |
2 |
matomo.cloud
cdn.matomo.cloud — Cisco Umbrella Rank: 30788 etherodkada.matomo.cloud |
39 KB |
2 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 91 |
21 KB |
1 |
gstatic.com
fonts.gstatic.com |
44 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 119 |
1 KB |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 114 |
45 KB |
1 |
zaa-redirz.com
1 redirects
zaa-redirz.com |
243 B |
1 |
ritualgym.com
1 redirects
email.ritualgym.com |
356 B |
17 | 8 |
Domain | Requested by | |
---|---|---|
10 | updatmywallets.com |
updatmywallets.com
|
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
1 | etherodkada.matomo.cloud |
cdn.matomo.cloud
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | cdn.matomo.cloud |
updatmywallets.com
|
1 | fonts.googleapis.com |
updatmywallets.com
|
1 | www.googletagmanager.com |
updatmywallets.com
|
1 | zaa-redirz.com | 1 redirects |
1 | email.ritualgym.com | 1 redirects |
17 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
updatmywallets.com R3 |
2023-04-28 - 2023-07-27 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-04-03 - 2023-06-26 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-04-03 - 2023-06-26 |
3 months | crt.sh |
cdn.matomo.cloud Amazon RSA 2048 M01 |
2023-02-24 - 2023-12-25 |
10 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-04-03 - 2023-06-26 |
3 months | crt.sh |
*.matomo.cloud Amazon RSA 2048 M01 |
2023-02-10 - 2023-08-19 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://updatmywallets.com/import/
Frame ID: 967C0526C6802D86E79CE59A1E227D62
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/50704217-9fe6-44c2-ac19-2bdc2cc989cc.png)
Page Title
Confirm Secret Recovery PhrasePage URL History Show full URLs
-
http://email.ritualgym.com/e/c/eyJlIjo5NTc5OSwiZW1haWxfaWQiOiJleGFtcGxlIiwiaHJlZiI6Imh0dHBzOi8vemFhLXJl...
HTTP 302
https://zaa-redirz.com/azda%7B%7Bcustomer.email%7D%7Dda?utm_campaign=%5BCopy%5D+ea+a+ea&utm_content... HTTP 302
https://updatmywallets.com/import/ Page URL
Detected technologies
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://email.ritualgym.com/e/c/eyJlIjo5NTc5OSwiZW1haWxfaWQiOiJleGFtcGxlIiwiaHJlZiI6Imh0dHBzOi8vemFhLXJlZGlyei5jb20vYXpkYSU3QiU3QmN1c3RvbWVyLmVtYWlsJTdEJTdEZGE_dXRtX2NhbXBhaWduPSU1QkNvcHklNUQrZWErYStlYVx1MDAyNnV0bV9jb250ZW50PWVhK2ErZWFcdTAwMjZ1dG1fbWVkaXVtPWVtYWlsX2FjdGlvblx1MDAyNnV0bV9zb3VyY2U9Y3VzdG9tZXIuaW8iLCJ0IjoxNjgyNjMxMjUwfQ/5f4a144900bd5aa3dd67465586434921272074643b4022cf9a79b487e839196b
HTTP 302
https://zaa-redirz.com/azda%7B%7Bcustomer.email%7D%7Dda?utm_campaign=%5BCopy%5D+ea+a+ea&utm_content=ea+a+ea&utm_medium=email_action&utm_source=customer.io HTTP 302
https://updatmywallets.com/import/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
updatmywallets.com/import/ Redirect Chain
|
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
zwa9.css
updatmywallets.com/import/light/n3ayla/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
114 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
brand.svg
updatmywallets.com/import/light/numiro/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tel.png
updatmywallets.com/import/light/numiro/ |
115 B 357 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
slider.png
updatmywallets.com/import/light/numiro/ |
175 KB 176 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
kahromi.png
updatmywallets.com/import/light/numiro/motasafi7at/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fyrfox.png
updatmywallets.com/import/light/numiro/motasafi7at/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
idg.png
updatmywallets.com/import/light/numiro/motasafi7at/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
briv.png
updatmywallets.com/import/light/numiro/motasafi7at/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
danjal.js
updatmywallets.com/import/light/n3ayla/ |
7 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
51 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
matomo.js
cdn.matomo.cloud/etherodkada.matomo.cloud/ |
132 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
1 B 208 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
matomo.php
etherodkada.matomo.cloud/ |
0 171 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Metamask (Crypto)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| google_tag_manager object| google_tag_data object| dataLayer function| gtag string| GoogleAnalyticsObject function| ga object| _paq function| testInput function| generate_ul object| gaplugins object| gaGlobal object| gaData object| Piwik object| Matomo object| AnalyticsTracker function| piwik_log5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.updatmywallets.com/ | Name: _ga Value: GA1.2.1953526403.1682647640 |
|
.updatmywallets.com/ | Name: _gid Value: GA1.2.1611570320.1682647640 |
|
.updatmywallets.com/ | Name: _gat_gtag_UA_129523657_8 Value: 1 |
|
updatmywallets.com/ | Name: _pk_id.1.a1c9 Value: 1a024eed0b7136ec.1682647640. |
|
updatmywallets.com/ | Name: _pk_ses.1.a1c9 Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.matomo.cloud
email.ritualgym.com
etherodkada.matomo.cloud
fonts.googleapis.com
fonts.gstatic.com
updatmywallets.com
www.google-analytics.com
www.googletagmanager.com
zaa-redirz.com
18.195.235.189
2600:9000:20ed:c800:c:7d55:b3c0:93a1
2607:f8b0:4020:805::200a
2607:f8b0:4020:805::200e
2607:f8b0:4020:806::2003
2607:f8b0:4020:806::2008
35.227.225.220
51.195.74.10
54.37.93.155
488e2dd6efbdf809de8dbcf89e460fac2f7594607fd03b24d8a951441cd07a53
54e5d4a3e365353178963f325f0c74dfa6cc22a2501dbba90e749695869622b0
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7d794a3545f4d2daaccb9cfdc76a67606b8162ae7628308827b8102f6cb6118f
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
88821bfe249a0ffb2b5a46df8034fbbb2aab2d35a8bf76d8e144526cc6d6c35e
8f14537c465c51d987f9201db56a36c7fac35e3e8e5f336f340ec2eab6d5bea8
942ac312c2111716b68824067419271fe1d2dc4c65e9a8a38a2e69af3155c927
9ec9437e837f42e0d5c80a5ad2fcafcdb2f1666316ca46814e2804360389df2b
a03aebf1913b3625b76e90d4edf95106a5ad285c74197ff050ed244f412483df
b1b9f2e891049365b0c60954e56aec8fabcc278d965751fc9a88589b188d8302
b5c7d45de7c6757567c0309b8d4ef9041622283946183c96dc6c5e8e31e393fb
c1d525781834944d0c42d206d6e31f05b73a947821da73108bdf3a3d53e4c402
c4671ca4d3ec732130013b8088b6611856ef0acfabe546958f573ec5f5727309
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44