uplinkleve.com
Open in
urlscan Pro
45.133.200.3
Malicious Activity!
Public Scan
Effective URL: https://uplinkleve.com/css/indiana/logon/app/login.php?MTY1OTQ2Njc5NDcwMDU4N2NhNmE0MzJmNWY3YTdmZDdhM2EwNGMyNTc4NjgzNzU5...
Submission: On August 02 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on July 30th 2022. Valid for: 3 months.
This is the only time uplinkleve.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: US Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 17 | 45.133.200.3 45.133.200.3 | 200313 (INTERNET-IT) (INTERNET-IT) | |
16 | 1 |
ASN200313 (INTERNET-IT, VG)
PTR: cpanel-host.prohoster.info
uplinkleve.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
uplinkleve.com
1 redirects
uplinkleve.com |
273 KB |
16 | 1 |
Domain | Requested by | |
---|---|---|
17 | uplinkleve.com |
1 redirects
uplinkleve.com
|
16 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.uplinkleve.com R3 |
2022-07-30 - 2022-10-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://uplinkleve.com/css/indiana/logon/app/login.php?MTY1OTQ2Njc5NDcwMDU4N2NhNmE0MzJmNWY3YTdmZDdhM2EwNGMyNTc4NjgzNzU5OGMwNTk0M2NkNGFkODc0ZWRjZTZmNTNiMDg3NzAyNDNkZQ==
Frame ID: 8CB7C5AFCBE16D59391E22F852721128
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Claimant Self Service LogonPage URL History Show full URLs
-
https://uplinkleve.com/css/indiana/logon/
HTTP 302
https://uplinkleve.com/css/indiana/logon/app/login.php?MTY1OTQ2Njc5NDcwMDU4N2NhNmE0MzJmNWY3YTdmZDdh... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://uplinkleve.com/css/indiana/logon/
HTTP 302
https://uplinkleve.com/css/indiana/logon/app/login.php?MTY1OTQ2Njc5NDcwMDU4N2NhNmE0MzJmNWY3YTdmZDdhM2EwNGMyNTc4NjgzNzU5OGMwNTk0M2NkNGFkODc0ZWRjZTZmNTNiMDg3NzAyNDNkZQ== Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
uplinkleve.com/css/indiana/logon/app/ Redirect Chain
|
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.css
uplinkleve.com/css/indiana/logon/app/assets/css/ |
153 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap-theme.css
uplinkleve.com/css/indiana/logon/app/assets/css/ |
26 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
datepicker.css
uplinkleve.com/css/indiana/logon/app/assets/css/ |
17 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dwd_ui_2.css
uplinkleve.com/css/indiana/logon/app/assets/css/ |
14 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dwd_ui_new_logon.css
uplinkleve.com/css/indiana/logon/app/assets/css/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
top_banner_02-2.png
uplinkleve.com/css/indiana/logon/app/assets/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dwd_logo_header.png
uplinkleve.com/css/indiana/logon/app/assets/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
workone_logo.png
uplinkleve.com/css/indiana/logon/app/assets/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Get_Adobe_Acrobat_Reader_icon.png
uplinkleve.com/css/indiana/logon/app/assets/img/ |
60 KB 60 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DWD_sm2.png
uplinkleve.com/css/indiana/logon/app/assets/img/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DWD_seal_sm2.png
uplinkleve.com/css/indiana/logon/app/assets/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WO_sm2.png
uplinkleve.com/css/indiana/logon/app/assets/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
uplinkleve.com/css/indiana/logon/app/assets/js/ |
833 B 574 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hp-hero-img-bkg-img-1.jpg
uplinkleve.com/css/indiana/logon/app/assets/img/ |
106 KB 106 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
glyphicons-halflings-regular.ttf
uplinkleve.com/css/indiana/logon/app/assets/font/ |
44 KB 45 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: US Government (Government)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| btn object| username object| password1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
uplinkleve.com/ | Name: PHPSESSID Value: 89l5khcf7hnqt0suqpdb45r5l3 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
uplinkleve.com
45.133.200.3
02d752941b8287dbaffea39c3e85ede4fdd290c94d28007c6290d3f750579c70
0b4bdffe61a61e13eeebd6f6cf26d94d32ffdc1a903be5a06f964da4f48d252c
384efd3352ce7d1af2b2499f853b78fdaeffc2e0d2e9cc88d8ade0f21101e278
5bc5f64ae27ba1df17b0b51f7a21352cd9dd9e71c890223ed61920c49ddc944b
64cef246392cbcf778dc22da2a0b55cacfe3128edf47ceb7630b3dbdfdf70921
737583b7ef565d8ef3dac66402748b061252d53131b393f25d1a8ddace5c968b
75e091bf479bf068ca110648a5bf1a547c3937034136c6df9b0c7a6b756bd0ee
8c244e0969259ca2551354e74c8b4e03765d5c904bdebde9f76d04339ecf4be1
a480de0a4936506d2214e1df18af771a9f55dd9b783f5fffaeb82a43ae8ae4c0
be49d3c37d9a69304bc64f939549f1e23679538f8557f2e501c37aea9bc25efa
c38543754f7f4032641a203495c57ad9938b4b9acf96e916a7b2f91dc366a3e6
c67742e3f99c6c6e527d2b1e59adc5e9770ce1dd0de9b936e06bbc9803e9f454
e395044093757d82afcb138957d06a1ea9361bdcf0b442d06a18a8051af57456
e9d799f426b22004c33e534cf0a63f1236f1a3c18a941e899ddcfabdddf8c846
fc4889186113664ddba1a1289bfd7417da8d1a5a29196a5df5826452cd6a139a
fe4996d9bc6553f63ff89bc7dab848b4d6251620a8bc70218c2f73a1a291326a