Windows Analysis Report
https://upholdloginie.godaddysites.com/

Overview

General Information

Sample URL:	https://upholdloginie.godaddysites.com/
Analysis ID:	1522050
Tags:	openphish
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detected non-DNS traffic on DNS port

Classification

Signatures

Phishing

AI detected phishing page

Source: https://upholdloginie.godaddysites.com/uphold-l%C5%8Dgin-official

LLM: Score: 9 Reasons: The legitimate domain for Uphold is uphold.com., The provided URL 'upholdloginie.godaddysites.com' does not match the legitimate domain., The URL contains 'godaddysites.com', which is a domain used for hosting websites and is not directly associated with Uphold., The subdomain 'upholdloginie' is suspicious and not a standard subdomain used by Uphold., The presence of input fields for sensitive information (Email, Password) on a non-legitimate domain is a common phishing tactic. DOM: 32.2.pages.csv

Source: https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-in_corp_applications_base

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49848 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.6:49730 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://upholdloginie.godaddysites.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _tccl_visit=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _scc_session=pc=1&C_TOUCH=2024-09-29T05:53:36.666Z
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://upholdloginie.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://upholdloginie.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _tccl_visit=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _scc_session=pc=1&C_TOUCH=2024-09-29T05:53:36.666Z
Source: global traffic	HTTP traffic detected: GET /uphold-l%C5%8Dgin-official HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://upholdloginie.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _tccl_visit=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _scc_session=pc=1&C_TOUCH=2024-09-29T05:53:36.666Z
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://upholdloginie.godaddysites.com/sw.jsUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _tccl_visit=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _scc_session=pc=2&C_TOUCH=2024-09-29T05:53:51.549ZIf-None-Match: cff7d80a088795bdda9dcdf8c92c6676

Source: global traffic	DNS traffic detected: DNS query: upholdloginie.godaddysites.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: events.api.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: csp.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: www.godaddy.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundLink: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.27.2.js>; rel=preload; as=script; crossorigin,<https://img1.wsimg.com/gfonts/s/cabin/v27/u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7alxw.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/lato/v24/S6u8w4BMUTPHjxsAXC-q.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/lato/v24/S6u_w4BMUTPHjxsI5wq_Gwft.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/lato/v24/S6u8w4BMUTPHh30AXC-q.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ.woff2>; rel=preload; as=font; crossorigin,<https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossoriginCache-Control: max-age=30Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.comContent-Type: text/html;charset=utf-8Vary: Accept-EncodingServer: DPS/2.0.0+sha-227ca78X-Version: 227ca78X-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Sun, 29 Sep 2024 05:53:42 GMTConnection: closeTransfer-Encoding: chunked

Source: chromecache_252.2.dr, chromecache_227.2.dr, chromecache_293.2.dr, chromecache_277.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/cabin/v27/u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7alxw.wof
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/cabin/v27/u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7ilx17r.w
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/cabin/v27/u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7mlx17r.w
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u8w4BMUTPHh30AUi-qJCY.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u8w4BMUTPHh30AXC-q.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u8w4BMUTPHjxsAUi-qJCY.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u8w4BMUTPHjxsAXC-q.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh50XSwaPGR_p.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh7USSwaPGR_p.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u_w4BMUTPHjxsI5wq_FQft1dw.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u_w4BMUTPHjxsI5wq_Gwft.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2)
Source: chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/isteam/ip/3ace6614-6084-4f91-9a59-1e229f814716/upholddd.jpg
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
Source: chromecache_242.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_273.2.dr	String found in binary or memory: https://upholdloginie.godaddysites.com/404
Source: chromecache_268.2.dr, chromecache_241.2.dr	String found in binary or memory: https://upholdloginie.godaddysites.com/uphold-l%C5%8Dgin-official
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applica
Source: chromecache_216.2.dr, chromecache_250.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49848 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@23/144@18/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2240,i,3924135059581285012,13270627194640580722,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://upholdloginie.godaddysites.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2240,i,3924135059581285012,13270627194640580722,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
13.248.243.5	upholdloginie.godaddysites.com	United States	16509	AMAZON-02US	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
3.64.248.63	isteam.wsimg.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.6
192.168.2.5

Contacted Domains

Name	IP	Active
upholdloginie.godaddysites.com	13.248.243.5	true
bg.microsoft.map.fastly.net	199.232.210.172	true
www.google.com	142.250.184.196	true
isteam.wsimg.com	3.64.248.63	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
img1.wsimg.com	unknown	unknown
csp.secureserver.net	unknown	unknown
events.api.secureserver.net	unknown	unknown
www.godaddy.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://upholdloginie.godaddysites.com/	false	unknown
https://upholdloginie.godaddysites.com/favicon.ico	false	unknown
https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-in_corp_applications_base	false	unknown
https://upholdloginie.godaddysites.com/sw.js	false	unknown
https://upholdloginie.godaddysites.com/manifest.webmanifest	false	unknown
https://upholdloginie.godaddysites.com/uphold-l%C5%8Dgin-official	true	unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 205	ASCII text, with very long lines (65536), with no line terminators	E0201F84421293DA324B0057E86FE74A	90FC5CE7E236D874C6A49B5D31A328817D9B5654	0BCCC3F322140FFC7FFAB57C9A9B37C0DBD576A2474522D917F064B51D8C7274
Chrome Cache Entry: 206	ASCII text, with very long lines (442)	5F10DF611C856F376981BE4DFBD17753	4463A27419B2FDFDBD81770C74DEE2E74BE948E0	EBD2BA2A0E879AE2CEC7D513324E04346153A581BE3AA202662E6C9D5B1CE6E1
Chrome Cache Entry: 207	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 208	ASCII text, with very long lines (905)	62A914B2C847D4D02B76164D7A2A54C6	20D9F49A90A51FA6C8420640610DF77F7A96D919	B08C2864EC27736C507B1CA4B3A225A19147841B861CD8494DAF95FA370FE639
Chrome Cache Entry: 209	ASCII text, with very long lines (651)	7B01FCDF2048E82F4DF741791CD44F61	D1D126931B5D6937B1496E7950342D6A06F361B9	CBC04C06117804A9A97013C97A0714B027DF8279C5F1D0FD0478756A0944AEE6
Chrome Cache Entry: 210	ASCII text, with very long lines (2368)	70BC240B39FD393F6E3003CC69E4FE73	B69B4A25E3EB749ADFD1E13224FC59DC73B196ED	9CE79703BF9EF25C61BA4FEED40992772B9231110F6AAB72B714D9517219B3F9
Chrome Cache Entry: 211	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 400x267, components 3	1EBB7AC6A100313E8EBF31343C9FFA0A	10EB6BB13818045A504CB84C1E87A422A353C77B	298BEB6A2A84A04F6CF4480E3CDD5C3A54A1AE84F51D9D705EE1627A0F3FDC66
Chrome Cache Entry: 212	ASCII text, with very long lines (50909)	FD2633592114B0FC7D94F6147B0DBD40	800CDC6CDB5ABDD4010B42D08E757B54DEED7943	8BA20FB775737F13E825D5043844F4ED641A5A45A1F58656AC09CC035192EFA3
Chrome Cache Entry: 213	HTML document, ASCII text	EDA1023D9249649B536C3B965A02EA82	3B50794AAED1A2A7BAF65DFF2E2089B2D0ED6876	6FBFE96AC693D992D8D19292F12A11DFADCB501C1A8231DC4A3FE3D8364ECD1B
Chrome Cache Entry: 214	Web Open Font Format (Version 2), TrueType, length 23040, version 1.0	DE69CF9E514DF447D1B0BB16F49D2457	2AC78601179C3A63BA3F3F3081556B12DDCAF655	C447DD7677B419DB7B21DBDFC6277C7816A913FFDA76FD2E52702DF538DE0E49
Chrome Cache Entry: 215	ASCII text, with very long lines (21556)	1C56940A864F144FAE2EB40EE952CB94	EBFC754CE962A1F9025853F2995B3987F0383D87	3C37A4AA3CF6AAAE6921A4B750C0E4F81FD338D6878BE90B0FAF2F921039CB23
Chrome Cache Entry: 216	ASCII text, with very long lines (5519)	01B4FAA5F94737D8B9F1B5936322A717	97D537FE0EA8A77ABAED5751DB9B4DD6FA25567B	3E3C3D09F6F272EAA48D8C9E4ED067CC38BD5DD5EDD7E8438C5D3C00C8BADB88
Chrome Cache Entry: 217	ASCII text, with very long lines (12251)	9F94046AEA26739AC8888A6D3ED17E16	9AD04A9430086B1A1A403D9FB0485174393EB8BC	5712A0DCF37AC601A9E017FBA9F9276C9206A730ADF495186421AF66D4B3F49E
Chrome Cache Entry: 218	ASCII text, with very long lines (19615)	5FD30BB38EBA06E3522AE28610AC8C74	B9FA328B098321E7C7AABC154A2135DC165D25F7	A94E9E0D7E80FB8129F6C33F78F6B03F08C2EB5722870CCFA7CC2893190C9C20
Chrome Cache Entry: 219	Web Open Font Format (Version 2), TrueType, length 22504, version 1.0	1C6C65523675ABC6FCD78E804325BD77	898D9808304DC157F5DCB18CA169EC6E2B96B3D7	08664859BAAB5ED98F0BF818ED77E38464FF1826DC6406D5ECBD651409AFBD92
Chrome Cache Entry: 220	ASCII text, with very long lines (65536), with no line terminators	E0201F84421293DA324B0057E86FE74A	90FC5CE7E236D874C6A49B5D31A328817D9B5654	0BCCC3F322140FFC7FFAB57C9A9B37C0DBD576A2474522D917F064B51D8C7274
Chrome Cache Entry: 221	ASCII text, with very long lines (32976), with no line terminators	CFF7D80A088795BDDA9DCDF8C92C6676	8195296420CB29C7B8067D51C5BFB32EDBDD98A8	5240607F5E8CE6DE32058E6821723193C1F6EA886BEDD63B00CE91CCFF5F7D61
Chrome Cache Entry: 222	ASCII text, with very long lines (1211)	CB9BFA0FBDD957FBE7F4841B70341DB2	9CAD12A3580D3E4D340CB867E88B687C75564C5A	513864FD4EBD1926F3E1E78B436A90C2BC3A5D16835B50415E7B318D7DEEC2A2
Chrome Cache Entry: 223	ASCII text, with very long lines (829)	F806FAAB29346709AA36F154927B3AC6	26A0B7AD2B844F2318229738927519A822D93445	DF2BB9597A554B46BD807CFD97EC6E3F7194CCC218B95D7F1E899657C1CF9FCC
Chrome Cache Entry: 224	Web Open Font Format (Version 2), TrueType, length 24408, version 1.0	EFEE2D080D7BEBDD2E0AEB2E030813A0	F8D38F9F9584E48C2E469877EBD94232265585F1	BCA1D88ADA544D9C80872D4DA27133FAB6D347361FA26E932B47EC9559088FD0
Chrome Cache Entry: 225	Web Open Font Format (Version 2), TrueType, length 21508, version 1.0	24B8A8ABBEC56AB127ADC36E35F49BB3	0906975D70856EF3DF1AE3D91DB5D29687981C3F	A79B4C65B454A795FF3868156F54BE09AC8360B9FD3BA21431B5C48FD9B66AFA
Chrome Cache Entry: 226	ASCII text, with very long lines (13449)	E135455ABAC1E365C75ACB29427BE2BD	386B236DC493D0EBE7827B2FD8897CC9DF4FE222	88C66FB773F05F8A1B9EA9092CDE47FD6204EB3D3E5EF91F8223BD8A62339B40
Chrome Cache Entry: 227	Unicode text, UTF-8 text, with very long lines (20947)	753CB19EE1A756E46FAA0F118B1B4E01	248885E3BFE7E71989BA9FFFB33B6EFF18166FEC	ED9FFA2FBA5ECC75AF2F99E6EBADD5B927086F258037C2A848E94449CC579991
Chrome Cache Entry: 228	ASCII text	8F12765EB30FBDCFCDC116D13F7FC272	506E45B7D3930756EACCE0DAD449A3C8CDB3EAC6	265995EB76326E95613750F6F6570B850F5C22280D262DE9B9632A16CEB98B9B
Chrome Cache Entry: 229	ASCII text	E0DD176C6926B0363ADAF4F9AAEF6EE1	22F6B48EF8091561BE6C2475FCFD98FDDD5A8876	7727F84EAC14FE82243924684B431EEEFA12F779C0CABC62F684DB7D3AAB8369
Chrome Cache Entry: 230	ASCII text, with very long lines (65536), with no line terminators	6A7950CC31489069917BF817B62B2BFE	44AAB6E9B8FDBAA23EA297CE69E26422277907C0	1B4DACB0DAFDA81D48EE0890EA113B3B8275BF2D16D5325F971F16EB75F7218A
Chrome Cache Entry: 231	ASCII text, with very long lines (905)	62A914B2C847D4D02B76164D7A2A54C6	20D9F49A90A51FA6C8420640610DF77F7A96D919	B08C2864EC27736C507B1CA4B3A225A19147841B861CD8494DAF95FA370FE639
Chrome Cache Entry: 232	ASCII text, with very long lines (383)	21AD22788E6CAA18A4E9E57F7372B108	50EBDD2452193BEAB7D1899F788FBBF32D90DD55	0FE26F07B9E5D49590F55D31CBC381CA9337850F89B09940E3B384FCD6D26464
Chrome Cache Entry: 233	ASCII text, with very long lines (2368)	70BC240B39FD393F6E3003CC69E4FE73	B69B4A25E3EB749ADFD1E13224FC59DC73B196ED	9CE79703BF9EF25C61BA4FEED40992772B9231110F6AAB72B714D9517219B3F9
Chrome Cache Entry: 234	ASCII text	DAA79AD7558674F6A12D962ABF47F2F6	03EEA0EBEBD11EC14CFA5A651EB0ACA2604829A7	604281887CD770ED21601933E9636A7A9C8A57A30D7D796AE7D760EEF64D5089
Chrome Cache Entry: 235	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 1160x490, components 3	9499DB813375D5C6E504B995FC04ACC7	83308A7EDD87A70663557D7CD24B339EEFE22023	A9A8F0E6CFB8E9F87F59CD98541B42BA8A9EA22B3DE91E8823444AE69E575E44
Chrome Cache Entry: 236	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 237	ASCII text, with very long lines (50909)	FD2633592114B0FC7D94F6147B0DBD40	800CDC6CDB5ABDD4010B42D08E757B54DEED7943	8BA20FB775737F13E825D5043844F4ED641A5A45A1F58656AC09CC035192EFA3
Chrome Cache Entry: 238	ASCII text, with very long lines (13449)	E135455ABAC1E365C75ACB29427BE2BD	386B236DC493D0EBE7827B2FD8897CC9DF4FE222	88C66FB773F05F8A1B9EA9092CDE47FD6204EB3D3E5EF91F8223BD8A62339B40
Chrome Cache Entry: 239	ASCII text, with very long lines (383)	21AD22788E6CAA18A4E9E57F7372B108	50EBDD2452193BEAB7D1899F788FBBF32D90DD55	0FE26F07B9E5D49590F55D31CBC381CA9337850F89B09940E3B384FCD6D26464
Chrome Cache Entry: 240	RIFF (little-endian) data, Web/P image	C047513E9302749814B9A81971A6521E	9FBA11FAD05D19270BBDC7775800C915483401B9	AAAB650497AF1ABA9CA343B620AE4C798F9136D83CDE3A3557AB0309843805C9
Chrome Cache Entry: 241	HTML document, Unicode text, UTF-8 text, with very long lines (35897)	C1DE5C0572BA27F1094388C0FD6B38B8	F8A3B489AE473B0B82400AF2C520F87C60CB383D	04995427C1FA42916FB1AF770E74FE7304D5E6BBFA6ADC4F435A82F3D0E99E6D
Chrome Cache Entry: 242	ASCII text, with very long lines (2343)	575B5480531DA4D14E7453E2016FE0BC	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
Chrome Cache Entry: 243	ASCII text	DAA79AD7558674F6A12D962ABF47F2F6	03EEA0EBEBD11EC14CFA5A651EB0ACA2604829A7	604281887CD770ED21601933E9636A7A9C8A57A30D7D796AE7D760EEF64D5089
Chrome Cache Entry: 244	ASCII text, with very long lines (516)	4A37F23CB638C625FC8451584283E359	06E59198676105545F014464A40AD8D98C4DAD49	72C6DF194818462D86074EAF05FC75F13CABC26431999B329E51A0C26A9F4C81
Chrome Cache Entry: 245	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 246	ASCII text	8578A331AD09BB2EF6359FEC3916BEFC	38B68F5C02CBDB6E29C50F8858710E0392B0B8D6	3D7E7552E3801941A408C504AA732223FE2BED5D12E248680847D772182CB639
Chrome Cache Entry: 247	Web Open Font Format (Version 2), TrueType, length 16680, version 1.0	418EF4BC695166FFE3E360464C36D561	14DC7DEBE48D39DF7918760E9C9D9642F5563140	E0A2B0E87B833F07A76BDAAECEF067579C0988C25E6FD528C96B410004605E60
Chrome Cache Entry: 248	Web Open Font Format (Version 2), TrueType, length 24448, version 1.0	865E46AF816320C9F32234E8968558D0	6791E9F732FCBDE0F375F84CCBC14C4AC72795A3	6C84348296EBE2E2A0830C3962EB02156419D9BC76371C2EADAF7329D827D550
Chrome Cache Entry: 249	ASCII text, with very long lines (3283)	D2F3F3BB13567C7C3BA8C50DE05A8272	E96C9C5245969078F3CF6B4B055E6CA89056C1ED	F7B54B29718E20C7DEB19DE55648211D23A008BECC9AD6BFDE01A72A09072B2B
Chrome Cache Entry: 250	ASCII text, with very long lines (5519)	01B4FAA5F94737D8B9F1B5936322A717	97D537FE0EA8A77ABAED5751DB9B4DD6FA25567B	3E3C3D09F6F272EAA48D8C9E4ED067CC38BD5DD5EDD7E8438C5D3C00C8BADB88
Chrome Cache Entry: 251	ASCII text, with very long lines (367)	401821742DEF46C40D4CF5F0121C8BEC	1852305A4F2D7E120F9B7BD185790B98CDF9BFA6	462D8298239BC61418760DB4204CD135D990537E625782D059CB9D3A1D0266A4
Chrome Cache Entry: 252	Unicode text, UTF-8 text, with very long lines (63425)	F72A36608097CA8BF021D801E3933881	76C2DF4235FA9A39632E49142DB3460FD2C27F7F	F504DB42834DA17054958C0B451268F0A17DFB98EEAF91CA65019DA991512043
Chrome Cache Entry: 253	RIFF (little-endian) data, Web/P image	CDBC5DDC2FDC9F90A7C054F3A2AACECF	A489C20E566D19C4FE8009D9074BFB5F1D56ED7E	FFADC6C50306427CC8AC2303089AC018C37FEADF0C9B08726BBCB04B94C1029C
Chrome Cache Entry: 254	Web Open Font Format (Version 2), TrueType, length 23236, version 1.0	716309AAB2BCA045F9627F63AD79D0BF	38804233A29AAF975D557FE14E762C627BEF76E0	115F6A626CA115D4AD5581B59275327E0E860B30330A52B0F785561332DD2429
Chrome Cache Entry: 255	ASCII text, with very long lines (651)	7B01FCDF2048E82F4DF741791CD44F61	D1D126931B5D6937B1496E7950342D6A06F361B9	CBC04C06117804A9A97013C97A0714B027DF8279C5F1D0FD0478756A0944AEE6
Chrome Cache Entry: 256	ASCII text, with very long lines (1352)	DA82F14F261B7847FC0BC55DAC30A9B3	94D7EDACB4F425A3CB1E6B7B70301A60027E3AF8	03F278836505E268D8B286774CF646016C5CC65BF893B7541BE1A2A63CC66D4C
Chrome Cache Entry: 257	ASCII text, with very long lines (2343)	575B5480531DA4D14E7453E2016FE0BC	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
Chrome Cache Entry: 258	ASCII text, with very long lines (3283)	D2F3F3BB13567C7C3BA8C50DE05A8272	E96C9C5245969078F3CF6B4B055E6CA89056C1ED	F7B54B29718E20C7DEB19DE55648211D23A008BECC9AD6BFDE01A72A09072B2B
Chrome Cache Entry: 259	ASCII text, with very long lines (14742)	4E56DDB045B48F1074F336A33249E577	2C5DED666EBC66F9D7A45135DF7A55C60C4DA6D1	B3FA00681128F7B43422A70A5463904CC1D9FB9AB2BB35859D7832E215AF16D3
Chrome Cache Entry: 260	ASCII text, with very long lines (330)	C86B7F8224FA45FB1682AC94D8F75AC6	9561F67AAE74B14702DB79C22F9C7F9E6F3B3239	010083B88E95F18CEFDB90796ACCE02073E91FC8DFEFB27A7F5F3F75529E4906
Chrome Cache Entry: 261	ASCII text	8578A331AD09BB2EF6359FEC3916BEFC	38B68F5C02CBDB6E29C50F8858710E0392B0B8D6	3D7E7552E3801941A408C504AA732223FE2BED5D12E248680847D772182CB639
Chrome Cache Entry: 262	ASCII text, with very long lines (19615)	5FD30BB38EBA06E3522AE28610AC8C74	B9FA328B098321E7C7AABC154A2135DC165D25F7	A94E9E0D7E80FB8129F6C33F78F6B03F08C2EB5722870CCFA7CC2893190C9C20
Chrome Cache Entry: 263	ASCII text, with very long lines (21556)	1C56940A864F144FAE2EB40EE952CB94	EBFC754CE962A1F9025853F2995B3987F0383D87	3C37A4AA3CF6AAAE6921A4B750C0E4F81FD338D6878BE90B0FAF2F921039CB23
Chrome Cache Entry: 264	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 265	ASCII text, with very long lines (367)	401821742DEF46C40D4CF5F0121C8BEC	1852305A4F2D7E120F9B7BD185790B98CDF9BFA6	462D8298239BC61418760DB4204CD135D990537E625782D059CB9D3A1D0266A4
Chrome Cache Entry: 266	ASCII text, with very long lines (330)	C86B7F8224FA45FB1682AC94D8F75AC6	9561F67AAE74B14702DB79C22F9C7F9E6F3B3239	010083B88E95F18CEFDB90796ACCE02073E91FC8DFEFB27A7F5F3F75529E4906
Chrome Cache Entry: 267	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 268	HTML document, Unicode text, UTF-8 text, with very long lines (35897)	C1DE5C0572BA27F1094388C0FD6B38B8	F8A3B489AE473B0B82400AF2C520F87C60CB383D	04995427C1FA42916FB1AF770E74FE7304D5E6BBFA6ADC4F435A82F3D0E99E6D
Chrome Cache Entry: 269	ASCII text	8F12765EB30FBDCFCDC116D13F7FC272	506E45B7D3930756EACCE0DAD449A3C8CDB3EAC6	265995EB76326E95613750F6F6570B850F5C22280D262DE9B9632A16CEB98B9B
Chrome Cache Entry: 270	ASCII text, with very long lines (1352)	DA82F14F261B7847FC0BC55DAC30A9B3	94D7EDACB4F425A3CB1E6B7B70301A60027E3AF8	03F278836505E268D8B286774CF646016C5CC65BF893B7541BE1A2A63CC66D4C
Chrome Cache Entry: 271	ASCII text, with very long lines (12251)	9F94046AEA26739AC8888A6D3ED17E16	9AD04A9430086B1A1A403D9FB0485174393EB8BC	5712A0DCF37AC601A9E017FBA9F9276C9206A730ADF495186421AF66D4B3F49E
Chrome Cache Entry: 272	ASCII text, with very long lines (1211)	CB9BFA0FBDD957FBE7F4841B70341DB2	9CAD12A3580D3E4D340CB867E88B687C75564C5A	513864FD4EBD1926F3E1E78B436A90C2BC3A5D16835B50415E7B318D7DEEC2A2
Chrome Cache Entry: 273	HTML document, Unicode text, UTF-8 text, with very long lines (17181)	D40FF7219CDB8BD2FC8A27F4B1BA9D28	645F1F1D93540EDDA304779C28A6C56E46299939	643D8BA18CC202C7874E205E0967115108F2510E73AE87CA05DAB3C984A31165
Chrome Cache Entry: 274	ASCII text, with very long lines (1875)	DB9B98D640EBA155278DB0BBAA83050D	25F72D93FE64E2B9A398C2D74D6EC747533E613B	4666B9BD872EBF01AD511B5B7628C5E19362AA01B05A6EDC2A266527780E1865
Chrome Cache Entry: 275	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 276	ASCII text, with very long lines (442)	5F10DF611C856F376981BE4DFBD17753	4463A27419B2FDFDBD81770C74DEE2E74BE948E0	EBD2BA2A0E879AE2CEC7D513324E04346153A581BE3AA202662E6C9D5B1CE6E1
Chrome Cache Entry: 277	Unicode text, UTF-8 text, with very long lines (20947)	753CB19EE1A756E46FAA0F118B1B4E01	248885E3BFE7E71989BA9FFFB33B6EFF18166FEC	ED9FFA2FBA5ECC75AF2F99E6EBADD5B927086F258037C2A848E94449CC579991
Chrome Cache Entry: 278	Web Open Font Format (Version 2), TrueType, length 23580, version 1.0	E1B3B5908C9CF23DFB2B9C52B9A023AB	FCD4136085F2A03481D9958CC6793A5ED98E714C	918B7DC3E2E2D015C16CE08B57BCB64D2253BAFC1707658F361E72865498E537
Chrome Cache Entry: 279	ASCII text, with very long lines (522)	FADB3719FFA2A9E96CDC64FFEA0220FA	B9B00833E59E99ECE036B518D8429AF5EFEC1163	E8A5463FF98210D3017DEEE55D5A287AD01AAA11DBE7DEB7D07F7D15D7F609F2
Chrome Cache Entry: 280	JPEG image data, baseline, precision 8, 192x192, components 3	2460F5DE9DE320900B6EDBEE239CD3A8	F385B3253B914E2044DCDC2384ACF8CC57B2259A	80FF763FE5B062BAFE61FF473D53E0610D68C8A977FA357D55DBE63C85552411
Chrome Cache Entry: 281	ASCII text, with very long lines (1824)	EDC15AD5DAAC3CFA744BFFDB1E0174BE	E314A5CA702D0E77B2C2C023ADDADE266EA223B2	3B54AEACFDA01BE53800632989A82F6F5A7F92E927159A37A4324B38D3DFFEF8
Chrome Cache Entry: 282	ASCII text	E0DD176C6926B0363ADAF4F9AAEF6EE1	22F6B48EF8091561BE6C2475FCFD98FDDD5A8876	7727F84EAC14FE82243924684B431EEEFA12F779C0CABC62F684DB7D3AAB8369
Chrome Cache Entry: 283	ASCII text, with very long lines (65536), with no line terminators	6A7950CC31489069917BF817B62B2BFE	44AAB6E9B8FDBAA23EA297CE69E26422277907C0	1B4DACB0DAFDA81D48EE0890EA113B3B8275BF2D16D5325F971F16EB75F7218A
Chrome Cache Entry: 284	ASCII text, with very long lines (522)	FADB3719FFA2A9E96CDC64FFEA0220FA	B9B00833E59E99ECE036B518D8429AF5EFEC1163	E8A5463FF98210D3017DEEE55D5A287AD01AAA11DBE7DEB7D07F7D15D7F609F2
Chrome Cache Entry: 285	ASCII text, with very long lines (516)	4A37F23CB638C625FC8451584283E359	06E59198676105545F014464A40AD8D98C4DAD49	72C6DF194818462D86074EAF05FC75F13CABC26431999B329E51A0C26A9F4C81
Chrome Cache Entry: 286	ASCII text, with very long lines (829)	F806FAAB29346709AA36F154927B3AC6	26A0B7AD2B844F2318229738927519A822D93445	DF2BB9597A554B46BD807CFD97EC6E3F7194CCC218B95D7F1E899657C1CF9FCC
Chrome Cache Entry: 287	ASCII text, with very long lines (1875)	DB9B98D640EBA155278DB0BBAA83050D	25F72D93FE64E2B9A398C2D74D6EC747533E613B	4666B9BD872EBF01AD511B5B7628C5E19362AA01B05A6EDC2A266527780E1865
Chrome Cache Entry: 288	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 289	ASCII text, with very long lines (14742)	4E56DDB045B48F1074F336A33249E577	2C5DED666EBC66F9D7A45135DF7A55C60C4DA6D1	B3FA00681128F7B43422A70A5463904CC1D9FB9AB2BB35859D7832E215AF16D3
Chrome Cache Entry: 290	ASCII text, with very long lines (1824)	EDC15AD5DAAC3CFA744BFFDB1E0174BE	E314A5CA702D0E77B2C2C023ADDADE266EA223B2	3B54AEACFDA01BE53800632989A82F6F5A7F92E927159A37A4324B38D3DFFEF8
Chrome Cache Entry: 291	RIFF (little-endian) data, Web/P image, VP8 encoding, 192x192, Scaling: [none]x[none], YUV color, decoders should clamp	138F196E984491E32DAC12235FE1831E	0B41EE506C82DD5F6795BFD7A2307926540BCB78	2DC50F75EAA74A4F9537B32D692CAF20293333C1D108B9CE8F1E42DA87AEB6B1
Chrome Cache Entry: 292	JSON data	A517890F7A2830D99F6CC2E22C10E651	4A832D56A6D15EB16D0181C482E0F9D5F661F402	3D3AEF5285DF4DC0F7CA787D8FB2482DEF808C9BD70AA572BF51664E6AD25F53
Chrome Cache Entry: 293	Unicode text, UTF-8 text, with very long lines (63425)	F72A36608097CA8BF021D801E3933881	76C2DF4235FA9A39632E49142DB3460FD2C27F7F	F504DB42834DA17054958C0B451268F0A17DFB98EEAF91CA65019DA991512043
Chrome Cache Entry: 294	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B

Phishing

AI detected phishing page

Source: https://upholdloginie.godaddysites.com/uphold-l%C5%8Dgin-official

Source: https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-in_corp_applications_base

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49848 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.6:49730 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://upholdloginie.godaddysites.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _tccl_visit=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _scc_session=pc=1&C_TOUCH=2024-09-29T05:53:36.666Z
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://upholdloginie.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://upholdloginie.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _tccl_visit=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _scc_session=pc=1&C_TOUCH=2024-09-29T05:53:36.666Z
Source: global traffic	HTTP traffic detected: GET /uphold-l%C5%8Dgin-official HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://upholdloginie.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _tccl_visit=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _scc_session=pc=1&C_TOUCH=2024-09-29T05:53:36.666Z
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: upholdloginie.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://upholdloginie.godaddysites.com/sw.jsUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _tccl_visit=58b560e0-426a-47a8-a9a9-ca804e5d08a6; _scc_session=pc=2&C_TOUCH=2024-09-29T05:53:51.549ZIf-None-Match: cff7d80a088795bdda9dcdf8c92c6676

Source: global traffic	DNS traffic detected: DNS query: upholdloginie.godaddysites.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: events.api.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: csp.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: www.godaddy.com

Source: global traffic

Source: chromecache_252.2.dr, chromecache_227.2.dr, chromecache_293.2.dr, chromecache_277.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/cabin/v27/u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7alxw.wof
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/cabin/v27/u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7ilx17r.w
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/cabin/v27/u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7mlx17r.w
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u8w4BMUTPHh30AUi-qJCY.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u8w4BMUTPHh30AXC-q.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u8w4BMUTPHjxsAUi-qJCY.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u8w4BMUTPHjxsAXC-q.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh50XSwaPGR_p.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh7USSwaPGR_p.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u_w4BMUTPHjxsI5wq_FQft1dw.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6u_w4BMUTPHjxsI5wq_Gwft.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2)
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2)
Source: chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/isteam/ip/3ace6614-6084-4f91-9a59-1e229f814716/upholddd.jpg
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
Source: chromecache_242.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_273.2.dr	String found in binary or memory: https://upholdloginie.godaddysites.com/404
Source: chromecache_268.2.dr, chromecache_241.2.dr	String found in binary or memory: https://upholdloginie.godaddysites.com/uphold-l%C5%8Dgin-official
Source: chromecache_268.2.dr, chromecache_241.2.dr, chromecache_273.2.dr	String found in binary or memory: https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applica
Source: chromecache_216.2.dr, chromecache_250.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_257.2.dr, chromecache_242.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49848 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@23/144@18/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2240,i,3924135059581285012,13270627194640580722,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://upholdloginie.godaddysites.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2240,i,3924135059581285012,13270627194640580722,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1522050
Product:	CloudBasic
Start time:	07:52:35
Start date:	29.09.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://upholdloginie.godaddysites.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://upholdloginie.godaddysites.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://upholdloginie.godaddysites.com/