# PhishDestroy domain threat record: auth-sumup.lt

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/auth-sumup.lt/
Machine-readable companion: https://phishdestroy.io/domain/auth-sumup.lt/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-12 16:40:08 UTC
- Last availability or vendor check: 2026-10-23 10:33:16 UTC
- Stored record updated: 2026-10-23 18:20:40 UTC
- VirusTotal detections in the stored snapshot: 14/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: sei

## Stored infrastructure

- Observed IP address: 190.97.165.131
- Registrar in stored WHOIS data: Instra Corporation Pty Ltd
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2025-06-30 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a5fa-286b-7087-89df-863b024b0dc9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/auth-sumup.lt
- Certificate Transparency search: https://crt.sh/?q=%25.auth-sumup.lt
- Web Archive lookup: https://web.archive.org/web/*/https://auth-sumup.lt/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
auth-sumup.lt is a credential phishing page posing as the SumUp sign-in portal. Its Italian page title, "Accesso Area Riservata SumUp Italia | Login Ufficiale" (Reserved Area Access, Official Login), shows it targets SumUp merchants in Italy. PhishDestroy first flagged it on 2026-09-12, and it was still online and serving content on 2026-10-19.

How the scam works
Victims usually arrive from an email or SMS that looks like a SumUp alert about a payout, a blocked account or a verification step. The link opens a copy of the SumUp login under a name that adds "auth" to the brand, so it reads like an official authentication subdomain. Whatever the merchant types, such as email, password and often a one-time code, goes straight to the operators. With that access they can take over the account, change payout bank details, or use the stolen identity in further fraud.

Evidence
On 2026-09-21, VirusTotal showed 14 of 89 engines flagging the domain as malicious. The vendors include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, alphaMountain.ai, CyRadar and Chong Lua Dao. Fourteen independent detections is a solid signal for a single phishing domain, and four AlienVault OTX threat pulses reference it. Among blocklists, it appears on PhishDestroy's own list.

Infrastructure
The domain was registered on 2025-07-01 through Instra Corporation Pty Ltd, more than a year before PhishDestroy detected it. A long-held domain like this can be kept in reserve until a campaign is ready to launch. The site runs on the Cyber Cast International, S.A. network in Panama, which has no link to a Lithuanian domain or an Italian audience. Its Let's Encrypt certificate gives the page a browser padlock, but that only means the connection is encrypted, not that the site is genuine.

What to do
If you entered your SumUp credentials on this page, change your SumUp password right away from the official app or a bookmarked address. Change it anywhere else you reuse it, and turn on or reset two-factor authentication. Check your payout bank details, recent transactions and any connected devices, and contact SumUp support if anything changed. Watch for follow-up calls or messages that cite your stolen details. Defenders should block auth-sumup.lt at the DNS and email gateway level and look for messages pointing SumUp users to look-alike domains.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a5fa-286b-7087-89df-863b024b0dc9/
VirusTotal report: https://www.virustotal.com/gui/domain/auth-sumup.lt
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=auth-sumup.lt
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:43:50 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0a5fa-286b-7087-89df-863b024b0dc9.png
  Captured: 2026-09-12 16:40:08 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0a5fa-286b-7087-89df-863b024b0dc9.png
  Captured: 2026-09-22 03:30:38 UTC
  Source report: https://urlscan.io/result/01a0a5fa-286b-7087-89df-863b024b0dc9/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d7555377-9570-48eb-95c4-cf96368b1679.png
  Captured: 2026-09-20 00:30:49 UTC
  Source report: https://radar.cloudflare.com/scan/d7555377-9570-48eb-95c4-cf96368b1679
  SHA-256: 8d2e3cd5387d4c312c28bc26d8f62d6772a0715e259d43acdcde4a0dc508ac78
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a5fa-0ca0-70f6-951d-cda27e3a1494.png
  Captured: 2026-09-15 16:50:33 UTC
  Source report: https://urlscan.io/result/01a0a5fa-0ca0-70f6-951d-cda27e3a1494/
  SHA-256: b243974aa6efb321953e394715fb156ed45d27f0b8e8af3fa8f022e119c35bef

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:25:55Z",
        "uuid": "01a0a5fa-286b-7087-89df-863b024b0dc9",
        "scanned_at": "2026-09-15T16:50:47Z",
        "final_url": "https://auth-sumup.lt/.redirect/auth.sumup.com/dash.php",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://auth-sumup.lt/flows/login",
                "from": "https://auth-sumup.lt/"
            },
            {
                "to": "https://auth-sumup.lt/flows/login/",
                "from": "https://auth-sumup.lt/flows/login",
                "status": 301
            },
            {
                "to": "https://auth-sumup.lt/.redirect/auth.sumup.com/id.php",
                "from": "https://auth-sumup.lt/flows/login/"
            },
            {
                "to": "https://auth-sumup.lt/.redirect/auth.sumup.com/dash.php",
                "from": "https://auth-sumup.lt/.redirect/auth.sumup.com/id.php",
                "status": 302
            }
        ],
        "ip": "190.97.165.131",
        "ptr": "www.dox.wf",
        "domains": [
            "challenges.cloudflare.com",
            "www.googletagmanager.com",
            "static.sumup.com",
            "pagead2.googlesyndication.com",
            "s3-sa-east-1.amazonaws.com",
            "ajax.googleapis.com",
            "auth.sumup.com"
        ],
        "ips": [
            "104.18.34.207",
            "173.194.114.156",
            "3.5.233.32",
            "104.18.95.41",
            "209.85.201.95",
            "74.125.192.97",
            "190.97.165.131"
        ],
        "asns": [
            "13335",
            "15169",
            "16509",
            "27956"
        ],
        "countries": [
            "US",
            "BR",
            "PA"
        ],
        "link_domains": [
            "sumup.it",
            "auth.sumup.com",
            "status.sumup.com"
        ],
        "doc_hash": "19980f0aebec9ca8541b2675c6b83cfd22c14c28689d5a0c5b1757ba7198a828",
        "globals": [
            "dataLayer",
            "gtag",
            "ex1",
            "newurl",
            "$",
            "jQuery",
            "u",
            "SUPPORTS_INLINE_SCRIPTS",
            "SUPPORTS_DYNAMIC_IMPORT",
            "turnstile",
            "google_tag_data",
            "google_tag_manager"
        ],
        "cookies": [
            "__cf_bm"
        ],
        "tls": {
            "san": [
                "*.auth-sumup.lt",
                "auth-sumup.lt"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "auth-sumup.lt",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-13T05:58:04Z",
            "valid_from": "2026-08-15T05:58:05Z"
        },
        "domain_age_days": 434,
        "apex_age_days": 434,
        "tls_age_days": 31,
        "tls_valid_days": 89,
        "requests": 30,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 83,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.2.33\nPleskLin",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "geolocation=(), microphone=(), camera=()"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:33:00Z",
        "uuid": "d7555377-9570-48eb-95c4-cf96368b1679",
        "scanned_at": "2026-09-20T00:30:49Z",
        "final_url": "https://auth-sumup.lt/.redirect/auth.sumup.com/dash.php",
        "status": 200,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://auth-sumup.lt/",
                "status": 307
            },
            {
                "url": "https://auth-sumup.lt/",
                "status": 200
            },
            {
                "url": "https://auth-sumup.lt/flows/login",
                "status": 301
            },
            {
                "url": "https://auth-sumup.lt/flows/login/",
                "status": 200
            },
            {
                "url": "https://auth-sumup.lt/.redirect/auth.sumup.com/id.php",
                "status": 302
            },
            {
                "url": "https://auth-sumup.lt/.redirect/auth.sumup.com/dash.php",
                "status": 200
            }
        ],
        "dom_hash": "5fc1b53582fb6e4d5ecb0edea5c86003134733839bbdaff9b56741e9266c97a2",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "auth-sumup.lt",
                "type": "A",
                "value": "190.97.165.131"
            }
        ],
        "dnssec_valid": false,
        "ip": "190.97.165.131",
        "whois": {
            "registrar": "Instra Corporation Pty Ltd",
            "created": "2025-07-01T00:00:00Z",
            "expires": "2027-07-02T00:00:00Z",
            "nameservers": [
                "ns-canada.topdns.com",
                "ns-usa.topdns.com",
                "ns-uk.topdns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T03:25:42Z",
        "analysis_at": "2026-10-20T15:43:44Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 13,
            "suspicious": 2,
            "undetected": 31
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "PhishFort": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Instra Corporation Pty Ltd",
        "expires": "2027-07-02T00:00:00Z",
        "first_seen": "2025-07-07T17:28:42Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "_domainkey.auth-sumup.lt. IN TXT \"o=-"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=DMARC1; p=none; rua=mailto:postmaster@auth-sumup.lt"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mail.auth-sumup.lt",
                "priority": 10
            },
            {
                "ttl": 7200,
                "type": "SOA",
                "rname": "hostmaster.topdns.com",
                "value": "ns-uk.topdns.com"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns-uk.topdns.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "190.97.165.131"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "default._domainkey.auth-sumup.lt. IN TXT \"v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcYqeBCN4heZM1b2BxxlDcwz+ixSi8QgAw4kwh4Uu6S82ppNWuL4VE/6MOBoNI/uzOSL1us5MaP6/Tx6m+2nHM8pyF7fvvI5xrUPj8JAi8OzRFs1k8It+ceZyXx4Yrl8x3izu8iTt5q3F9JxH3GktW6ZrdUcjTN"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns-canada.topdns.com"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:190.97.165.131 include:_spf.plesk.com ~all"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns-usa.topdns.com"
            }
        ],
        "dns_at": "2026-10-20T16:20:43Z",
        "jarm": "29d29d15d29d29d21c42d42d000000b7cc5a312b95f81625a914b21964a66e",
        "cert": {
            "san": [
                "*.auth-sumup.lt",
                "auth-sumup.lt"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "6c481b0844710555471d47049a42ab4d3b5",
            "sha256": "90465d13e0dac4c9e36400f29ec599b399b500e079ed887ed29640241d4a0b74",
            "subject": "auth-sumup.lt",
            "valid_to": "2026-11-13T05:58:04Z",
            "valid_from": "2026-08-15T05:58:05Z"
        },
        "whois": {
            "registrar": "Instra Corporation Pty Ltd"
        }
    }
}
```