# PhishDestroy domain threat record: unionwavesavingsline.online

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/unionwavesavingsline.online/
Machine-readable companion: https://phishdestroy.io/domain/unionwavesavingsline.online/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 09:17:28 UTC
- Last availability or vendor check: 2026-10-28 12:31:11 UTC
- Stored record updated: 2026-10-28 12:31:11 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: revolut

## Stored infrastructure

- Observed IP address: 163.61.188.7
- Registrar in stored WHOIS data: NAMECHEAP INC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-23 09:31:19 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a181cf-cce4-7779-a194-b60e7547c18e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/unionwavesavingsline.online
- Certificate Transparency search: https://crt.sh/?q=%25.unionwavesavingsline.online
- Web Archive lookup: https://web.archive.org/web/*/https://unionwavesavingsline.online/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated intake classified unionwavesavingsline.online as malicious because the page imitates a financial institution called Union Wave Savings and displays “Login To Account” and “Open Account” calls to action. The assessment notes brand impersonation and a credential‑theft risk. The domain was first observed by PhishDestroy on 2026-10-28, five days after its registration on 2026-10-23, and returned an HTTP 200 response at that time.

How the scam works
In credential‑phishing attacks targeting banks, attackers host a replica of the institution’s website to lure victims into entering login credentials, personal data or account details. Harvested information can be used to access real accounts or sold on underground markets.

Evidence
A VirusTotal scan on 2026-10-28 recorded one suspicious detection, with Fortinet labeling the domain as spam. Google Safe Browsing checked the same day and did not flag the URL. urlscan.io captured the page on 2026-10-28; its overall verdict was clean but its engine flagged the site as malicious with a score of 100, and OTX listed three pulses referencing the domain. PhishDestroy’s internal blocklist contains the domain, while external blocklists checked on that date returned zero hits.

Infrastructure
The domain was registered on 2026-10-23 through NameCheap, Inc. The site uses a Let’s Encrypt TLS certificate valid until 2027-01-21 and resolves to the recorded IP 163.61.188.7, which served a LiteSpeed web server. DNS records list an A record for that IP, an MX record pointing to the domain itself, and four LyteHosting name servers.

What to do
Visitors should not enter any credentials on the site; if they have already done so, they should change passwords with the legitimate Union Wave Savings institution and monitor accounts for unauthorized activity. Organizations should add unionwavesavingsline.online to network‑level blocklists and review logs for connections to the domain. Any credentials captured from this page should be treated as compromised and revoked or changed accordingly.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a181cf-cce4-7779-a194-b60e7547c18e/
Cloudflare Radar report: https://radar.cloudflare.com/scan/23191005-9d49-47da-adbf-22d7e0304d62
URLQuery report: https://urlquery.net/report/a3649a30-d048-4785-a89f-2e6d00ac1dd5
Stored capture screenshot: https://i.ibb.co/vvsdwBV4/f87eed66ab43.png
Cloudflare Radar screenshot (2026-10-28T09:18:51Z): https://screenshots.phishdestroy.io/cf/23191005-9d49-47da-adbf-22d7e0304d62.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/a3649a30-d048-4785-a89f-2e6d00ac1dd5.png
URLScan screenshot (2026-10-28T09:16:20Z): https://screenshots.phishdestroy.io/us/01a181cb-9abd-7288-9aa2-10b2b573368d.png
URLScan capture report: https://urlscan.io/result/01a181cb-9abd-7288-9aa2-10b2b573368d/
URLScan screenshot (2026-10-28T09:17:42Z): https://screenshots.phishdestroy.io/us/01a181cc-f10c-76ed-912e-7bf4d690dca6.png
URLScan capture report: https://urlscan.io/result/01a181cc-f10c-76ed-912e-7bf4d690dca6/
VirusTotal report: https://www.virustotal.com/gui/domain/unionwavesavingsline.online
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=unionwavesavingsline.online
Archived copy: https://web.archive.org/web/20261028091847/https://unionwavesavingsline.online/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 09:49:38 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/vvsdwBV4/f87eed66ab43.png
  Captured: 2026-10-28 09:21:46 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a181cf-cce4-7779-a194-b60e7547c18e.png
  Captured: 2026-10-28 09:21:46 UTC
  Source report: https://urlscan.io/result/01a181cf-cce4-7779-a194-b60e7547c18e/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a181cb-9abd-7288-9aa2-10b2b573368d.png
  Captured: 2026-10-28 09:17:28 UTC
  Source report: https://urlscan.io/result/01a181cf-cce4-7779-a194-b60e7547c18e/
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a181cc-f10c-76ed-912e-7bf4d690dca6.png
  Captured: 2026-10-28 09:17:42 UTC
  Source report: https://urlscan.io/result/01a181cc-f10c-76ed-912e-7bf4d690dca6/
  SHA-256: 7d5289b0ba620a90c8ade0c5bc5613d0d90c174ed419ac71b80ba11c25357436
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/23191005-9d49-47da-adbf-22d7e0304d62.png
  Captured: 2026-10-28 09:18:51 UTC
  Source report: https://radar.cloudflare.com/scan/23191005-9d49-47da-adbf-22d7e0304d62
  SHA-256: 50eadefc9d09b81f329126661ac8505ba43d7e6a0da6358de05691c1ca4b1e4c
- URLQuery: https://screenshots.phishdestroy.io/uq/a3649a30-d048-4785-a89f-2e6d00ac1dd5.png
  Source report: https://urlquery.net/report/a3649a30-d048-4785-a89f-2e6d00ac1dd5
  SHA-256: d1e76fb5e01dd2225ba0a49b643858153bf3268056695d23d740168f5df505a7
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a181cb-9abd-7288-9aa2-10b2b573368d.png
  Captured: 2026-10-28 09:16:20 UTC
  Source report: https://urlscan.io/result/01a181cb-9abd-7288-9aa2-10b2b573368d/
  SHA-256: 392f88f6f69d74576a58430c419cca7bbf6b7156bc426f1c97c6972dbe112da4

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T09:48:46Z",
        "uuid": "01a181cf-cce4-7779-a194-b60e7547c18e",
        "scanned_at": "2026-10-28T09:20:59Z",
        "final_url": "https://unionwavesavingsline.online/",
        "status": 200,
        "ip": "163.61.188.7",
        "ptr": "s6.whitelabelclouds.com",
        "domains": [
            "maps.googleapis.com",
            "fonts.gstatic.com",
            "translate.googleapis.com",
            "www.gstatic.com",
            "cdnjs.cloudflare.com",
            "fonts.googleapis.com",
            "bootstrap.smartsuppchat.com",
            "translate-pa.googleapis.com",
            "www.smartsuppchat.com",
            "translate.google.com"
        ],
        "ips": [
            "3.125.68.253",
            "142.251.210.35",
            "142.250.68.202",
            "142.251.153.120",
            "195.181.172.3",
            "172.217.117.4",
            "142.250.68.206",
            "104.17.24.14",
            "142.250.217.10",
            "163.61.188.7"
        ],
        "asns": [
            "16509",
            "15169",
            "60068",
            "13335",
            "153568"
        ],
        "countries": [
            "DE",
            "US",
            "NL",
            "BD"
        ],
        "link_domains": [
            "translate.google.com",
            "wa.me"
        ],
        "social": [
            "https://wa.me/+12897125693"
        ],
        "doc_hash": "1fc7dfcdf0945f678a04de81b88affeaef5d0aff24634185abad8e94f7ce118a",
        "script_hashes": [
            "8be8d0df3cece10f19186e472dc5722e1f98e8c3b18b33ffe6eeb619af379d5a",
            "76fb8bcc185402b79c64edb472e6257755f0878a085eb9f073f0deec8acba7f3",
            "3eb369d21ac4be875a0c20f09634cb3adf5b8c24ba53a75453935f290ea5825e",
            "797771221fec8ca4cd8b95b20bc70a1de9303f2c0e462a26ca2305c99b28c16c",
            "0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740",
            "11a45dff1b23a45e27f987d657f0170921e180a75b9a0acf713ecf4218650261",
            "f2634fa413588df8b70718026111976a80e0b9da884a5ffa7c3204e45dcc84d8",
            "cebb7776fb386c1fc6f0ef7168aa12642441058942bf91e0403ed1b15665ed37",
            "fb94ceb7ccd991bf407a87bdc351d85837654a07e1562667dc1faa5494e29084",
            "d5e1425fc0e89fb204941ca2fdade83d5856abec042b31b0e2f2ff51c355ca78"
        ],
        "globals": [
            "_smartsupp",
            "smartsupp",
            "googleTranslateElementInit",
            "_DumpException",
            "google",
            "$",
            "jQuery",
            "Popper",
            "bootstrap",
            "pJS",
            "hexToRgb",
            "clamp",
            "isInArray",
            "requestAnimFrame",
            "cancelRequestAnimFrame",
            "pJSDom",
            "particlesJS",
            "module$exports$google3$maps$api$javascript$geometry$lat_lng_bounds",
            "module$exports$google3$maps$api$javascript$marker$marker",
            "litHtmlVersions",
            "litElementVersions",
            "reactiveElementVersions",
            "jQueryBridget",
            "EvEmitter",
            "getSize",
            "matchesSelector",
            "fizzyUIUtils",
            "Outlayer",
            "Isotope",
            "Masonry",
            "WOW",
            "default_tr",
            "_F_toggles_default_tr",
            "closure_lm_999611",
            "SMARTSUPP_LOADED",
            "$smartsupp"
        ],
        "cookies": [
            "ci_session"
        ],
        "storage_keys": [
            "__sak"
        ],
        "tls": {
            "san": [
                "*.unionwavesavingsline.online",
                "unionwavesavingsline.online"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "unionwavesavingsline.online",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-21T16:28:58Z",
            "valid_from": "2026-10-23T16:28:59Z"
        },
        "domain_age_days": 4,
        "apex_age_days": 4,
        "tls_age_days": 4,
        "tls_valid_days": 89,
        "requests": 69,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T09:48:48Z",
        "uuid": "23191005-9d49-47da-adbf-22d7e0304d62",
        "scanned_at": "2026-10-28T09:18:51Z",
        "final_url": "https://unionwavesavingsline.online/",
        "status": 200,
        "history": [
            {
                "url": "https://unionwavesavingsline.online/",
                "status": 200
            }
        ],
        "dom_hash": "6d8c7961399b70306c0b60fe0e9b16fafba1459346217d9086168c2e0dcb5ddf",
        "doc_hash": "1fc7dfcdf0945f678a04de81b88affeaef5d0aff24634185abad8e94f7ce118a",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "unionwavesavingsline.online",
                "type": "A",
                "value": "163.61.188.7"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.8",
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-10-23T11:31:19Z",
            "updated": "2026-10-23T15:45:37Z",
            "expires": "2027-10-23T11:31:19Z",
            "nameservers": [
                "dns1.lytehosting.com",
                "dns2.lytehosting.com",
                "dns3.lytehosting.com",
                "dns4.lytehosting.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T09:48:58Z",
        "analysis_at": "2026-10-28T09:35:56Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 39
        },
        "detections": {
            "Fortinet": "spam"
        },
        "reputation": 0,
        "registrar": "NAMECHEAP INC",
        "created": "2026-10-23T11:31:19Z",
        "expires": "2027-10-23T11:31:19Z",
        "updated": "2026-10-23T15:45:37Z",
        "first_seen": "2026-10-23T17:33:11Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns2.lytehosting.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns4.lytehosting.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns1.lytehosting.com"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "unionwavesavingsline.online",
                "priority": 0
            },
            {
                "ttl": 12910,
                "type": "A",
                "value": "163.61.188.7"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:163.61.188.7 include:relay.serverfoundation.com ~all"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "atalha.lytehosting.net",
                "value": "dns1.lytehosting.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns3.lytehosting.com"
            }
        ],
        "dns_at": "2026-10-28T09:41:20Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "*.unionwavesavingsline.online",
                "unionwavesavingsline.online"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6a799ce05b21c4ec1524df3c789ee207da1",
            "sha256": "8a8f1dd856587261b8d71209691ea1610699718070aa02faf7640d742d0fd84e",
            "subject": "unionwavesavingsline.online",
            "valid_to": "2027-01-21T16:28:58Z",
            "valid_from": "2026-10-23T16:28:59Z"
        },
        "whois": {
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068",
            "registrar_url": "http://www.namecheap.com",
            "created": "2026-10-23T11:31:19Z",
            "updated": "1-01-01T00:00:00Z",
            "expires": "2027-10-23T11:31:19Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "dns1.lytehosting.com",
                "dns2.lytehosting.com",
                "dns3.lytehosting.com",
                "dns4.lytehosting.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "registration": "2026-10-23T11:31:19Z",
                "registrar expiration": "2027-10-23T11:31:19Z",
                "last update of RDAP database": "2026-10-23T17:27:42Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T09:19:37Z",
        "mail_config": {
            "mx": [
                "unionwavesavingsline.online"
            ],
            "spf": "v=spf1 +a +mx +ip4:163.61.188.7 include:relay.serverfoundation.com ~all",
            "dkim": [
                "default"
            ],
            "dmarc": true,
            "dkim_bits": 2048,
            "spf_lookups": 3
        },
        "caa_records": {
            "domain": "unionwavesavingsline.online"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-28T09:18:47Z",
            "first": "2026-10-23T19:59:08Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.22,
            "avg_page_bytes": 12426
        },
        "social_tags": {
            "title": "Union Wave Savings  Online",
            "keywords": "#",
            "description": "#"
        },
        "mixed_content": {
            "no_sri": [
                "https://translate.google.com/translate_a/element.js",
                "https://maps.googleapis.com/maps/api/js"
            ],
            "third_party_scripts": 2
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 278,
                "tls": 109,
                "wait": 225,
                "connect": 104,
                "download": 106
            },
            "response_ms": 822
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                21,
                25,
                53,
                80,
                110,
                143,
                443,
                587,
                993,
                995
            ]
        },
        "carbon": {
            "bytes": 49049,
            "co2_grams": 0.0018,
            "cleaner_than": 37
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "163.61.236.35",
                    "host": "dns3.lytehosting.com"
                },
                {
                    "ip": "163.61.236.35",
                    "host": "dns4.lytehosting.com"
                },
                {
                    "ip": "163.61.236.35",
                    "host": "dns1.lytehosting.com"
                },
                {
                    "ip": "163.61.236.35",
                    "host": "dns2.lytehosting.com"
                }
            ],
            "zone": "unionwavesavingsline.online"
        },
        "location": {
            "ip": "163.61.188.7",
            "asn": "153568",
            "org": "NEW DHAKA HARDWARE",
            "city": "Staten Island",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "unionwavesavingsline.online"
        },
        "dns": {
            "A": [
                "163.61.188.7"
            ],
            "MX": [
                "{\"exchange\": \"unionwavesavingsline.online\", \"priority\": 0}"
            ],
            "NS": [
                "dns4.lytehosting.com",
                "dns3.lytehosting.com",
                "dns2.lytehosting.com",
                "dns1.lytehosting.com"
            ],
            "SOA": "{\"nsname\": \"dns1.lytehosting.com\", \"hostmaster\": \"atalha.lytehosting.net\", \"serial\": 2026102304, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}",
            "TXT": [
                "v=spf1 +a +mx +ip4:163.61.188.7 include:relay.serverfoundation.com ~all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "163.61.188.7",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://unionwavesavingsline.online"
            ]
        },
        "linked_pages": {
            "external": [
                "https://wa.me/+12897125693"
            ],
            "external_count": 1,
            "internal_count": 13
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-10-23T11:31:19Z",
            "updated": "2026-10-23T15:45:37Z",
            "expires": "2027-10-23T11:31:19Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "dns1.lytehosting.com",
                "dns2.lytehosting.com",
                "dns3.lytehosting.com",
                "dns4.lytehosting.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "LiteSpeed",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```