people.oregonstate.edu Open in urlscan Pro
128.193.5.21 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://people.virginia.edu/~amw2fu/?e=janice.gould@usps.gov
Effective URL:
http://people.oregonstate.edu/~hansenma/squareup.com/login/Signon.php?LOB=RBGLogon&_pageLabel=page_logonform
Submission: On November 20 via manual (November 20th 2018, 3:49:02 pm UTC) from US

Summary HTTP 3 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 3 HTTP transactions. The main IP is 128.193.5.21, located in Corvallis, United States and belongs to ORST-AS - Oregon State University, US. The main domain is people.oregonstate.edu.

This is the only time people.oregonstate.edu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Squarespace (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	128.143.22.180 128.143.22.180	225 (VIRGINIA-AS) (VIRGINIA-AS - University of Virginia)
2	128.193.5.21 128.193.5.21	4201 (ORST-AS) (ORST-AS - Oregon State University)
1	52.1.22.171 52.1.22.171	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
3	4

1 128.143.22.180 (Charlottesville, United States) 1 redirects

ASN225 (VIRGINIA-AS - University of Virginia, US)
PTR: people.virginia.edu

people.virginia.edu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 128.193.5.21 (Corvallis, United States)

ASN4201 (ORST-AS - Oregon State University, US)
PTR: onid-web.cws.oregonstate.edu

people.oregonstate.edu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.1.22.171 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-1-22-171.compute-1.amazonaws.com

www.easycounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	oregonstate.edu people.oregonstate.edu	155 KB
1	easycounter.com www.easycounter.com	561 B
1	virginia.edu 1 redirects people.virginia.edu	390 B
3	3

	Domain	Requested by
2	people.oregonstate.edu
1	www.easycounter.com	people.oregonstate.edu
1	people.virginia.edu	1 redirects
3	3

This site contains no links.

Subject Issuer	Validity	Valid
easycounter.com Let's Encrypt Authority X3	`2018-09-30` - `2018-12-29`	3 months	crt.sh

This page contains 4 frames:

Primary Page: http://people.oregonstate.edu/~hansenma/squareup.com/login/Signon.php?LOB=RBGLogon&_pageLabel=page_logonform
Frame ID: 07AC189E1ED2CF9AF5E1ED0052844984
Requests: 6 HTTP requests in this frame

Frame: data://truncated
Frame ID: 35067446A1E61BEBD6F26F86FFC648F4
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 7D611CCF61657C4DBF799E5480428D35
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 97BC7F815051CD4FF15C187D3CEA1362
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://people.virginia.edu/~amw2fu/?e=janice.gould@usps.gov HTTP 302
http://people.oregonstate.edu/~hansenma/squareup.com/login/ Page URL
http://people.oregonstate.edu/~hansenma/squareup.com/login/Signon.php?LOB=RBGLogon&_pageLabel=page_logonform Page URL

Detected technologies

Ruby (Programming Languages) Expand

Overall confidence: 50%
Detected patterns

meta csrf-param /authenticity_token/i

Debian (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Debian/i

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 50%
Detected patterns

meta csrf-param /authenticity_token/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

3
Requests

33 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

156 kB
Transfer

456 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://people.virginia.edu/~amw2fu/?e=janice.gould@usps.gov HTTP 302
http://people.oregonstate.edu/~hansenma/squareup.com/login/ Page URL
http://people.oregonstate.edu/~hansenma/squareup.com/login/Signon.php?LOB=RBGLogon&_pageLabel=page_logonform Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://people.virginia.edu/~amw2fu/?e=janice.gould@usps.gov HTTP 302
http://people.oregonstate.edu/~hansenma/squareup.com/login/

3 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ people.oregonstate.edu/~hansenma/squareup.com/login/ Redirect Chain http://people.virginia.edu/~amw2fu/?e=janice.gould@usps.gov http://people.oregonstate.edu/~hansenma/squareup.com/login/	318 B 543 B	728ms 234ms	Document text/html	128.193.5.21 Oregon State Univ...
General Check archive.org Show headers Download Go to Full URL http://people.oregonstate.edu/~hansenma/squareup.com/login/ Protocol HTTP/1.1 Server 128.193.5.21 Corvallis, United States, ASN4201 (ORST-AS - Oregon State University, US), Reverse DNS onid-web.cws.oregonstate.edu Software Apache/2.2.12 (Debian) / PHP/5.2.10-5.2.10 Resource Hash Request headers Host people.oregonstate.edu Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 20 Nov 2018 15:48:46 GMT Server Apache/2.2.12 (Debian) X-Powered-By PHP/5.2.10-5.2.10 Keep-Alive timeout=15, max=198 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Cache-Control private Content-Encoding gzip Transfer-Encoding chunked Redirect headers Date Tue, 20 Nov 2018 15:48:46 GMT Server Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8b mod_fastcgi/2.4.2 DAV/2 PHP/4.4.2 mod_pubcookie/3.3.0a X-Powered-By PHP/4.4.2 Location http://people.oregonstate.edu/~hansenma/squareup.com/login/ Content-Length 6 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html Content-Language en
GET H/1.1	200 OK	Primary Request Signon.php Show response people.oregonstate.edu/~hansenma/squareup.com/login/	343 KB 154 KB	260ms 259ms	Document text/html	128.193.5.21 Oregon State Univ...
General Check archive.org Show headers Download Go to Full URL http://people.oregonstate.edu/~hansenma/squareup.com/login/Signon.php?LOB=RBGLogon&_pageLabel=page_logonform Protocol HTTP/1.1 Server 128.193.5.21 Corvallis, United States, ASN4201 (ORST-AS - Oregon State University, US), Reverse DNS onid-web.cws.oregonstate.edu Software Apache/2.2.12 (Debian) / PHP/5.2.10-5.2.10 Resource Hash `42d9b410179d8ec27593d16710ea56745ba6cf6aa56bdeebb582498513ddaaff` Request headers Host people.oregonstate.edu Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://people.oregonstate.edu/~hansenma/squareup.com/login/ Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://people.oregonstate.edu/~hansenma/squareup.com/login/ Response headers Date Tue, 20 Nov 2018 15:48:46 GMT Server Apache/2.2.12 (Debian) X-Powered-By PHP/5.2.10-5.2.10 Keep-Alive timeout=15, max=200 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Cache-Control private Content-Encoding gzip Transfer-Encoding chunked
GET H/1.1	200 OK	counter.php Show response www.easycounter.com/	282 B 561 B	432ms 115ms	Script image/png	52.1.22.171 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://www.easycounter.com/counter.php?voyage999,square Requested by Host: people.oregonstate.edu URL: http://people.oregonstate.edu/~hansenma/squareup.com/login/Signon.php?LOB=RBGLogon&_pageLabel=page_logonform Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.1.22.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-52-1-22-171.compute-1.amazonaws.com Software nginx/1.14.1 / Resource Hash `5a43d2d13dc8e7f400ecf3ffca8e1d50e8f3ac5ae04d623b9a112d92c50e50db` Request headers Referer http://people.oregonstate.edu/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 20 Nov 2018 15:48:48 GMT Last-Modified Tue, 20 Nov 2018 15:48:48 +0000 Server nginx/1.14.1 Transfer-Encoding chunked Content-Type image/png Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Expires 0
GET DATA	200 OK	truncated /	562 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `50a7da9ad8921fa90ab51b3c906eb9fa0efbd49345cd216b3678c1b156458175` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml
GET DATA	200 OK	truncated /	49 KB 0		Font application/x-font-opentype
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1fc4881cab9110cf5a212890ce46537bb5192d99bc820fb447a7cd708c78e8da` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://people.oregonstate.edu/ Origin http://people.oregonstate.edu Response headers Access-Control-Allow-Origin * Content-Type application/x-font-opentype
GET DATA	200 OK	truncated /	56 KB 0		Font application/x-font-opentype
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `550adada1bc65c641da935bced98f7240863cc6ca61f9d38fe0ffdf1a085aeb3` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://people.oregonstate.edu/ Origin http://people.oregonstate.edu Response headers Access-Control-Allow-Origin * Content-Type application/x-font-opentype
GET DATA	200 OK	truncated Show response / Frame 3506	5 KB 0	-1ms 0ms	Document text/html
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `815c22233989b55a2e6c0f07b3f57bbbb11d464b01b613df5b74ed586cee5d28` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers
GET DATA	200 OK	truncated Show response / Frame 7D61	1 KB 0	-1ms 0ms	Document text/html
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `beb1fd17ac30f13380e2b90da16a2b66eca0ce287e8bdf1e266c9717142d8918` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers
GET DATA	200 OK	truncated Show response / Frame 97BC	236 B 0	-1ms 0ms	Document text/html
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `81e818b9e546fd67edefe26ef25b6fc3f16a1db2d988a2bb531f7ea930d69421` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Squarespace (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| savepage_PageLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

people.oregonstate.edu
people.virginia.edu
www.easycounter.com
128.143.22.180
128.193.5.21
52.1.22.171
1fc4881cab9110cf5a212890ce46537bb5192d99bc820fb447a7cd708c78e8da
42d9b410179d8ec27593d16710ea56745ba6cf6aa56bdeebb582498513ddaaff
50a7da9ad8921fa90ab51b3c906eb9fa0efbd49345cd216b3678c1b156458175
550adada1bc65c641da935bced98f7240863cc6ca61f9d38fe0ffdf1a085aeb3
5a43d2d13dc8e7f400ecf3ffca8e1d50e8f3ac5ae04d623b9a112d92c50e50db
815c22233989b55a2e6c0f07b3f57bbbb11d464b01b613df5b74ed586cee5d28
81e818b9e546fd67edefe26ef25b6fc3f16a1db2d988a2bb531f7ea930d69421
beb1fd17ac30f13380e2b90da16a2b66eca0ce287e8bdf1e266c9717142d8918

people.oregonstate.edu Open in urlscan Pro 128.193.5.21 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

33 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

156 kBTransfer

456 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

people.oregonstate.edu Open in urlscan Pro
128.193.5.21 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

33 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

156 kB
Transfer

456 kB
Size

0
Cookies

3 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!