urlscan.io logo urlscan.io
SecurityTrails logo

woodworkpalace.com Open in urlscan Pro
162.144.19.36  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://8rsf9.app.link/
Effective URL: https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-972...
Submission: On March 29 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 162.144.19.36, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is woodworkpalace.com.
TLS certificate: Issued by R3 on March 29th 2021. Valid for: 3 months.
This is the only time woodworkpalace.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Xfinity (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 2 2600:9000:214... 16509 (AMAZON-02)
2 6 162.144.19.36 46606 (UNIFIEDLA...)
4 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
8 3
Apex Domain
Subdomains		 Transfer
6 woodworkpalace.com
woodworkpalace.com
131 KB
4 cimcontent.net
static.cimcontent.net
107 KB
2 app.link
8rsf9.app.link
1 KB
8 3
Domain Requested by
6 woodworkpalace.com 2 redirects woodworkpalace.com
4 static.cimcontent.net woodworkpalace.com
2 8rsf9.app.link 2 redirects
8 3

This site contains no links.

Subject Issuer Validity Valid
cpcalendars.woodworkpalace.com
R3		 2021-03-29 -
2021-06-27		 3 months crt.sh
static.cimcontent.net
COMODO RSA Organization Validation Secure Server CA		 2020-04-16 -
2022-04-16		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
Frame ID: A4AF44A598727B5F6EC24DE107265D50
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://8rsf9.app.link/ HTTP 307
    https://8rsf9.app.link/ HTTP 307
    https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/GO/ HTTP 302
    https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Bi... HTTP 301
    https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Bi... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

238 kB
Transfer

273 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://8rsf9.app.link/ HTTP 307
    https://8rsf9.app.link/ HTTP 307
    https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/GO/ HTTP 302
    https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219 HTTP 301
    https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
Redirect Chain
  • http://8rsf9.app.link/
  • https://8rsf9.app.link/
  • https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/GO/
  • https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219
  • https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.144.19.36 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
seoitservice.com
Software
Apache /
Resource Hash
19deab81ab5a39e4e9ab9cddefe720d70629c95e413c01eb77aee89150bb6660
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

:method
GET
:authority
woodworkpalace.com
:scheme
https
:path
/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 29 Mar 2021 13:12:55 GMT
server
Apache
vary
Accept-Encoding
content-encoding
gzip
content-security-policy
upgrade-insecure-requests
content-length
3185
content-type
text/html; charset=UTF-8

Redirect headers

date
Mon, 29 Mar 2021 13:12:55 GMT
server
Apache
location
https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
content-length
353
content-type
text/html; charset=iso-8859-1
fonts-remote.min.css
woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/CSS/ 		3 KB
375 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/CSS/fonts-remote.min.css
Requested by
Host: woodworkpalace.com
URL: https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.144.19.36 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
seoitservice.com
Software
Apache /
Resource Hash
032d8b49c68572a6136937e3f8f4fb10d94eefaf95418e557f44f1f04b715ba8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Referer
https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 29 Mar 2021 13:12:55 GMT
content-encoding
gzip
last-modified
Mon, 29 Mar 2021 13:12:55 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
content-security-policy
upgrade-insecure-requests
accept-ranges
bytes
content-length
307
styles-light.min.css
woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/CSS/ 		44 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/CSS/styles-light.min.css
Requested by
Host: woodworkpalace.com
URL: https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.144.19.36 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
seoitservice.com
Software
Apache /
Resource Hash
9f0b93d0bbfb7b752c7aa3254f290442661bd8ca50da75094df5fef7fdc1fb26
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Referer
https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 29 Mar 2021 13:12:55 GMT
content-encoding
gzip
last-modified
Mon, 29 Mar 2021 13:12:55 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
content-security-policy
upgrade-insecure-requests
accept-ranges
bytes
C1.png
woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/CSS/ 		109 KB
110 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/CSS/C1.png
Requested by
Host: woodworkpalace.com
URL: https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.144.19.36 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
seoitservice.com
Software
Apache /
Resource Hash
bf422f6192bef1875406c2c915cc28bef978325cb39a5e2ee34bfb54b4658bbd
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Referer
https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
last-modified
Mon, 29 Mar 2021 13:12:55 GMT
server
Apache
accept-ranges
bytes
date
Mon, 29 Mar 2021 13:12:55 GMT
content-length
111580
content-type
image/png
truncated
/ 		933 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4bd9c8ed57b1dd8fddcc2910170e9b81b40f7b628e272924e88a98f45ebb9aea

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
58fd862aaa51daaa186ee3fecfd805c0f8eea09146e9c7deb44a3f30a1ad01b5

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
XfinityStandard-Regular.woff2
static.cimcontent.net/fonts/latest/Xfinity_Standard/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.cimcontent.net/fonts/latest/Xfinity_Standard/XfinityStandard-Regular.woff2
Requested by
Host: woodworkpalace.com
URL: https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/CSS/fonts-remote.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a6::30d4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176

Request headers

Origin
https://woodworkpalace.com
Referer
https://woodworkpalace.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
kLBQWhXkUwwuS0hOSKJ2GQ_XrNE.oQFF
last-modified
Fri, 24 Jan 2020 21:23:01 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
etag
"e3e79cd377b28c1e7ffea64b194136cf"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=2321290
date
Mon, 29 Mar 2021 13:12:56 GMT
accept-ranges
bytes
content-length
26768
x-amz-cf-id
r5s3irE-bW1kr52oAuP_MDr6Hpc5ReQvpn835a65JRJBRygay16WhA==
XfinityStandard-Bold.woff2
static.cimcontent.net/fonts/latest/Xfinity_Standard/ 		26 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.cimcontent.net/fonts/latest/Xfinity_Standard/XfinityStandard-Bold.woff2
Requested by
Host: woodworkpalace.com
URL: https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/CSS/fonts-remote.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a6::30d4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
020e9e48d93ba9d27e827e8246dd9f855c388ff4697ba14d647fcc4d9b1ccdef

Request headers

Origin
https://woodworkpalace.com
Referer
https://woodworkpalace.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
LDG6wJQl1INH_wTGu7a9uUI1eheA5q.9
last-modified
Fri, 24 Jan 2020 21:23:01 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
etag
"4cf223c306de5325b4939d9d4ea2c5a5"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=2276938
date
Mon, 29 Mar 2021 13:12:56 GMT
accept-ranges
bytes
content-length
26896
x-amz-cf-id
vzm-Mt4AOHwmFjl1UWgKOz_-SYnSjwvJwvjl3BWfOsy0MRnU_31ejw==
XfinityStandard-Medium.woff2
static.cimcontent.net/fonts/latest/Xfinity_Standard/ 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.cimcontent.net/fonts/latest/Xfinity_Standard/XfinityStandard-Medium.woff2
Requested by
Host: woodworkpalace.com
URL: https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/CSS/fonts-remote.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a6::30d4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2a031939885bb7efba89d423c9ee7c0fe2bab465f18db63f40a9ae2bd7bc0228

Request headers

Origin
https://woodworkpalace.com
Referer
https://woodworkpalace.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
6t4RA2DS89tdf_2IK5vrc9JAOKCy9A40
last-modified
Fri, 24 Jan 2020 21:23:01 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
etag
"13709eac065721ba8cd0e2d1b6fa8026"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=2309279
date
Mon, 29 Mar 2021 13:12:56 GMT
accept-ranges
bytes
content-length
27152
x-amz-cf-id
z1uHrgwGQQ1Sd0FF048setQ2KSLS5MTbOVkGg3osyxArHxkKUATvlQ==
XfinityStandard-Light.woff2
static.cimcontent.net/fonts/latest/Xfinity_Standard/ 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.cimcontent.net/fonts/latest/Xfinity_Standard/XfinityStandard-Light.woff2
Requested by
Host: woodworkpalace.com
URL: https://woodworkpalace.com/onlinnnr/wp-online/storeis/Mode/Cwd/MS-GO/Up/Verification%20UPCC%20Online&Billing.%20SUPPORT-97278134139858459219/CSS/fonts-remote.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a6::30d4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a

Request headers

Origin
https://woodworkpalace.com
Referer
https://woodworkpalace.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
wnCwOacXycelzt78IMkr55wWB9WkMd2W
last-modified
Fri, 24 Jan 2020 21:23:01 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
etag
"f05d3ebe80809d82ab14d62a79da544e"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=2317453
date
Mon, 29 Mar 2021 13:12:56 GMT
accept-ranges
bytes
content-length
27420
x-amz-cf-id
lHHI1IgBwXqQUKGGiRoC3TON4HlnTUiYe_eJTEzdiQhpsR-B5_5rsQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Xfinity (Consumer)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests