euphoria-swiecie.pl
Open in
urlscan Pro
89.161.152.161
Malicious Activity!
Public Scan
URL:
http://euphoria-swiecie.pl/umass/umass.html
Submission: On May 07 via manual from US
Submission: On May 07 via manual from US
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 11 HTTP transactions.
The main IP is 89.161.152.161, located in
Poland and
belongs to HOMEPL-AS, PL.
The main domain is euphoria-swiecie.pl.
This is the only time euphoria-swiecie.pl was scanned on urlscan.io!
This is the only time euphoria-swiecie.pl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: University of Massachusetts (Education)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 89.161.152.161 89.161.152.161 | 12824 (HOMEPL-AS) (HOMEPL-AS) | |
| 6 | 128.119.8.236 128.119.8.236 | 1249 (FIVE-COLL...) (FIVE-COLLEGES-AS - Five Colleges Network) | |
| 11 | 2 |
5
89.161.152.161
(Poland)
ASN12824 (HOMEPL-AS, PL)
PTR: cloudserver026577.home.pl
ASN12824 (HOMEPL-AS, PL)
PTR: cloudserver026577.home.pl
| euphoria-swiecie.pl |
6
128.119.8.236
(Amherst, United States)
ASN1249 (FIVE-COLLEGES-AS - Five Colleges Network, US)
PTR: webauth.umass.edu
ASN1249 (FIVE-COLLEGES-AS - Five Colleges Network, US)
PTR: webauth.umass.edu
| webauth.umass.edu |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
umass.edu
webauth.umass.edu |
42 KB |
| 5 |
euphoria-swiecie.pl
euphoria-swiecie.pl |
105 KB |
| 11 | 2 |
| Domain | Requested by | |
|---|---|---|
| 6 | webauth.umass.edu |
euphoria-swiecie.pl
|
| 5 | euphoria-swiecie.pl |
euphoria-swiecie.pl
|
| 11 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.umass.edu |
| www.it.umass.edu |
| umass.edu |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://euphoria-swiecie.pl/umass/umass.html
Frame ID: B5C37160557E3E25864984B7C4A43AFB
Requests: 11 HTTP requests in this frame
Screenshot
Detected technologies
Modernizr
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
- env /^Modernizr$/i
Prefix-Free
(Miscellaneous)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^PrefixFree$/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
URL: http://www.umass.edu/
Title: UMass Amherst
Title: UMass Amherst
Search URL Search Domain Scan URL
URL: https://www.it.umass.edu/support/accounts/understand-your-netid-password
Title: About your NetID & Password
Title: About your NetID & Password
Search URL Search Domain Scan URL
URL: http://www.it.umass.edu/support/accounts/understand-your-netid-password#Your%20OIT%20Account%20Password
Title: Forgot your password?
Title: Forgot your password?
Search URL Search Domain Scan URL
URL: http://www.it.umass.edu/
Title: UMass Amherst Information Technology
Title: UMass Amherst Information Technology
Search URL Search Domain Scan URL
URL: http://umass.edu/umhome/policies.html
Title: Site Policies
Title: Site Policies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
umass.html
euphoria-swiecie.pl/umass/ |
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.8.0.min.js.download
euphoria-swiecie.pl/umass/umass_files/ |
90 KB 91 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
prefixfree.min.js.download
euphoria-swiecie.pl/umass/umass_files/ |
6 KB 6 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
modernizr.custom.js.download
euphoria-swiecie.pl/umass/umass_files/ |
2 KB 3 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
weblogin.js.download
euphoria-swiecie.pl/umass/umass_files/ |
2 KB 2 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg.jpg
webauth.umass.edu/idp/res/images/ |
22 KB 22 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg_shadow.png
webauth.umass.edu/idp/res/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
textfield_shadow.png
webauth.umass.edu/idp/res/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
submit.png
webauth.umass.edu/idp/res/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
header_bg.png
webauth.umass.edu/idp/res/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
umass_amherst.png
webauth.umass.edu/idp/res/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: University of Massachusetts (Education)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| StyleFix object| PrefixFree object| Modernizr0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
euphoria-swiecie.pl
webauth.umass.edu
128.119.8.236
89.161.152.161
49523de5cebda416078b4691a6f4836b463d162269b445e896442f06149136ae
49c48d9d6bd7df2041e0f2145564ffe0b1dd7fbbdbb051a053445c67c3e652fb
721d931ab11b9c05d685824504d27ef0bbdfcabeb422edec87c19603460af627
74da73c21ef7a015559acedaf6e96f22af445c3b4e7287df9d4fa999a1780eaa
766ecb30d01549a40c413c22defd8c37f0fe3793d5784a567694db92e43b1d7b
8c574e0a06396dfa7064b8b460e0e4a8d5d0748c4aa66eb2e4efdfcb46da4b31
bfc3392ff70e3e8fd9a9c4b97b31233a3c4611ca9dda09812e2a20075f85edca
c8b085fb3fed38ce09682d15069c09fe73418221a9649c54489cb20b731c531e
cd359f70b2cace48335a2a4947a1c4df98609c964b5b3d25a4a5b62d2e6697f8
f0a2aa9e7863809d3f7195c08bfe5ce99974ffce68151a0e163a4eb7bd9d1e09
fc311f750331bb5029e9db828e38dbebe5c7cc39320af6a89877f7da9fa74564