workinprogress.pl Open in urlscan Pro
94.23.222.34  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/	18 KB 6 KB	87ms 46ms	Document text/html	94.23.222.34 OVH
General Check archive.org Show headers Download Go to Full URL http://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol HTTP/1.1 Server 94.23.222.34 Liévin, France, ASN16276 (OVH, FR), Reverse DNS s1.k4.pl Software Apache/2 / PHP/7.4.3 Resource Hash 5b8852aa6cd5c054989b02ccc2f0655ce3b565aaedbd27cd00af6188df943855 Request headers Host workinprogress.pl Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 08 Oct 2020 22:31:55 GMT Server Apache/2 X-Powered-By PHP/7.4.3 Upgrade h2,h2c Connection Upgrade, Keep-Alive Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 5535 Keep-Alive timeout=2, max=100 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	style.css workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/assets/	8 KB 3 KB	30ms 29ms	Stylesheet text/css	94.23.222.34 OVH
General Check archive.org Show headers Download Go to Full URL http://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/assets/style.css Requested by Host: workinprogress.pl URL: http://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol HTTP/1.1 Server 94.23.222.34 Liévin, France, ASN16276 (OVH, FR), Reverse DNS s1.k4.pl Software Apache/2 / Resource Hash 0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205 Request headers Referer http://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 08 Oct 2020 22:31:55 GMT Content-Encoding gzip Last-Modified Wed, 12 Feb 2020 01:43:00 GMT Server Apache/2 ETag "1fd0-59e5717ab5100-gzip" Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=99 Content-Length 2443
GET H/1.1	200 OK	sfu-logo.jpg www.acamp.ca/wp-content/uploads/2014/12/	18 KB 18 KB	660ms 131ms	Image image/jpeg	162.241.158.42 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://www.acamp.ca/wp-content/uploads/2014/12/sfu-logo.jpg Requested by Host: workinprogress.pl URL: http://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.241.158.42 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cre.creativepace.com Software Apache / Resource Hash 52baba4f27eec00128519c8215fde2eedc4a6b955e27b5daa20bbdee7c9290d3 Request headers Referer http://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 08 Oct 2020 22:31:56 GMT Referrer-Policy Last-Modified Thu, 09 Jul 2015 23:38:02 GMT Server Apache Vary Accept-Encoding Content-Type image/jpeg Cache-Control max-age=31536000 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 18156 Expires Fri, 08 Oct 2021 22:31:56 GMT
GET H2	200	100727-134.jpg www.vancouvermarket.ca/wp-content/uploads/2012/11/	7 MB 7 MB	727ms 231ms	Image image/jpeg	162.241.24.197 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://www.vancouvermarket.ca/wp-content/uploads/2012/11/100727-134.jpg Requested by Host: workinprogress.pl URL: http://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.24.197 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5895.bluehost.com Software nginx/1.19.0 / Resource Hash 70b1dd794254c68522dc3c6ac5534af2b6c6cbafd29116f31c33226edbf23163 Request headers Referer http://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 08 Oct 2020 22:31:56 GMT last-modified Thu, 01 Nov 2012 14:49:55 GMT server nginx/1.19.0 accept-ranges bytes x-server-cache false x-endurance-cache-level 2 content-type image/jpeg status 200 cache-control max-age=21600 host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== content-length 6838809 expires Fri, 09 Oct 2020 04:31:56 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canadian Universities (Education)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

workinprogress.pl
www.acamp.ca
www.vancouvermarket.ca
162.241.158.42
162.241.24.197
94.23.222.34
0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205
52baba4f27eec00128519c8215fde2eedc4a6b955e27b5daa20bbdee7c9290d3
5b8852aa6cd5c054989b02ccc2f0655ce3b565aaedbd27cd00af6188df943855
70b1dd794254c68522dc3c6ac5534af2b6c6cbafd29116f31c33226edbf23163