workinprogress.pl Open in urlscan Pro
94.23.222.34  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/	18 KB 6 KB	113ms 26ms	Document text/html	94.23.222.34 OVH
General Check archive.org Show headers Download Go to Full URL https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.23.222.34 Liévin, France, ASN16276 (OVH, FR), Reverse DNS s1.k4.pl Software Apache/2 / PHP/7.3.15 Resource Hash 5b8852aa6cd5c054989b02ccc2f0655ce3b565aaedbd27cd00af6188df943855 Request headers :method GET :authority workinprogress.pl :scheme https :path /bmw/wp-includes/SimplePie/Content/Type/SFU/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Thu, 30 Jul 2020 11:05:43 GMT server Apache/2 x-powered-by PHP/7.3.15 vary Accept-Encoding,User-Agent content-encoding gzip content-length 5535 content-type text/html; charset=UTF-8
GET H2	200	style.css workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/assets/	8 KB 2 KB	22ms 22ms	Stylesheet text/css	94.23.222.34 OVH
General Check archive.org Show headers Download Go to Full URL https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/assets/style.css Requested by Host: workinprogress.pl URL: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.23.222.34 Liévin, France, ASN16276 (OVH, FR), Reverse DNS s1.k4.pl Software Apache/2 / Resource Hash 0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205 Request headers Referer https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 30 Jul 2020 11:05:43 GMT content-encoding gzip last-modified Wed, 12 Feb 2020 01:43:00 GMT server Apache/2 etag "1fd0-59e5717ab5100-gzip" vary Accept-Encoding,User-Agent content-type text/css status 200 accept-ranges bytes content-length 2443
GET H/1.1	200 OK	sfu-logo.jpg www.acamp.ca/wp-content/uploads/2014/12/	18 KB 18 KB	508ms 129ms	Image image/jpeg	162.241.158.42 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://www.acamp.ca/wp-content/uploads/2014/12/sfu-logo.jpg Requested by Host: workinprogress.pl URL: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.241.158.42 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cre.creativepace.com Software Apache / Resource Hash 52baba4f27eec00128519c8215fde2eedc4a6b955e27b5daa20bbdee7c9290d3 Request headers Referer https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 30 Jul 2020 11:05:43 GMT Referrer-Policy Last-Modified Thu, 09 Jul 2015 23:38:02 GMT Server Apache Vary Accept-Encoding Content-Type image/jpeg Cache-Control max-age=31536000 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 18156 Expires Fri, 30 Jul 2021 11:05:43 GMT
GET H2	200	100727-134.jpg www.vancouvermarket.ca/wp-content/uploads/2012/11/	7 MB 7 MB	500ms 201ms	Image image/jpeg	162.241.24.197 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://www.vancouvermarket.ca/wp-content/uploads/2012/11/100727-134.jpg Requested by Host: workinprogress.pl URL: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.24.197 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5895.bluehost.com Software nginx/1.19.0 / Resource Hash 70b1dd794254c68522dc3c6ac5534af2b6c6cbafd29116f31c33226edbf23163 Request headers Referer https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 30 Jul 2020 11:05:43 GMT last-modified Thu, 01 Nov 2012 14:49:55 GMT server nginx/1.19.0 accept-ranges bytes x-server-cache false x-endurance-cache-level 2 content-type image/jpeg status 200 cache-control max-age=21600 host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== content-length 6838809 expires Thu, 30 Jul 2020 17:05:43 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canadian Universities (Education)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

workinprogress.pl
www.acamp.ca
www.vancouvermarket.ca
162.241.158.42
162.241.24.197
94.23.222.34
0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205
52baba4f27eec00128519c8215fde2eedc4a6b955e27b5daa20bbdee7c9290d3
5b8852aa6cd5c054989b02ccc2f0655ce3b565aaedbd27cd00af6188df943855
70b1dd794254c68522dc3c6ac5534af2b6c6cbafd29116f31c33226edbf23163