democracypublic.com Open in urlscan Pro
162.241.71.183  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set login.php Show response democracypublic.com/Accesspoint%20/secure-docu/	3 KB 3 KB	1083ms 352ms	Document text/html	162.241.71.183 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://democracypublic.com/Accesspoint%20/secure-docu/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.71.183 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-71-183.unifiedlayer.com Software www.fbi.gov / Resource Hash a592e52760fc17b8dee6d8fef2184ce00d34122ba7592679f9de697f40191b0d Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Host democracypublic.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 28 Oct 2020 22:53:38 GMT Server www.fbi.gov Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=e7651b02ca89619a74dda02925fd43f0; path=/ X-Content-Type nosniff X_FORWARDED_FOR 104.16.77.187 REMOTE_ADDR 104.16.77.187 Connection keep-alive, Keep-Alive Host www.fbi.gov Origin https://www.fbi.gov Referer https://www.fbi.gov X-Forwarded-Host www.fbi.gov X-Forwarded-Proto https X-XSS-Protection 1; mode=block Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	bootstrap.css democracypublic.com/Accesspoint%20/secure-docu/assets/css/	138 KB 138 KB	159ms 158ms	Stylesheet text/css	162.241.71.183 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://democracypublic.com/Accesspoint%20/secure-docu/assets/css/bootstrap.css Requested by Host: democracypublic.com URL: https://democracypublic.com/Accesspoint%20/secure-docu/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.71.183 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-71-183.unifiedlayer.com Software Apache / Resource Hash 3beb48429a842d5c330b9b4cc0a518652e1eca16121f40bdc1d4c41e4ff1a08c Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://democracypublic.com/Accesspoint%20/secure-docu/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 28 Oct 2020 22:53:38 GMT Origin https://www.fbi.gov Connection keep-alive, Keep-Alive X_FORWARDED_FOR 104.16.77.187 X-Forwarded-Proto https Content-Length 140942 X-XSS-Protection 1; mode=block Server Apache X-Content-Type nosniff REMOTE_ADDR 104.16.77.187 Last-Modified Sat, 13 Jul 2019 17:24:50 GMT X-Forwarded-Host www.fbi.gov Host www.fbi.gov Content-Type text/css Referer https://www.fbi.gov Accept-Ranges bytes Keep-Alive timeout=5, max=99
GET H/1.1	200 OK	login.css democracypublic.com/Accesspoint%20/secure-docu/assets/css/	2 KB 2 KB	448ms 155ms	Stylesheet text/css	162.241.71.183 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://democracypublic.com/Accesspoint%20/secure-docu/assets/css/login.css Requested by Host: democracypublic.com URL: https://democracypublic.com/Accesspoint%20/secure-docu/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.71.183 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-71-183.unifiedlayer.com Software Apache / Resource Hash 4dec1bef9200f9e8594d0bbb80b18ba4fee8ce6b71167f59b1b8aeeabdfe615b Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://democracypublic.com/Accesspoint%20/secure-docu/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 28 Oct 2020 22:53:38 GMT Origin https://www.fbi.gov Connection keep-alive, Keep-Alive X_FORWARDED_FOR 104.16.77.187 X-Forwarded-Proto https Content-Length 1926 X-XSS-Protection 1; mode=block Server Apache X-Content-Type nosniff REMOTE_ADDR 104.16.77.187 Last-Modified Thu, 21 May 2020 15:45:34 GMT X-Forwarded-Host www.fbi.gov Host www.fbi.gov Content-Type text/css Referer https://www.fbi.gov Accept-Ranges bytes Keep-Alive timeout=5, max=100
GET H/1.1	200 OK	jquery.min.js Show response democracypublic.com/Accesspoint%20/secure-docu/assets/js/	85 KB 85 KB	468ms 158ms	Script application/javascript	162.241.71.183 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://democracypublic.com/Accesspoint%20/secure-docu/assets/js/jquery.min.js Requested by Host: democracypublic.com URL: https://democracypublic.com/Accesspoint%20/secure-docu/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.71.183 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-71-183.unifiedlayer.com Software Apache / Resource Hash d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://democracypublic.com/Accesspoint%20/secure-docu/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 28 Oct 2020 22:53:38 GMT Origin https://www.fbi.gov Connection keep-alive, Keep-Alive X_FORWARDED_FOR 104.16.77.187 X-Forwarded-Proto https Content-Length 86927 X-XSS-Protection 1; mode=block Server Apache X-Content-Type nosniff REMOTE_ADDR 104.16.77.187 Last-Modified Sat, 13 Jul 2019 17:27:16 GMT X-Forwarded-Host www.fbi.gov Host www.fbi.gov Content-Type application/javascript Referer https://www.fbi.gov Accept-Ranges bytes Keep-Alive timeout=5, max=100
GET H/1.1	200 OK	popper.min.js Show response democracypublic.com/Accesspoint%20/secure-docu/assets/js/	20 KB 20 KB	481ms 160ms	Script application/javascript	162.241.71.183 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://democracypublic.com/Accesspoint%20/secure-docu/assets/js/popper.min.js Requested by Host: democracypublic.com URL: https://democracypublic.com/Accesspoint%20/secure-docu/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.71.183 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-71-183.unifiedlayer.com Software Apache / Resource Hash 315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://democracypublic.com/Accesspoint%20/secure-docu/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 28 Oct 2020 22:53:38 GMT Origin https://www.fbi.gov Connection keep-alive, Keep-Alive X_FORWARDED_FOR 104.16.77.187 X-Forwarded-Proto https Content-Length 20340 X-XSS-Protection 1; mode=block Server Apache X-Content-Type nosniff REMOTE_ADDR 104.16.77.187 Last-Modified Sat, 13 Jul 2019 17:28:00 GMT X-Forwarded-Host www.fbi.gov Host www.fbi.gov Content-Type application/javascript Referer https://www.fbi.gov Accept-Ranges bytes Keep-Alive timeout=5, max=100
GET H/1.1	200 OK	bootstrap.min.js Show response democracypublic.com/Accesspoint%20/secure-docu/assets/js/	100 KB 100 KB	557ms 166ms	Script application/javascript	162.241.71.183 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://democracypublic.com/Accesspoint%20/secure-docu/assets/js/bootstrap.min.js Requested by Host: democracypublic.com URL: https://democracypublic.com/Accesspoint%20/secure-docu/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.71.183 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-71-183.unifiedlayer.com Software Apache / Resource Hash 829ad53bf9c48fdeef3adbea95a53e8b57c4499198be68b1b7c1ac353790f50c Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://democracypublic.com/Accesspoint%20/secure-docu/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 28 Oct 2020 22:53:39 GMT Origin https://www.fbi.gov Connection keep-alive, Keep-Alive X_FORWARDED_FOR 104.16.77.187 X-Forwarded-Proto https Content-Length 102090 X-XSS-Protection 1; mode=block Server Apache X-Content-Type nosniff REMOTE_ADDR 104.16.77.187 Last-Modified Sat, 13 Jul 2019 17:29:38 GMT X-Forwarded-Host www.fbi.gov Host www.fbi.gov Content-Type application/javascript Referer https://www.fbi.gov Accept-Ranges bytes Keep-Alive timeout=5, max=100
GET H/1.1	200 OK	logo.svg democracypublic.com/Accesspoint%20/secure-docu/assets/images/	4 KB 4 KB	159ms 159ms	Image image/svg+xml	162.241.71.183 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://democracypublic.com/Accesspoint%20/secure-docu/assets/images/logo.svg Requested by Host: democracypublic.com URL: https://democracypublic.com/Accesspoint%20/secure-docu/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.71.183 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-71-183.unifiedlayer.com Software Apache / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://democracypublic.com/Accesspoint%20/secure-docu/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 28 Oct 2020 22:53:39 GMT Origin https://www.fbi.gov Connection keep-alive, Keep-Alive X_FORWARDED_FOR 104.16.77.187 X-Forwarded-Proto https Content-Length 3651 X-XSS-Protection 1; mode=block Server Apache X-Content-Type nosniff REMOTE_ADDR 104.16.77.187 Last-Modified Mon, 21 Jan 2019 10:45:04 GMT X-Forwarded-Host www.fbi.gov Host www.fbi.gov Content-Type image/svg+xml Referer https://www.fbi.gov Accept-Ranges bytes Keep-Alive timeout=5, max=99
GET H/1.1	200 OK	ellipsis_white.svg democracypublic.com/Accesspoint%20/secure-docu/assets/images/	915 B 1 KB	160ms 160ms	Image image/svg+xml	162.241.71.183 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://democracypublic.com/Accesspoint%20/secure-docu/assets/images/ellipsis_white.svg Requested by Host: democracypublic.com URL: https://democracypublic.com/Accesspoint%20/secure-docu/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.71.183 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-71-183.unifiedlayer.com Software Apache / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://democracypublic.com/Accesspoint%20/secure-docu/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 28 Oct 2020 22:53:39 GMT Origin https://www.fbi.gov Connection keep-alive, Keep-Alive X_FORWARDED_FOR 104.16.77.187 X-Forwarded-Proto https Content-Length 915 X-XSS-Protection 1; mode=block Server Apache X-Content-Type nosniff REMOTE_ADDR 104.16.77.187 Last-Modified Mon, 21 Jan 2019 10:45:04 GMT X-Forwarded-Host www.fbi.gov Host www.fbi.gov Content-Type image/svg+xml Referer https://www.fbi.gov Accept-Ranges bytes Keep-Alive timeout=5, max=98
GET H/1.1	200 OK	background.svg democracypublic.com/Accesspoint%20/secure-docu/assets/images/	2 KB 2 KB	207ms 207ms	Image image/svg+xml	162.241.71.183 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://democracypublic.com/Accesspoint%20/secure-docu/assets/images/background.svg Requested by Host: democracypublic.com URL: https://democracypublic.com/Accesspoint%20/secure-docu/assets/css/login.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.71.183 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-71-183.unifiedlayer.com Software Apache / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://democracypublic.com/Accesspoint%20/secure-docu/assets/css/login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 28 Oct 2020 22:53:39 GMT Origin https://www.fbi.gov Connection keep-alive, Keep-Alive X_FORWARDED_FOR 104.16.77.187 X-Forwarded-Proto https Content-Length 1864 X-XSS-Protection 1; mode=block Server Apache X-Content-Type nosniff REMOTE_ADDR 104.16.77.187 Last-Modified Thu, 21 May 2020 15:27:06 GMT X-Forwarded-Host www.fbi.gov Host www.fbi.gov Content-Type image/svg+xml Referer https://www.fbi.gov Accept-Ranges bytes Keep-Alive timeout=5, max=99

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery function| Popper

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			democracypublic.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: e7651b02ca89619a74dda02925fd43f0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

democracypublic.com
162.241.71.183
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
3beb48429a842d5c330b9b4cc0a518652e1eca16121f40bdc1d4c41e4ff1a08c
4dec1bef9200f9e8594d0bbb80b18ba4fee8ce6b71167f59b1b8aeeabdfe615b
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
829ad53bf9c48fdeef3adbea95a53e8b57c4499198be68b1b7c1ac353790f50c
a592e52760fc17b8dee6d8fef2184ce00d34122ba7592679f9de697f40191b0d
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d