urlscan.io logo urlscan.io
SecurityTrails logo

workinprogress.pl Open in urlscan Pro
94.23.222.34  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
Submission: On July 30 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 94.23.222.34, located in Liévin, France and belongs to OVH, FR. The main domain is workinprogress.pl.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 3rd 2020. Valid for: 3 months.
This is the only time workinprogress.pl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Canadian Universities (Education)

Domain & IP information

IP Address AS Autonomous System
1 3 94.23.222.34 16276 (OVH)
1 162.241.158.42 46606 (UNIFIEDLA...)
1 162.241.24.197 46606 (UNIFIEDLA...)
4 3
Apex Domain
Subdomains		 Transfer
3 workinprogress.pl
workinprogress.pl
8 KB
1 vancouvermarket.ca
www.vancouvermarket.ca
7 MB
1 acamp.ca
www.acamp.ca
18 KB
4 3
Domain Requested by
3 workinprogress.pl 1 redirects workinprogress.pl
1 www.vancouvermarket.ca workinprogress.pl
1 www.acamp.ca workinprogress.pl
4 3

This site contains no links.

Subject Issuer Validity Valid
workinprogress.pl
Let's Encrypt Authority X3		 2020-07-03 -
2020-10-01		 3 months crt.sh
cpcontacts.acamp.ca
Let's Encrypt Authority X3		 2020-05-27 -
2020-08-25		 3 months crt.sh
cpcontacts.vancouvermarket.ca
Let's Encrypt Authority X3		 2020-06-12 -
2020-09-10		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
Frame ID: 01B6289BE2422A7A59DA4D642DAC3DC1
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU HTTP 301
    https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

6716 kB
Transfer

6722 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU HTTP 301
    https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
Redirect Chain
  • https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU
  • https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
18 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.23.222.34 Liévin, France, ASN16276 (OVH, FR),
Reverse DNS
s1.k4.pl
Software
Apache/2 / PHP/7.3.15
Resource Hash
5b8852aa6cd5c054989b02ccc2f0655ce3b565aaedbd27cd00af6188df943855

Request headers

:method
GET
:authority
workinprogress.pl
:scheme
https
:path
/bmw/wp-includes/SimplePie/Content/Type/SFU/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 30 Jul 2020 04:41:44 GMT
server
Apache/2
x-powered-by
PHP/7.3.15
vary
Accept-Encoding,User-Agent
content-encoding
gzip
content-length
5535
content-type
text/html; charset=UTF-8

Redirect headers

status
301
date
Thu, 30 Jul 2020 04:41:44 GMT
server
Apache/2
location
https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
content-length
277
content-type
text/html; charset=iso-8859-1
style.css
workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/assets/ 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/assets/style.css
Requested by
Host: workinprogress.pl
URL: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.23.222.34 Liévin, France, ASN16276 (OVH, FR),
Reverse DNS
s1.k4.pl
Software
Apache/2 /
Resource Hash
0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205

Request headers

Referer
https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 30 Jul 2020 04:41:44 GMT
content-encoding
gzip
last-modified
Wed, 12 Feb 2020 01:43:00 GMT
server
Apache/2
etag
"1fd0-59e5717ab5100-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
status
200
accept-ranges
bytes
content-length
2443
sfu-logo.jpg
www.acamp.ca/wp-content/uploads/2014/12/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.acamp.ca/wp-content/uploads/2014/12/sfu-logo.jpg
Requested by
Host: workinprogress.pl
URL: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.241.158.42 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
cre.creativepace.com
Software
Apache /
Resource Hash
52baba4f27eec00128519c8215fde2eedc4a6b955e27b5daa20bbdee7c9290d3

Request headers

Referer
https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 30 Jul 2020 04:41:45 GMT
Referrer-Policy
Last-Modified
Thu, 09 Jul 2015 23:38:02 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
18156
Expires
Fri, 30 Jul 2021 04:41:45 GMT
100727-134.jpg
www.vancouvermarket.ca/wp-content/uploads/2012/11/ 		7 MB
7 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.vancouvermarket.ca/wp-content/uploads/2012/11/100727-134.jpg
Requested by
Host: workinprogress.pl
URL: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.197 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5895.bluehost.com
Software
nginx/1.19.0 /
Resource Hash
70b1dd794254c68522dc3c6ac5534af2b6c6cbafd29116f31c33226edbf23163

Request headers

Referer
https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 30 Jul 2020 04:41:45 GMT
last-modified
Thu, 01 Nov 2012 14:49:55 GMT
server
nginx/1.19.0
accept-ranges
bytes
x-server-cache
false
x-endurance-cache-level
2
content-type
image/jpeg
status
200
cache-control
max-age=21600
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
6838809
expires
Thu, 30 Jul 2020 10:41:45 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canadian Universities (Education)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage

0 Cookies