workinprogress.pl Open in urlscan Pro
94.23.222.34  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://northern-nasal-oregano.glitch.me/SFU.html Page URL
2. https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	SFU.html Show response northern-nasal-oregano.glitch.me/	133 B 452 B	365ms 130ms	Document text/html	34.228.120.225 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://northern-nasal-oregano.glitch.me/SFU.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.228.120.225 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-228-120-225.compute-1.amazonaws.com Software AmazonS3 / Resource Hash e895bacc44688eeed9f3863c763fa442ec6b0ced7e5e0e7b4b92bccfdbec231b Request headers :method GET :authority northern-nasal-oregano.glitch.me :scheme https :path /SFU.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Fri, 24 Jul 2020 19:40:25 GMT content-type text/html content-length 133 x-amz-id-2 eTx5jqdMlYU19vQ2COrZgysk9XKEfHWgGD04Gcp484aslUXXPkFpdHigPVVDutcVyEB8OuDuAyo= x-amz-request-id A81D3F738AC6B577 last-modified Fri, 24 Jul 2020 12:28:09 GMT etag "8ce440ebc04c2b9a3d76c23c028c909f" cache-control no-cache x-amz-version-id uce3HEDrfQ3i3pzXhB7Ycp9T94dthVIo accept-ranges bytes server AmazonS3
GET H2	200	Primary Request / Show response workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/	18 KB 6 KB	113ms 34ms	Document text/html	94.23.222.34 OVH
General Check archive.org Show headers Download Go to Full URL https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.23.222.34 Liévin, France, ASN16276 (OVH, FR), Reverse DNS s1.k4.pl Software Apache/2 / PHP/7.3.15 Resource Hash 5b8852aa6cd5c054989b02ccc2f0655ce3b565aaedbd27cd00af6188df943855 Request headers :method GET :authority workinprogress.pl :scheme https :path /bmw/wp-includes/SimplePie/Content/Type/SFU/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://northern-nasal-oregano.glitch.me/SFU.html accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://northern-nasal-oregano.glitch.me/SFU.html Response headers status 200 date Fri, 24 Jul 2020 19:40:25 GMT server Apache/2 x-powered-by PHP/7.3.15 vary Accept-Encoding,User-Agent content-encoding gzip content-length 5535 content-type text/html; charset=UTF-8
GET H2	200	style.css workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/assets/	8 KB 2 KB	31ms 30ms	Stylesheet text/css	94.23.222.34 OVH
General Check archive.org Show headers Download Go to Full URL https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/assets/style.css Requested by Host: workinprogress.pl URL: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.23.222.34 Liévin, France, ASN16276 (OVH, FR), Reverse DNS s1.k4.pl Software Apache/2 / Resource Hash 0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205 Request headers Referer https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 24 Jul 2020 19:40:25 GMT content-encoding gzip last-modified Wed, 12 Feb 2020 01:43:00 GMT server Apache/2 etag "1fd0-59e5717ab5100-gzip" vary Accept-Encoding,User-Agent content-type text/css status 200 accept-ranges bytes content-length 2443
GET H/1.1	200 OK	sfu-logo.jpg www.acamp.ca/wp-content/uploads/2014/12/	18 KB 18 KB	645ms 133ms	Image image/jpeg	162.241.158.42 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://www.acamp.ca/wp-content/uploads/2014/12/sfu-logo.jpg Requested by Host: workinprogress.pl URL: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.241.158.42 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cre.creativepace.com Software Apache / Resource Hash 52baba4f27eec00128519c8215fde2eedc4a6b955e27b5daa20bbdee7c9290d3 Request headers Referer https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 24 Jul 2020 19:40:25 GMT Referrer-Policy Last-Modified Thu, 09 Jul 2015 23:38:02 GMT Server Apache Vary Accept-Encoding Content-Type image/jpeg Cache-Control max-age=31536000 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 18156 Expires Sat, 24 Jul 2021 19:40:25 GMT
GET H2	200	100727-134.jpg www.vancouvermarket.ca/wp-content/uploads/2012/11/	7 MB 7 MB	801ms 233ms	Image image/jpeg	162.241.24.197 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://www.vancouvermarket.ca/wp-content/uploads/2012/11/100727-134.jpg Requested by Host: workinprogress.pl URL: https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.24.197 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5895.bluehost.com Software nginx/1.19.0 / Resource Hash 70b1dd794254c68522dc3c6ac5534af2b6c6cbafd29116f31c33226edbf23163 Request headers Referer https://workinprogress.pl/bmw/wp-includes/SimplePie/Content/Type/SFU/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 24 Jul 2020 19:40:26 GMT last-modified Thu, 01 Nov 2012 14:49:55 GMT server nginx/1.19.0 accept-ranges bytes x-server-cache false x-endurance-cache-level 2 content-type image/jpeg status 200 cache-control max-age=21600 host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== content-length 6838809 expires Sat, 25 Jul 2020 01:40:26 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canadian Universities (Education)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

northern-nasal-oregano.glitch.me
workinprogress.pl
www.acamp.ca
www.vancouvermarket.ca
162.241.158.42
162.241.24.197
34.228.120.225
94.23.222.34
0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205
52baba4f27eec00128519c8215fde2eedc4a6b955e27b5daa20bbdee7c9290d3
5b8852aa6cd5c054989b02ccc2f0655ce3b565aaedbd27cd00af6188df943855
70b1dd794254c68522dc3c6ac5534af2b6c6cbafd29116f31c33226edbf23163
e895bacc44688eeed9f3863c763fa442ec6b0ced7e5e0e7b4b92bccfdbec231b