Report - workers-playground-red-credit-596b.dominickm.workers.dev/

Report Overview

Submitted URL
workers-playground-red-credit-596b.dominickm.workers.dev/
IP
104.21.68.158
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-18 19:02:06
Access
public
Website Title
DocuSign - Login
Final URL
workers-playground-red-credit-596b.dominickm.workers.dev/
Tags
phishing
urlquery detections
Phishing - Generic phishing

Detections

urlquery
3
Network Intrusion Detection
3
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
noon-working-oil.glitch.me	unknown	2008-07-18	2023-04-19	2023-07-14	455 B	86 kB	54.234.253.124
ada978-docusign.webnotifications.net	unknown	unknown	No data	No data	997 B	5.9 kB	52.64.150.111
stackpath.bootstrapcdn.com	2467	2012-05-25	2018-06-15	2024-04-18	477 B	22 kB	104.18.10.207
workers-playground-red-credit-596b.dominickm.workers.dev	unknown	2019-02-08	2023-12-14	2024-04-18	513 B	16 kB	104.21.68.158

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-18 19:01:40	low	Client IP	104.21.68.158	ET INFO Observed Cloudflare workers.dev Domain in TLS SNI
2024-04-18 19:01:41	medium	Client IP	54.234.253.124	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2024-04-18 19:01:41	low	Client IP	54.234.253.124	ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	workers-playground-red-credit-596b.dominickm.workers.dev/	DocuSign

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	noon-working-oil.glitch.me/jquery.min.js	86 kB	2023-03-07	2024-05-01
Pretty URL noon-working-oil.glitch.me/jquery.min.js IP 54.234.253.124 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:18 Last Seen2024-05-01 10:14:40 Times Seen4115 Hash b354cc9d56a1da6b0c77604d1b153850 a3d8479f4d4e39b131bc9a53bbf53d1fbaa23732 fdce77a6d0053f32d231518a84a71bcab5c86045ed52369da00b89d4284aef46 Loading...

	stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	51 kB	2023-03-07	2024-05-01
Pretty URL stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js IP 104.18.10.207 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:44 Last Seen2024-05-01 18:49:05 Times Seen245979 Hash 67176c242e1bdc20603c878dee836df3 27a71b00383d61ef3c489326b3564d698fc1227c 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Loading...

	workers-playground-red-credit-596b.dominickm.workers.dev/	6.0 kB	2023-03-07	2024-04-30
Pretty URL workers-playground-red-credit-596b.dominickm.workers.dev/ IP 104.21.68.158 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:10:27 Last Seen2024-04-30 23:48:26 Times Seen741 Hash 36bb41434655cf561f77987b521868e4 859b75d2e2e6eb0ff665e4ce3c3aa4d0f26d45ba 7853623597c83d5420b041e662614eddbe69a1f978214d7f4f90fcf27f8248b4 Loading...

	workers-playground-red-credit-596b.dominickm.workers.dev/	135 B	2023-03-07	2024-04-30
Pretty URL workers-playground-red-credit-596b.dominickm.workers.dev/ IP 104.21.68.158 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:10:28 Last Seen2024-04-30 23:48:26 Times Seen954 Hash 6d370053752bcccfea3a05ed1f958f00 dc27a1f8c079d10b6bcb12d934690d5ac13b8245 712b83e1fb7bba23edc0cad83735386653ae53ac4751130d8a1a32340eced84b Loading...

	workers-playground-red-credit-596b.dominickm.workers.dev/	4.1 kB	2024-04-18	2024-04-18
Pretty URL workers-playground-red-credit-596b.dominickm.workers.dev/ IP 104.21.68.158 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 21:02:12 Last Seen2024-04-18 21:02:12 Times Seen1 Hash c0303cdfe20ad6b84404d39fe189fe40 2f5fffe802eee84ca5fc01cf94f4a12d593410a1 1f51283d24193a56609b581ac320f3b3ef97e8e6337391a8a0424567cf9ff4b1 Loading...

HTTP Transactions (5)

URL IP Response Size

noon-working-oil.glitch.me/jquery.min.js

54.234.253.124

200 OK

86 kB

URL GET HTTP/2
noon-working-oil.glitch.me/jquery.min.js
IP
54.234.253.124:443
ASN
#14618 AMAZON-AES

Requested by
https://workers-playground-red-credit-596b.dominickm.workers.dev/
Certificate
IssuerAmazon
Subjectglitch.com
Fingerprint57:4F:13:8A:33:42:32:7C:F7:C9:C5:1F:DF:C1:35:65:F0:E9:70:EE
ValidityMon, 04 Dec 2023 00:00:00 GMT - Wed, 01 Jan 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (32065)
Size
86 kB (85577 bytes)
Hash
b354cc9d56a1da6b0c77604d1b153850
a3d8479f4d4e39b131bc9a53bbf53d1fbaa23732
fdce77a6d0053f32d231518a84a71bcab5c86045ed52369da00b89d4284aef46

HTTP Headers

GET /jquery.min.js HTTP/1.1
Host: noon-working-oil.glitch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://workers-playground-red-credit-596b.dominickm.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 19:01:41 GMT
content-type: application/javascript; charset=utf-8
content-length: 85577
x-amz-id-2: uLDUzLK1TV8mEuCuA58UnfbIereAk1zPpHq1Fv/CQz1+/C6XsZZZg7bbg3sLaSQgAeELyjzdKZc=
x-amz-request-id: 06PJBQMMCDHKXPQ8
last-modified: Sat, 13 Apr 2024 15:48:09 GMT
etag: "b354cc9d56a1da6b0c77604d1b153850"
x-amz-server-side-encryption: AES256
cache-control: no-cache
x-amz-version-id: dWreIsAsRwHiwnOTDSutveXrvHop_CaG
accept-ranges: bytes
server: AmazonS3
X-Firefox-Spdy: h2

ada978-docusign.webnotifications.net/docusign/docusign-logo.png

52.64.150.111

200 OK

4.1 kB

URL GET HTTP/2
ada978-docusign.webnotifications.net/docusign/docusign-logo.png
IP
52.64.150.111:443
ASN
#16509 AMAZON-02

Requested by
https://workers-playground-red-credit-596b.dominickm.workers.dev/
Certificate
IssuerAmazon
Subjectauthwebmail.com
Fingerprint13:72:25:EB:82:06:5B:FF:0F:6A:C4:E1:89:3C:1C:D2:F2:36:12:DF
ValiditySun, 11 Jun 2023 00:00:00 GMT - Wed, 10 Jul 2024 23:59:59 GMT

File type
PNG image data, 200 x 56, 8-bit/color RGBA, non-interlaced
Size
4.1 kB (4064 bytes)
Hash
56077a70a39ff955a7276ba1768d8bed
15042bb7f06c0db23eadbd4bcd48b92c6c694989
e83f8d0b4a78d14185abfca96ee2fbaf18e396a047f725d944ff27a845787279

HTTP Headers

GET /docusign/docusign-logo.png HTTP/1.1
Host: ada978-docusign.webnotifications.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://workers-playground-red-credit-596b.dominickm.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 19:01:41 GMT
content-type: image/png
content-length: 4064
server: nginx
accept-ranges: bytes
etag: "1d85c79f04ff9e0"
last-modified: Sat, 30 Apr 2022 10:06:20 GMT
X-Firefox-Spdy: h2

ada978-docusign.webnotifications.net/favicon.svg

52.64.150.111

200 OK

1.4 kB

URL GET HTTP/2
ada978-docusign.webnotifications.net/favicon.svg
IP
52.64.150.111:443
ASN
#16509 AMAZON-02

Requested by
https://workers-playground-red-credit-596b.dominickm.workers.dev/
Certificate
IssuerAmazon
Subjectauthwebmail.com
Fingerprint13:72:25:EB:82:06:5B:FF:0F:6A:C4:E1:89:3C:1C:D2:F2:36:12:DF
ValiditySun, 11 Jun 2023 00:00:00 GMT - Wed, 10 Jul 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
1.4 kB (1398 bytes)
Hash
b428a89a67a053edb1d6c863fa47e5e2
fefbe6ba8aeda1ff8e63e909498d18ea341b9f28
3c214612955b892f372c18d5706ece732e9cfd5936fb0b59f8b8e469f6f5bc21

HTTP Headers

GET /favicon.svg HTTP/1.1
Host: ada978-docusign.webnotifications.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://workers-playground-red-credit-596b.dominickm.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Thu, 18 Apr 2024 19:01:42 GMT
content-type: image/svg+xml
content-length: 1398
server: nginx
accept-ranges: bytes
etag: "1d82ee0fd05d276"
last-modified: Thu, 03 Mar 2022 09:28:06 GMT
X-Firefox-Spdy: h2

stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

104.18.10.207

200 OK

22 kB

URL GET HTTP/2
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
IP
104.18.10.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://workers-playground-red-credit-596b.dominickm.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint57:B4:25:B9:9C:88:A1:A3:3D:F7:31:74:02:E4:D1:E0:0A:F5:11:63
ValidityWed, 27 Mar 2024 00:22:09 GMT - Tue, 25 Jun 2024 00:22:08 GMT

File type
JavaScript source, ASCII text, with very long lines (50758)
Size
22 kB (21627 bytes)
Hash
67176c242e1bdc20603c878dee836df3
27a71b00383d61ef3c489326b3564d698fc1227c
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

HTTP Headers

GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1
Host: stackpath.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://workers-playground-red-credit-596b.dominickm.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 19:01:41 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
cdn-cachedat: 11/15/2021 23:30:00
cdn-proxyver: 1.0
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 723
cdn-status: 200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-requestid: a35b0179a28ed953258d0fb41376a09c
cdn-cache: HIT
cf-cache-status: HIT
age: 1381502
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 8766e7a3aa960b59-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

workers-playground-red-credit-596b.dominickm.workers.dev/

104.21.68.158

200 OK

15 kB

URL User Request GET HTTP/2
workers-playground-red-credit-596b.dominickm.workers.dev/
IP
104.21.68.158:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectdominickm.workers.dev
FingerprintCF:07:1C:27:70:07:D4:D1:23:C4:1F:A0:36:0F:B8:CE:90:65:A7:7F
ValiditySat, 30 Mar 2024 12:16:49 GMT - Fri, 28 Jun 2024 12:16:48 GMT

File type
HTML document, ASCII text, with very long lines (316)
Size
15 kB (15364 bytes)
Hash
847177dcdb3ad0755d807348282b30a8
2cdedaec7bb2bbdac17310e4579c98f789b5c481
0967c7ce43f94fc0fff220c107a7d024c13d609d5efcddbc4ab8b500f0a38db0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic phishing
OpenPhish	phishing	DocuSign

HTTP Headers

GET / HTTP/1.1
Host: workers-playground-red-credit-596b.dominickm.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 19:01:40 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WFsydygmpfOSpil%2Fm9ckj%2B7sAucOMkeBumovygk2oAsXt0HZjz0fI2CkItjtLdwsWrx9s5zuYifSEgmag555POqiy3DFAvnkk49dJavsk7KBXNyRAq1PmI9CX4OpXQGnLgyhAZN13uI6HeT0Pw506h5K2uW2pUj%2F8AgPk4xiyzjDpcqsCukry%2FIjYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8766e7a20d0956b5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (5)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers