Report - jkghjj.kolomo.workers.dev/

Report Overview

Submitted URL
jkghjj.kolomo.workers.dev/
IP
104.21.90.238
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-19 06:03:04
Access
public
Website Title
Online ID
Final URL
jkghjj.kolomo.workers.dev/
Tags
suspicious
urlquery detections
Suspicious - Suspicious Javascript code

Detections

urlquery
3
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
secure.bankofamerica.com	9182	1998-12-28	2013-01-30	2024-04-18	492 B	26 kB	171.161.118.200
jkghjj.kolomo.workers.dev	unknown	2019-02-08	2024-01-18	2024-03-25	939 B	19 kB	104.21.90.238

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	jkghjj.kolomo.workers.dev/	Bank of America
2024-04-18	medium	jkghjj.kolomo.workers.dev/	Bank of America

PhishTank

Scan Date	Severity	Indicator	Alert
2024-03-29	medium	jkghjj.kolomo.workers.dev/favicon.ico	Bank of America Corporation
2024-03-29	medium	jkghjj.kolomo.workers.dev/	Bank of America Corporation

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	jkghjj.kolomo.workers.dev/	0 B	2023-03-07	2024-05-02
Pretty URL jkghjj.kolomo.workers.dev/ IP 104.21.90.238 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-02 01:54:31 Times Seen37260632 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	unknown	1.2 kB	2024-03-25	2024-04-19
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-25 05:00:31 Last Seen2024-04-19 08:03:04 Times Seen2 Hash fe61617f7628f9aa8ab780497108a213 a727d3e3db338e917c584db8338130414c1dabd4 8d1febaf706958167dee6388db5f35c2e225334f9bd6a99cbc5d434c87953b5d Loading...

		Size	First Seen	Last Seen
	#1 Write - 66b0ee3643b57149f89145eccfc2a524	5.4 kB	2024-03-25	2024-04-19
Pretty Observations First Seen2024-03-25 05:00:31 Last Seen2024-04-19 08:03:04 Times Seen2 Hash 66b0ee3643b57149f89145eccfc2a524 857d64de2e6dd2d8616885d8646772271b169e2a fe179443857b53a7b6525efbb304cf23ceb1378256cc41b44a2b1026238a7e9d Loading...

HTTP Transactions (3)

URL IP Response Size

secure.bankofamerica.com/content/images/ContextualSiteGraphics/Logos/en_US/BofA_rgb.png

171.161.118.200

23 kB

URL GET
secure.bankofamerica.com/content/images/ContextualSiteGraphics/Logos/en_US/BofA_rgb.png
IP
171.161.118.200:0
ASN
#10794 BANKAMERICA

Requested by
https://jkghjj.kolomo.workers.dev/
Certificate
IssuerEntrust, Inc.
Subjectsecure.bankofamerica.com
Fingerprint29:F4:E3:07:86:4A:9B:FD:43:EB:6C:05:59:F1:76:8B:BE:41:F8:C1
ValidityThu, 28 Mar 2024 18:06:47 GMT - Mon, 28 Apr 2025 18:06:45 GMT

File type
PNG image data, 1520 x 170, 8-bit/color RGBA, non-interlaced
Size
23 kB (23389 bytes)
Hash
49bc9262c4a31f1ee2ca2dd5e1dc8588
5b145ba3666ffa9eded453160010567ccc24e8cc
30652cee5990b3b76f6cbf6f26362be9254dd62b4c6e6003c1127d1484573787

HTTP Headers

GET /content/images/ContextualSiteGraphics/Logos/en_US/BofA_rgb.png HTTP/1.1
Host: secure.bankofamerica.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jkghjj.kolomo.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Last-Modified: Tue, 05 Feb 2019 20:28:24 GMT
ETag: "99fe-5812b73724a00"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
X-BOA-RequestID: Zfih0cioJghl0ozBGDcjTwAAAbY
Keep-Alive: timeout=40, max=497
Content-Type: image/png
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self' *.bankofamerica.com *.bac-assets.com *.ml.com https: wss: data: blob:; script-src 'self' *.bankofamerica.com *.bac-assets.com *.ml.com fsa.merrilledge.com merrilledge.com s3.amazonaws.com boa-api.arkoselabs.com cdn.cookielaw.org resources.digital-cloud.medallia.com players.brightcove.net metrics.brightcove.com cdnapisec.kaltura.com tags.tiqcdn.com akamai.tiqcdn.com glance.net beta.glancecdn.net storage.glancecdn.net cct.google cdn.mplxtms.com cdn.tt.omtrdc.net data.cmcore.com data.coremetrics.com iocdn.coremetrics.com libs.coremetrics.com mc.coremetrics.com mcdata.coremetrics.com mktgcdn.coremetrics.com recs.coremetrics.com secure-cdn.mplxtms.com convertro.com stage.convertro.com idsync.rlcdn.com test.coremetrics.com testdata.coremetrics.com tmscdn.coremetrics.com www.glancecdn.net www.google-analytics.com maps.googleapis.com www.googletagmanager.com mboxedge34.tt.omtrdc.net anrdoezrs.net cj.dotomi.com cj.com cj.mplxtms.com emjcd.com mczbf.com sjwoe.com secure-cdn.mplxtms.com cdn.mplxtms.com bofa.demdex.net cdnstorage.myglance.net bankofamerica.tt.omtrdc.net www.paypalobjects.com cdn-bofa.myglance.net six.cdn-net.com vjs.zencdn.net 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' data: blob: *.bankofamerica.com *.bac-assets.com *.ml.com cdn.cookielaw.org glance.net beta.glancecdn.net storage.glancecdn.net convertro.com stage.convertro.com idsync.rlcdn.com www.glancecdn.net cdnstorage.myglance.net www.google-analytics.com cdn-bofa.myglance.net resources.digital-cloud.medallia.com 'unsafe-inline'; worker-src 'self' blob:; frame-ancestors 'self' *.bankofamerica.com *.ml.com;
X-Serviced-By: U+ptikAEUFLC5HGOBKdV1w==--b5iaOKc4TFDZ1TJsCxg4GQ==
Connection: Keep-Alive
Date: Fri, 19 Apr 2024 06:02:39 GMT
Age: 615
Content-Length: 23389
Server: Oops

jkghjj.kolomo.workers.dev/favicon.ico

104.21.90.238

200 OK

9.0 kB

URL GET HTTP/3
jkghjj.kolomo.workers.dev/favicon.ico
IP
104.21.90.238:443
ASN
#13335 CLOUDFLARENET

Requested by
https://jkghjj.kolomo.workers.dev/
Certificate
IssuerLet's Encrypt
Subjectkolomo.workers.dev
FingerprintCF:5C:6D:76:0D:0E:A5:48:42:4D:2F:C9:B4:AD:6A:C4:9A:E3:E6:7A
ValiditySun, 17 Mar 2024 16:58:45 GMT - Sat, 15 Jun 2024 16:58:44 GMT

File type
HTML document, ASCII text, with very long lines (9273)
Size
9.0 kB (8997 bytes)
Hash
c639ce7fe0c12e9a361dec8bd2af51f4
0ba0f4de78f8ec40b6b30f90fdc94145374475b6
eb1e77b9cfd4ee19bef1b136378307e0e3f445d3de8e0bc9e8fad52ef4f35ae1

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Bank of America
PhishTank	phishing	Bank of America Corporation

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: jkghjj.kolomo.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jkghjj.kolomo.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 19 Apr 2024 06:02:39 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wnz10ofyYHa8ihe0zN3dYGf1lKNgeRfgLIsPlBSwYnqYpgJoNjVRnWRKeHfDKIXJOo0bTiqNHh2q3tgY%2F1ZU8NSZYTEQmiAepAMty1ADxXD723WT7cbs6DmLpc6Xpv3SqRm64l9QoCcYDY1w"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876aafdb3f27b503-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

jkghjj.kolomo.workers.dev/

104.21.90.238

200 OK

9.3 kB

URL User Request GET HTTP/2
jkghjj.kolomo.workers.dev/
IP
104.21.90.238:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectkolomo.workers.dev
FingerprintCF:5C:6D:76:0D:0E:A5:48:42:4D:2F:C9:B4:AD:6A:C4:9A:E3:E6:7A
ValiditySun, 17 Mar 2024 16:58:45 GMT - Sat, 15 Jun 2024 16:58:44 GMT

File type
HTML document, ASCII text, with very long lines (9317), with no line terminators
Size
9.3 kB (9309 bytes)
Hash
21be8738824ac9471b965541dbc0c19d
b1106f463256a636660155aa625269cf0f9badd1
a43916961754b679df3f9124960db27beb8f2591763f825e2623699f7bb1d102

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Bank of America
PhishTank	phishing	Bank of America Corporation

HTTP Headers

GET / HTTP/1.1
Host: jkghjj.kolomo.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 06:02:38 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pnJQ6MJpvtgDW7eKMbNhTj%2FqDXe2ayZ8CMxmGb%2FL9xTSl8SF4WxfTNBRS45yXQEbC6yn13RkE%2BHtXJeeRb1xwnrUbZ77189lBv5hWC6y%2FRKbECsg4mt%2BC6jEA4mI5jVnrce%2FcxDYx03NYnEk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876aafd8ea6c56aa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (3)

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers