Report - mailo-ao1.quaryr.workers.dev/

Report Overview

Submitted URL
mailo-ao1.quaryr.workers.dev/
IP
172.67.156.216
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-25 16:23:50
Access
public
Website Title
AOL
Final URL
mailo-ao1.quaryr.workers.dev/
Tags
phishing suspicious
urlquery detections
Phishing - Generic phishing
Suspicious - Suspicious Javascript code

Detections

urlquery
11
Network Intrusion Detection
1
Threat Detection Systems
12

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
mailo-ao1.quaryr.workers.dev	unknown	unknown	No data	No data	1.4 kB	155 kB	172.67.156.216
img.icons8.com	28959	unknown	2017-05-26	2024-04-24	456 B	2.1 kB	185.76.9.19

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-25 16:23:24	low	Client IP	172.67.156.216	ET INFO Observed Cloudflare workers.dev Domain in TLS SNI

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	mailo-ao1.quaryr.workers.dev/	AOL Inc.
2024-04-25	medium	mailo-ao1.quaryr.workers.dev/	AOL Inc.
2024-04-25	medium	mailo-ao1.quaryr.workers.dev/	AOL Inc.

PhishTank

Scan Date	Severity	Indicator	Alert
2024-04-01	medium	mailo-ao1.quaryr.workers.dev/	AOL
2024-04-01	medium	mailo-ao1.quaryr.workers.dev/style.css	AOL
2024-04-01	medium	mailo-ao1.quaryr.workers.dev/favicon.ico	AOL

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	mailo-ao1.quaryr.workers.dev/	66 kB	2024-03-25	2024-04-25
Pretty URL mailo-ao1.quaryr.workers.dev/ IP 172.67.156.216 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-25 19:05:05 Last Seen2024-04-25 18:23:56 Times Seen3 Hash 57acd50377e159cb3981b6cca843ee8d 770bfb2a2510e4b309e1e232e92b0890f8f5ee08 345d38b4643cb0e965476b4c7cd9714265da992ebd1fe35d911901783ff72679 Loading...

	unknown	61 kB	2024-03-25	2024-04-25
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-25 19:05:05 Last Seen2024-04-25 18:23:56 Times Seen3 Hash abe87238aab08c70787180fa7a88c87f 5f61b23eccdc4796f06837c125300b73d40574fe 1224100c732f2fbe8b842cac47d9d4b7017bc9e0666989a92d09c9ce0c0753b0 Loading...

	unknown	56 kB	2024-03-25	2024-04-25
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-25 19:05:05 Last Seen2024-04-25 18:23:56 Times Seen3 Hash 8450016e8a45fa9a893c18a14c61ce65 d3f48412ff3cf8e636f4bc403f329193eb55509c aa389adca0e926df8d8cb6508cb6d715d186f8643f6b255121756b13b2f80b10 Loading...

	unknown	1.5 kB	2024-03-25	2024-04-25
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-25 19:05:05 Last Seen2024-04-25 18:23:56 Times Seen3 Hash 15f1303b8e5f05674b994249c94e4daf 7012d57626f915aa383ff61319fb64d78284c719 008c9d5df9367e0b7cd9ddab0221b1007143097994381d20b7ebd596c3d55640 Loading...

		Size	First Seen	Last Seen
	#1 Write - 9c128152f5f8894082288919c40bd86b	56 kB	2024-03-25	2024-04-25
Pretty Observations First Seen2024-03-25 19:05:06 Last Seen2024-04-25 18:23:56 Times Seen3 Hash 9c128152f5f8894082288919c40bd86b d9af13a0ba82b1bf70a58ff56951452e2458594c 97d98c9615762b33c89e2b6bd2c897fac0910b970f9128a632f899ba92a5f4d0 Loading...

	#2 Write - 144dbd4892f6f48bc5477c2461769b4a	52 kB	2024-03-25	2024-04-25
Pretty Observations First Seen2024-03-25 19:05:06 Last Seen2024-04-25 18:23:56 Times Seen3 Hash 144dbd4892f6f48bc5477c2461769b4a 15419ed11af1b5c2ea35077829a2bb75fe6ba06e 30e28596f19337a97d929a2e5ee093a49ccc1871130a8bb80c8ba6a0f7332141 Loading...

	#3 Write - 80c46a135edee3c66d649855cf03bc25	61 kB	2024-03-25	2024-04-25
Pretty Observations First Seen2024-03-25 19:05:06 Last Seen2024-04-25 18:23:56 Times Seen3 Hash 80c46a135edee3c66d649855cf03bc25 52a1a29b89ff6f59d33c7364ab8176650d8fde40 7aefadafadd092f07778e8c1e857155d8c94f52a567418a7860910b4e0302201 Loading...

HTTP Transactions (4)

URL IP Response Size

mailo-ao1.quaryr.workers.dev/

172.67.156.216

200 OK

22 kB

URL User Request GET HTTP/2
mailo-ao1.quaryr.workers.dev/
IP
172.67.156.216:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectquaryr.workers.dev
FingerprintEF:EB:13:74:C7:AA:5E:23:00:84:00:56:96:91:6C:06:7D:59:0C:37
ValidityMon, 22 Apr 2024 11:46:05 GMT - Sun, 21 Jul 2024 11:46:04 GMT

File type
HTML document, ASCII text, with very long lines (65500)
Size
22 kB (21596 bytes)
Hash
7f557b9835fcf80d563cf1f2850ed681
7cb4f97e2efd22259fc018bd5eaafd3d671807de
bb7aa04f95ae31b082428e622b0815067016a219768f794982ecfca56d3d65e5

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code
OpenPhish	phishing	AOL Inc.
PhishTank	phishing	AOL

HTTP Headers

GET / HTTP/1.1
Host: mailo-ao1.quaryr.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 16:23:25 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XwVNUVx2EIRpsjgTAD4YDXKWdYWa6L236ZwCp9EY8b6M7FiUeGWaWetZuGnxYiG9ImgO5N%2F67Np%2FYGYThLRPhgtEXiMTmhwLlrkz%2F5Krfbed9dSo1MIFlaBQTJNeMahjZo%2FVxTNPG1jMqnV0apKV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879fad6d4b26b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mailo-ao1.quaryr.workers.dev/style.css

172.67.156.216

200 OK

66 kB

URL GET HTTP/3
mailo-ao1.quaryr.workers.dev/style.css
IP
172.67.156.216:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mailo-ao1.quaryr.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectquaryr.workers.dev
FingerprintEF:EB:13:74:C7:AA:5E:23:00:84:00:56:96:91:6C:06:7D:59:0C:37
ValidityMon, 22 Apr 2024 11:46:05 GMT - Sun, 21 Jul 2024 11:46:04 GMT

File type
HTML document, ASCII text, with very long lines (65500)
Size
66 kB (65751 bytes)
Hash
7f557b9835fcf80d563cf1f2850ed681
7cb4f97e2efd22259fc018bd5eaafd3d671807de
bb7aa04f95ae31b082428e622b0815067016a219768f794982ecfca56d3d65e5

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	AOL Inc.
PhishTank	phishing	AOL

HTTP Headers

GET /style.css HTTP/1.1
Host: mailo-ao1.quaryr.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mailo-ao1.quaryr.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 16:23:25 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yqmegb80hypcQrihJzaNv2EMfY4%2B7c0bqI3xUgyPCWe%2BJ%2B7ConWGyJ8U7BiieCTjKnH5303jkGKCfHDZRcjB1%2FzSeGG3K98TGk14bpTbszkBwAq8U1qceE5EosCulWmFlBpIkMvHQG0JpGNNHjeu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879fad6f3e6db4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

img.icons8.com/color/50/000000/google-logo.png

185.76.9.19

200 OK

1.3 kB

URL GET HTTP/2
img.icons8.com/color/50/000000/google-logo.png
IP
185.76.9.19:443
ASN
#60068 Datacamp Limited

Requested by
https://mailo-ao1.quaryr.workers.dev/
Certificate
IssuerLet's Encrypt
Subject1004834818.rsc.cdn77.org
FingerprintFD:9B:CD:AE:45:20:20:EA:0C:27:58:F8:5D:B3:8E:9F:51:11:5D:F6
ValiditySun, 14 Apr 2024 18:33:15 GMT - Sat, 13 Jul 2024 18:33:14 GMT

File type
PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Size
1.3 kB (1335 bytes)
Hash
45717104c188f613553aa17f989bd3ec
9160dfe7f936a53a76f1a5135212d7d6f07993ba
1a120e58f75551ccd9d96cdb3c285008a750de5c4eb18b66f2b036a588031955

HTTP Headers

GET /color/50/000000/google-logo.png HTTP/1.1
Host: img.icons8.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mailo-ao1.quaryr.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 16:23:25 GMT
content-type: image/png
content-length: 1335
vary: Origin
access-control-allow-origin: *
icon-id: 17949
icon-size: 50
icon-format: png
last-modified: Sat, 30 Mar 2024 22:46:06
version: 0.0.29
from-mongo-cache: true
from-redis-cache: false
not-found-platform: false
cache-control: public, max-age=302400
strict-transport-security: max-age=15724800; includeSubDomains
x-77-nzt: EwwBuUwJDQH3GbYCAAwBuUwKAQH3KAAAAAwB1GY4EQH3joIEAA
x-77-nzt-ray: c0a4cc2807ea3aae7d832a6674e82119
x-accel-expires: @1714186916
x-accel-date: 1713884516
x-77-cache: HIT
x-77-age: 177689
server: CDN77-Turbo
x-cache: HIT
x-age: 177689
x-77-pop: stockholmSE
accept-ranges: bytes
X-Firefox-Spdy: h2

mailo-ao1.quaryr.workers.dev/favicon.ico

172.67.156.216

200 OK

66 kB

URL GET HTTP/3
mailo-ao1.quaryr.workers.dev/favicon.ico
IP
172.67.156.216:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mailo-ao1.quaryr.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectquaryr.workers.dev
FingerprintEF:EB:13:74:C7:AA:5E:23:00:84:00:56:96:91:6C:06:7D:59:0C:37
ValidityMon, 22 Apr 2024 11:46:05 GMT - Sun, 21 Jul 2024 11:46:04 GMT

File type
HTML document, ASCII text, with very long lines (65500)
Size
66 kB (65751 bytes)
Hash
7f557b9835fcf80d563cf1f2850ed681
7cb4f97e2efd22259fc018bd5eaafd3d671807de
bb7aa04f95ae31b082428e622b0815067016a219768f794982ecfca56d3d65e5

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	AOL Inc.
PhishTank	phishing	AOL

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: mailo-ao1.quaryr.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mailo-ao1.quaryr.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 16:23:25 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hK2E5gFwzodrtFCDqCdBmsrTTHRAVNCI65GXu0RgyjkkE1TciZvymFyaTQUmDvt8TXBWHbypitch%2Bhyvkoabeq4vucPVOgvf3NP1ThxUr4RSLbYi20V3ZH8QV0yyoqXIobuXMF8tqE640Ie4cQ0u"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879fad702f36b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (4)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers