Report - pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/1Sharepointfile.html

Report Overview

Submitted URL
pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/1Sharepointfile.html
IP
104.18.2.35
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-20 15:56:39
Access
public
Website Title
Sign | SharePoint
Final URL
pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/1Sharepointfile.html
Tags
phishing
urlquery detections
Phishing - Generic phishing

Detections

urlquery
2
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev	unknown	2022-08-23	2023-11-14	2024-03-16	1.0 kB	360 kB	104.18.3.35
code.jquery.com	634	2005-12-10	2012-05-21	2024-04-19	433 B	80 kB	151.101.130.137
icons.iconarchive.com	80681	2000-08-02	2012-06-20	2024-04-17	451 B	4.7 kB	104.21.235.214

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-20	medium	pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/1Sharepointfile.html	Office365

PhishTank

Scan Date	Severity	Indicator	Alert
2023-11-15	medium	pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/1Sharepointfile.html	Other

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-20	medium	pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev	Sinkholed
2024-04-20	medium	pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/1Sharepointfile.html	333 kB	2023-11-15	2024-04-20
Pretty URL pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/1Sharepointfile.html IP 104.18.3.35 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-15 04:00:28 Last Seen2024-04-20 17:56:39 Times Seen8 Hash 0c8f05c5c1929c0938dc07c3c2e2a21e 0e187846e61106bd64110aa0703bba1b00a320c9 bd90bd90d693edd02c45cdb53d38f5af7a26f860850b2bcc86554fc0491f4164 Loading...

	unknown	636 B	2023-11-15	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-15 04:00:28 Last Seen2024-04-20 17:56:39 Times Seen8 Hash 293d28ef8f583d8b35d1f2efdda3fce1 ebac25967df06dba563456754f9c865f6ca08280 eb61f80eac8bc42d24a04b7b0cac10ed8fdfa62589a836d4360fcd63e8fa4bae Loading...

	code.jquery.com/jquery-1.9.1.js	268 kB	2023-03-07	2024-05-03
Pretty URL code.jquery.com/jquery-1.9.1.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:57 Last Seen2024-05-03 18:07:04 Times Seen43995 Hash 08c235d357750c657ac1db7d1cf656a9 9257afd2d46c3a189ec0d40a45722701d47e9ca5 7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40 Loading...

	unknown	1.6 kB	2023-11-15	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-15 04:00:28 Last Seen2024-04-20 17:56:39 Times Seen8 Hash 7c5dd8ec8ed6515dc96e36a2ee51e5ec f23f3af8da224aa87aa8ca1c03d76214ebd2da75 2bd1a0bc85aa02daff4285f058ad0ed278091b984d5c36b92eadd801d7b21add Loading...

		Size	First Seen	Last Seen
	#1 Write - 7604f20561146d1799b3135d69a2a216	37 kB	2023-11-15	2024-04-20
Pretty Observations First Seen2023-11-15 04:00:28 Last Seen2024-04-20 17:56:39 Times Seen8 Hash 7604f20561146d1799b3135d69a2a216 9d37d886283605f1d2ae6571d0e8b59331215d90 62ca5977ed2fc6cffece4352046d48e981d50165be04d7b6ff4fe53e5cdbf93d Loading...

HTTP Transactions (4)

URL IP Response Size

pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/1Sharepointfile.html

104.18.3.35

333 kB

URL
pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/1Sharepointfile.html
IP
104.18.3.35:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with very long lines (65423), with CRLF line terminators
Size
333 kB (332711 bytes)
Hash
dce78aae8ed6432020bfe3981d35d9d4
28a2679c5565f6d61f822d3d1b51a4c10762064b
55ad7c37469877530f4ee051f75e62d9b0dea1c42351d44b1ee92240268cfab7

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Office365
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /1Sharepointfile.html HTTP/1.1
Host: pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:56:13 GMT
Content-Type: text/html
Content-Length: 332711
Connection: keep-alive
Accept-Ranges: bytes
ETag: "dce78aae8ed6432020bfe3981d35d9d4"
Last-Modified: Tue, 14 Nov 2023 03:52:42 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 877652b7ea97b4eb-OSL

pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/index_files/myscr584876.js.download

104.18.3.35

27 kB

URL
pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/index_files/myscr584876.js.download
IP
104.18.3.35:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with very long lines (611)
Size
27 kB (27242 bytes)
Hash
df3d48946e8d3f5a83608308edbb4b86
47b9c40c97abf2658df96b1c06109324e15e1a00
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /index_files/myscr584876.js.download HTTP/1.1
Host: pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/1Sharepointfile.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Sat, 20 Apr 2024 15:56:14 GMT
Content-Type: text/html
Content-Length: 27242
Connection: keep-alive
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 877652bcbef2b4eb-OSL

code.jquery.com/jquery-1.9.1.js

151.101.130.137

80 kB

URL
code.jquery.com/jquery-1.9.1.js
IP
151.101.130.137:0
ASN
#54113 FASTLY

File type
JavaScript source, ASCII text
Size
80 kB (79506 bytes)
Hash
08c235d357750c657ac1db7d1cf656a9
9257afd2d46c3a189ec0d40a45722701d47e9ca5
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

HTTP Headers

GET /jquery-1.9.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-879dfae7067b41799a1f30a5d0d62a22.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-4185d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sat, 20 Apr 2024 15:56:14 GMT
age: 8204435
x-served-by: cache-lga21952-LGA, cache-hel1410031-HEL
x-cache: HIT, HIT
x-cache-hits: 31, 64395
x-timer: S1713628574.280699,VS0,VE0
vary: Accept-Encoding
content-length: 79506
X-Firefox-Spdy: h2

icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png

104.21.235.214

4.0 kB

URL
icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png
IP
104.21.235.214:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Size
4.0 kB (4033 bytes)
Hash
3a583cb9b1e02f29498c63dcf6422f68
dc055fd8bc58c384e2d00a677d9581acf5e4775e
98af5967761222708dc79f43df493e4cc2e085376bf8d50be5560d6c6e1fa7de

HTTP Headers

GET /icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png HTTP/1.1
Host: icons.iconarchive.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 20 Apr 2024 15:56:14 GMT
content-type: image/png
content-length: 4033
last-modified: Tue, 07 Feb 2023 10:06:28 GMT
etag: "63e222a4-fc1"
cache-control: max-age=5356800
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yj4QVYpny7O34BAABfcN%2BAExbhLBCijxDEPVSLSKm2wdKANJJlF56yJMYwbIuzQj%2B6nPXnMTUjTJ8cH5cYerilubaJRGEKk47i0R1ratm70hUpAbx%2FSAVj86VJl0c%2FCrk9C6BPZ8Ppc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 877652be8fb94c7e-HEL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (4)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash