Report - green-shared-211d.ecormllhoi.workers.dev/4346576f-c31e-497a-8860-e05dc9349d39

Report Overview

Submitted URL
green-shared-211d.ecormllhoi.workers.dev/4346576f-c31e-497a-8860-e05dc9349d39
IP
172.67.217.241
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-20 06:10:03
Access
public
Website Title
blob:https://green-shared-211d.ecormllhoi.workers.dev/8f7cfa0b-c1d6-4fd5-952c-eb872a9d1cba
Final URL
green-shared-211d.ecormllhoi.workers.dev/8f7cfa0b-c1d6-4fd5-952c-eb872a9d1cba
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
1
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
code.jquery.com	634	2005-12-10	2012-05-21	2024-04-19	434 B	31 kB	151.101.66.137
green-shared-211d.ecormllhoi.workers.dev	unknown	2019-02-08	2023-08-17	2024-04-18	1.0 kB	2.8 MB	104.21.70.22

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-20 06:09:35	low	Client IP	104.21.70.22	ET INFO Observed Cloudflare workers.dev Domain in TLS SNI

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-19	medium	green-shared-211d.ecormllhoi.workers.dev/4346576f-c31e-497a-8860-e05dc9349d39	Office365
2024-04-19	medium	green-shared-211d.ecormllhoi.workers.dev/	Office365

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (10)

	URL	Size	First Seen	Last Seen
	green-shared-211d.ecormllhoi.workers.dev/8f7cfa0b-c1d6-4fd5-952c-eb872a9d1cba	1.7 MB	2023-11-16	2024-05-02
Pretty URL green-shared-211d.ecormllhoi.workers.dev/8f7cfa0b-c1d6-4fd5-952c-eb872a9d1cba IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-16 04:13:12 Last Seen2024-05-02 19:40:44 Times Seen272 Hash 22c10aa6cb9eeb71d2b1ce364b29b679 5058fae83f1c3e22e7e964216c1f15e9abdf8a80 1a2beeb0171a3c45ae24cfc8a05bbc24e3e122e3c2bc8c99e22dc7de72f982f6 Loading...

	unknown	1.5 MB	2023-11-16	2024-05-02
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-16 04:13:12 Last Seen2024-05-02 19:40:44 Times Seen272 Hash c220fc9c677a1a02cb049be5fe4bc5f7 720498c2c14e27eddf5762397d660fc174c28dca b6427abbfb6ff6f4f0d4bf297e4e98aefa4c3d9b73def1a567cf2139d587b337 Loading...

	unknown	34 B	2023-04-11	2024-05-03
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:16:40 Last Seen2024-05-03 13:33:49 Times Seen76003 Hash 572cb94037fffc2a0a53b465972e15f1 0d679b041a7c1ca45cc99e2d229fc2b86762838d 6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35 Loading...

	unknown	1.6 MB	2023-11-16	2024-05-02
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-16 04:13:12 Last Seen2024-05-02 19:40:44 Times Seen272 Hash c1c8ddf24c1f3123efb4e0333c6ca2c3 66b841c228e4674ca60e10bc0c0ce7df99456d6e 505c16e671d5e05213ec9e4e56e00accdd496c1839aa52e302f118c2bc815f98 Loading...

	unknown	141 kB	2023-07-23	2024-05-02
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-07-23 04:14:01 Last Seen2024-05-02 19:40:44 Times Seen4249 Hash e912ea3e9c1ad34e52f1a4093d1e0399 faec3a83fccbbae090e6c391fc4962c085f8181c 925e9cc12990a4c045cf7c28409e650f96381683a504217d8d8f2b71152a8cab Loading...

		Size	First Seen	Last Seen
	#1 Eval - 3d705a08bb8c5df4d0bcf9224b6377a2	1.6 MB	2023-11-16	2024-05-02
Pretty Observations First Seen2023-11-16 04:13:13 Last Seen2024-05-02 19:40:44 Times Seen272 Hash 3d705a08bb8c5df4d0bcf9224b6377a2 a38730d514d1d4ee3db5e92beaa7aa229ef1ebae 4f5cff1d2e5995fcee78f90013060b89e484d96621630b448c61d1a7e78576b4 Loading...

	#2 Eval - 6af91b5b0e6849430e0cc9df199da8a7	1.7 MB	2023-11-16	2024-05-02
Pretty Observations First Seen2023-11-16 04:13:13 Last Seen2024-05-02 19:40:44 Times Seen267 Hash 6af91b5b0e6849430e0cc9df199da8a7 a59b85ec08ccecd9ef661d3b9acaf1c0322000a8 965998be5068bae138a122b7e41ae88cc25d1d4141d27d221b11f33c36e314b4 Loading...

		Size	First Seen	Last Seen
	#1 Write - a778acf54eba1d35e4eb3b1d71d6d645	1.5 MB	2023-11-16	2024-05-02
Pretty Observations First Seen2023-11-16 04:13:13 Last Seen2024-05-02 19:40:44 Times Seen272 Hash a778acf54eba1d35e4eb3b1d71d6d645 120a778baafd26ae474817238933634999b124f6 0382a99515bed498c4c4143a99014b32da19420af437b7b84cf5b6b955816461 Loading...

	#2 Write - ae1707fa333c37163fcb2c33d7f165e7	1.6 MB	2023-11-16	2024-05-02
Pretty Observations First Seen2023-11-16 04:13:13 Last Seen2024-05-02 19:40:44 Times Seen272 Hash ae1707fa333c37163fcb2c33d7f165e7 7bc942cfea9f91d5bb4ec1a7794f2c3cc9c25e95 d7f1dd7192c6c00bde71f1661335624869e1ca938d7b346e4e42523b7eefa574 Loading...

	#3 Write - e905192ffde25f4a422cd9fd2f66a0eb	293 kB	2023-08-17	2024-05-02
Pretty Observations First Seen2023-08-17 11:32:18 Last Seen2024-05-02 19:40:44 Times Seen3160 Hash e905192ffde25f4a422cd9fd2f66a0eb 11baaac0302e49d88b21935e2672015bccde7cd1 390280e7bdaa350a888e72897212a8f6336201ba2ac7646fa320b56b47c05b96 Loading...

HTTP Transactions (3)

URL IP Response Size

code.jquery.com/jquery-3.4.1.min.js

151.101.66.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.4.1.min.js
IP
151.101.66.137:443
ASN
#54113 FASTLY

Requested by
https://green-shared-211d.ecormllhoi.workers.dev/4346576f-c31e-497a-8860-e05dc9349d39
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
31 kB (30638 bytes)
Hash
220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

HTTP Headers

GET /jquery-3.4.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://green-shared-211d.ecormllhoi.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15851"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sat, 20 Apr 2024 06:09:35 GMT
age: 5511873
x-served-by: cache-lga21965-LGA, cache-hel1410028-HEL
x-cache: HIT, HIT
x-cache-hits: 23, 512411
x-timer: S1713593376.819095,VS0,VE0
vary: Accept-Encoding
content-length: 30638
X-Firefox-Spdy: h2

green-shared-211d.ecormllhoi.workers.dev/4346576f-c31e-497a-8860-e05dc9349d39

104.21.70.22

200 OK

858 kB

URL User Request GET HTTP/2
green-shared-211d.ecormllhoi.workers.dev/4346576f-c31e-497a-8860-e05dc9349d39
IP
104.21.70.22:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectecormllhoi.workers.dev
Fingerprint8F:4D:2B:33:DA:A0:70:27:0D:33:97:4E:57:CD:C8:F6:38:CB:33:AE
ValidityFri, 12 Apr 2024 04:12:00 GMT - Thu, 11 Jul 2024 04:11:59 GMT

File type
HTML document, ASCII text, with very long lines (64871)
Size
858 kB (858121 bytes)
Hash
ec145552ddbf241a0e0a435e5e97ce9d
5191cbf45e75d905ca84abcbc8de69838d49238e
93dcf9142d96ebaaee3f15e62ba8b781954295c24d248a7bac023fe2eb7155c5

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Office365

HTTP Headers

GET /4346576f-c31e-497a-8860-e05dc9349d39 HTTP/1.1
Host: green-shared-211d.ecormllhoi.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 20 Apr 2024 06:09:35 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BYfB6GPcZkB3N8b0DTRC4EX57WAP0NHLU4fdQtA9sTVYaGXdCatWOsdPItTTlI0PpETDXuouWIkZZyjDaCDbXJzEYmXPu1jjFxKW8khQapWxkqYLupE4VSu6spjl%2FL%2FyXCtBuglBF2Xp7FnFBcBmKK3TtimCzPm1Csi0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772f7644c2756bf-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

green-shared-211d.ecormllhoi.workers.dev/favicon.ico

104.21.70.22

200 OK

1.9 MB

URL GET HTTP/3
green-shared-211d.ecormllhoi.workers.dev/favicon.ico
IP
104.21.70.22:443
ASN
#13335 CLOUDFLARENET

Requested by
https://green-shared-211d.ecormllhoi.workers.dev/4346576f-c31e-497a-8860-e05dc9349d39
Certificate
IssuerGoogle Trust Services LLC
Subjectecormllhoi.workers.dev
Fingerprint8F:4D:2B:33:DA:A0:70:27:0D:33:97:4E:57:CD:C8:F6:38:CB:33:AE
ValidityFri, 12 Apr 2024 04:12:00 GMT - Thu, 11 Jul 2024 04:11:59 GMT

File type

Size
1.9 MB (1900365 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Office365

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: green-shared-211d.ecormllhoi.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://green-shared-211d.ecormllhoi.workers.dev/4346576f-c31e-497a-8860-e05dc9349d39
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 20 Apr 2024 06:09:36 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KsaZzow5Vno6JbS4VSETHLbV4qFzMrXznxhVJjhgRP6zSoJlXB3kEBCBnWyFIXVT0WwXV0tqcYfSojV4UFwdalvjaDrMiA3YjHGfcaravAt69WkCzCmtBiK3zNtP4hUT5%2BPj8sd%2FAHO0x5Am57KNJaJlGKzhocMBTcEQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772f767ee0a56b5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (3)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP