Report - pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html

Report Overview

Submitted URL
pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html
IP
104.18.3.35
ASN
#13335 CLOUDFLARENET
Submitted
2024-05-11 03:17:24
Access
public
Website Title
Sign in to your account
Final URL
pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
logincdn.msauth.net	2330	unknown	No data	No data	476 B	18 kB	13.107.213.53
pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev	unknown	unknown	No data	No data	506 B	273 kB	104.18.3.35
code.jquery.com	634	unknown	No data	No data	496 B	34 kB	151.101.130.137
ocsp.r2m03.amazontrust.com	unknown	unknown	No data	No data	338 B	863 B	143.204.53.97
cdn.mcauto-images-production.sendgrid.net	27953	unknown	No data	No data	531 B	43 kB	54.230.111.91

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-05-10	medium	pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html	Outlook

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	code.jquery.com/jquery-1.12.4.min.js	97 kB	2023-03-07	2024-05-23
Pretty URL code.jquery.com/jquery-1.12.4.min.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:06 Last Seen2024-05-23 04:38:08 Times Seen120158 Hash 4f252523d4af0b478c810c2547a63e19 5a9dcfbef655a2668e78baebeaa8dc6f41d8dabb 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Loading...

	pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html	15 kB	2024-05-11	2024-05-11
Pretty URL pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html IP 104.18.3.35 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-05-11 05:17:44 Last Seen2024-05-11 05:17:44 Times Seen1 Hash 3bf9a6eea7640a4921c11718ab5dbbe2 5872eb8a1c1376445a33b2fa25bef9cb04f3951b 2208028ef063341ea2a3a92b6bc49d5e12be76b63cc3496b983581367e5f3b4e Loading...

HTTP Transactions (5)

URL IP Response Size

pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html

104.18.3.35

200 OK

273 kB

URL User Request GET HTTP/1.1
pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html
IP
104.18.3.35:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint48:74:F0:98:E0:A1:57:3E:86:18:BF:B3:DC:C9:7A:5B:53:50:FE:E0
ValidityFri, 05 Apr 2024 15:25:24 GMT - Thu, 04 Jul 2024 15:25:23 GMT

File type
HTML document, ASCII text, with very long lines (65313), with CRLF line terminators
Size
273 kB (273133 bytes)
Hash
7ac8e62795bc69d1ef3b89fb47c8f47b
ff23fa788599fce299145b495e537d443046ef1a
9d35c09171c68e6651bad91b18d183b1c612114e56afdeeacb1532eb0e7a08e6

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Outlook

HTTP Headers

GET /sm3.html HTTP/1.1
Host: pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 11 May 2024 01:53:12 GMT
Content-Type: text/html
Content-Length: 273133
Connection: keep-alive
Accept-Ranges: bytes
ETag: "7ac8e62795bc69d1ef3b89fb47c8f47b"
Last-Modified: Mon, 08 Apr 2024 14:36:14 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 881e88b279c50b02-OSL

code.jquery.com/jquery-1.12.4.min.js

151.101.130.137

200 OK

34 kB

URL GET HTTP/2
code.jquery.com/jquery-1.12.4.min.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (32077)
Size
34 kB (33738 bytes)
Hash
4f252523d4af0b478c810c2547a63e19
5a9dcfbef655a2668e78baebeaa8dc6f41d8dabb
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

HTTP Headers

GET /jquery-1.12.4.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-17b8b"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sat, 11 May 2024 01:53:12 GMT
age: 382211
x-served-by: cache-lga21956-LGA, cache-hel1410020-HEL
x-cache: HIT, HIT
x-cache-hits: 25, 61016
x-timer: S1715392393.770530,VS0,VE0
vary: Accept-Encoding
content-length: 33738
X-Firefox-Spdy: h2

ocsp.r2m03.amazontrust.com/

143.204.53.97

471 B

URL
ocsp.r2m03.amazontrust.com/
IP
143.204.53.97:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
abce99cdbd75db4ca4d2b4f661a971b3
8218b899cda22e088d6bf658c0c25947041cefaa
5f2f0d7a0d9ddf24dbe30ec081d3bb561838002ba356bbee5142ad84c01fbf8b

HTTP Headers

POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Sat, 11 May 2024 01:53:13 GMT
Server: ECAcc (amb/6B38)
X-Cache: Miss from cloudfront
Via: 1.1 f66e3db0f0449307dba3fbf72bbf3bac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: m5fbsSXizewsnyJH_eQzALVkb6Ef6NSaMVfrfLVorB0qf5yyjY2ooA==

cdn.mcauto-images-production.sendgrid.net/32724a092ad701f7/c6e2282d-8a53-44c8-9b7c-262b2479f731/1366x768.jpg

54.230.111.91

200 OK

42 kB

URL GET HTTP/2
cdn.mcauto-images-production.sendgrid.net/32724a092ad701f7/c6e2282d-8a53-44c8-9b7c-262b2479f731/1366x768.jpg
IP
54.230.111.91:443
ASN
#16509 AMAZON-02

Requested by
https://pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html
Certificate
IssuerAmazon
Subjectcdn.mcauto-images-production.sendgrid.net
Fingerprint76:6B:A2:A4:D3:DD:37:97:91:8B:BB:00:E6:9E:B7:39:6F:94:1A:9E
ValidityTue, 19 Mar 2024 00:00:00 GMT - Wed, 16 Apr 2025 23:59:59 GMT

File type
JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Windows), datetime=2020:08:31 21:49:19], progressive, precision 8, 1366x768, components 3
Size
42 kB (42147 bytes)
Hash
4860b3f5c2527b01beb37df985da7005
cbc935483ba7350a1f99e43eb4a6e5f04fdb1500
e61d76a5ce6532cc01241cdb4028157ed3c5f3a3d45cb0f0e01f3a961d3a7c01

HTTP Headers

GET /32724a092ad701f7/c6e2282d-8a53-44c8-9b7c-262b2479f731/1366x768.jpg HTTP/1.1
Host: cdn.mcauto-images-production.sendgrid.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/jpg
content-length: 42147
x-amz-replication-status: COMPLETED
last-modified: Tue, 06 Dec 2022 19:35:28 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: Oi_6xlGs.xNJjdxbYqfuqHOtn.w5p7RR
accept-ranges: bytes
server: AmazonS3
date: Sat, 11 May 2024 01:53:13 GMT
etag: "4860b3f5c2527b01beb37df985da7005"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 92c4bb210eab82a152000047d3609a02.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 4-FUvBOkf91IlgJNkikNnmj_9CEw1qsubvCbWS3MDym9rFKLSTrjIA==
age: 111
X-Firefox-Spdy: h2

logincdn.msauth.net/16.000.28799.4/images/favicon.ico

13.107.213.53

200 OK

17 kB

URL GET HTTP/2
logincdn.msauth.net/16.000.28799.4/images/favicon.ico
IP
13.107.213.53:443
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/sm3.html
Certificate
IssuerMicrosoft Corporation
Subjectidentitycdn.msauth.net
Fingerprint8F:BB:C6:02:63:00:DB:52:8E:2F:75:54:B7:75:9D:43:C4:31:CF:5B
ValidityThu, 11 Apr 2024 16:30:31 GMT - Sun, 06 Apr 2025 16:30:31 GMT

File type
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Size
17 kB (17174 bytes)
Hash
12e3dac858061d088023b2bd48e2fa96
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

HTTP Headers

GET /16.000.28799.4/images/favicon.ico HTTP/1.1
Host: logincdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-f6a866cbccb442b590c1f061f4abf9a5.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 11 May 2024 01:53:13 GMT
content-type: image/x-icon
content-length: 17174
cache-control: public, max-age=31536000
last-modified: Thu, 15 Oct 2020 04:33:48 GMT
etag: 0x8D870C382AA9C3D
x-ms-request-id: 17a3a688-401e-000a-0b45-a3eb8b000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240511T015313Z-er15bb998b7dzfrgu6mmp2sphn00000006ug000000005a0w
x-fd-int-roxy-purgeid: 67912908
x-cache: TCP_MISS
accept-ranges: bytes
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (5)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate