Report - val1d-upge.2zd4t4hkw.workers.dev/

Report Overview

Visited public
2024-08-03 10:37:08
Tags
phishing suspicious
URL
val1d-upge.2zd4t4hkw.workers.dev/
Finishing URL
val1d-upge.2zd4t4hkw.workers.dev/
IP / ASN
104.21.96.113
#13335 CLOUDFLARENET
Title
AT&T - Login
Phishing - Generic phishing
Suspicious - Suspicious Javascript code

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown				2.3 kB	6.2 kB	23.36.77.32
val1d-upge.2zd4t4hkw.workers.dev	unknown				921 B	29 kB	172.67.178.92

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-08-03 10:36:43	low	Client IP	172.67.178.92	ET INFO Observed Cloudflare workers.dev Domain in TLS SNI

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-08-02	medium	val1d-upge.2zd4t4hkw.workers.dev/	AT&T Inc.
2024-08-02	medium	val1d-upge.2zd4t4hkw.workers.dev/	AT&T Inc.

PhishTank

Scan Date	Severity	Indicator	Alert
2023-06-25	medium	val1d-upge.2zd4t4hkw.workers.dev/favicon.ico	AT&T
2023-06-25	medium	val1d-upge.2zd4t4hkw.workers.dev/style.css	AT&T

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	From	Size	First Seen	Last Seen
	val1d-upge.2zd4t4hkw.workers.dev/	ScriptElement	18 kB	2023-06-09	2024-08-29
Pretty URL val1d-upge.2zd4t4hkw.workers.dev/ IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-06-09 13:50 Last Seen2024-08-29 17:24 Times Seen9 Hash ba2452e8b4c7e3b294b0be0411643137 2eb49f85bdc1d7b13024923033a6ef92f349687b c6f73e185f45f1636aa1238db78b9607c60089b74909d50b85fdc553f297228d Loading...

	unknown	ScriptElement	14 kB	2023-06-09	2024-08-29
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-09 13:50 Last Seen2024-08-29 17:24 Times Seen9 Hash e9cd3e7183be5f3fb438820a819c7e8c a33ca1f175c052e5b6b2c96ab5876919fdfb5139 2b70d67bf9cabb78a056b4ca3b6d876ed88306dc84b56ee0a06f2849edffe488 Loading...

	unknown	ScriptElement	10 kB	2023-06-09	2024-08-29
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-09 13:50 Last Seen2024-08-29 17:24 Times Seen9 Hash b7b0bbf8bd87f39912ba91bf995d100b a414416a64a22a44635cf21db50c6f60b3eb66a4 2cd01a02a5f14aef86b52805ed04bd67fd5e235f3b06ecccd32803ccf8a29a66 Loading...

	unknown	ScriptElement	1.0 kB	2023-06-09	2024-08-29
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-09 13:50 Last Seen2024-08-29 17:24 Times Seen9 Hash 183e9141775d42c990360761141e208f cf643b5c87a203a22d781db056a204e2bd05d46c ba37113b00b087496dca42c31b62bb01ac89b0b44a9fab7942760a665280879a Loading...

		Size	First Seen	Last Seen
	#1 Write - 17506bf165b6215b2237372d4d7935d8	14 kB	2023-06-09 13:50	2024-08-29 17:24
Pretty Observations First Seen2023-06-09 13:50 Last Seen2024-08-29 17:24 Times Seen9 Hash 17506bf165b6215b2237372d4d7935d8 bfb08a42486d85174914e48964da0a62615d8a01 f1c1a8c98ccc7186026e07768a31efa25a44668b67906fbec88cf142f15edd17 Loading...

	#2 Write - 7ccb1aea49aacd2d3925e9adb24f44cd	10 kB	2023-06-09 13:50	2024-08-29 17:24
Pretty Observations First Seen2023-06-09 13:50 Last Seen2024-08-29 17:24 Times Seen9 Hash 7ccb1aea49aacd2d3925e9adb24f44cd 5dc5bca34067d47bc5e0d6a194ebf089b0252bda 6c0d13951c4e89800672213aec262e2a08a4ea4ae9154930a36c8cfe34dc07a7 Loading...

	#3 Write - 58010fb3e83fe9c9d4fb9be1ce2bcc85	6.4 kB	2023-06-09 13:50	2024-08-29 17:24
Pretty Observations First Seen2023-06-09 13:50 Last Seen2024-08-29 17:24 Times Seen9 Hash 58010fb3e83fe9c9d4fb9be1ce2bcc85 dd9e0291f039d59cafc272fc3744404b0f42172a 84dec83fd430043eb091214ff47cb16bf42738b359dde2d13f5f367f7db7e764 Loading...

HTTP Transactions (9)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
1fc39f9a6ccc25867cc2924e625282d0
f859354fa7202cd2f2cbd279ad12ab0358c638d1
037bd31a93556f0a88d519cc4629ca3f8fcc94ffc357a71d34a133e5943c3b96

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "037BD31A93556F0A88D519CC4629CA3F8FCC94FFC357A71D34A133E5943C3B96"
Last-Modified: Thu, 01 Aug 2024 06:28:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16581
Expires: Sat, 03 Aug 2024 15:13:04 GMT
Date: Sat, 03 Aug 2024 10:36:43 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
44e4b90088be23610d96d270d377406d
ce7ab232af453bb960a97435173b3ab09a376054
31567666bda7db348cd6e2ad94576da2c7240872f45e969fd6a52cf14440e95b

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "31567666BDA7DB348CD6E2AD94576DA2C7240872F45E969FD6A52CF14440E95B"
Last-Modified: Thu, 01 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12909
Expires: Sat, 03 Aug 2024 14:11:52 GMT
Date: Sat, 03 Aug 2024 10:36:43 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
b84a2e6efef529bac3e0d5dd309babe7
b22b4d0e8f84859a83b85939ae4c77d16fde0c93
9ed1020ce84380273c514b5c14a8705879d8233acaae13b428063bc7b83a067b

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "9ED1020CE84380273C514B5C14A8705879D8233ACAAE13B428063BC7B83A067B"
Last-Modified: Thu, 01 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13525
Expires: Sat, 03 Aug 2024 14:22:08 GMT
Date: Sat, 03 Aug 2024 10:36:43 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
06f86a556a3bc0d04f36267a3081f07f
3ca01a6761c66a9434a2ee060e2cb4b685b0b9f8
e9d373f8bcb454c3fc0b4e4d3768e5104c7f4cad03145468f9d2c0ff89c08143

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E9D373F8BCB454C3FC0B4E4D3768E5104C7F4CAD03145468F9D2C0FF89C08143"
Last-Modified: Thu, 01 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14209
Expires: Sat, 03 Aug 2024 14:33:33 GMT
Date: Sat, 03 Aug 2024 10:36:44 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
7b71bbce2c5e563fde3afb60497eb33b
ffe77143d7aae5b966b693211336919b872de46a
5d3fe5575b14f6f240e86c4c5065e8f3f79a6f20039efce544e7597166c1ae0f

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5D3FE5575B14F6F240E86C4C5065E8F3F79A6F20039EFCE544E7597166C1AE0F"
Last-Modified: Thu, 01 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11017
Expires: Sat, 03 Aug 2024 13:40:23 GMT
Date: Sat, 03 Aug 2024 10:36:46 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
7b71bbce2c5e563fde3afb60497eb33b
ffe77143d7aae5b966b693211336919b872de46a
5d3fe5575b14f6f240e86c4c5065e8f3f79a6f20039efce544e7597166c1ae0f

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5D3FE5575B14F6F240E86C4C5065E8F3F79A6F20039EFCE544E7597166C1AE0F"
Last-Modified: Thu, 01 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11017
Expires: Sat, 03 Aug 2024 13:40:23 GMT
Date: Sat, 03 Aug 2024 10:36:46 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
7b71bbce2c5e563fde3afb60497eb33b
ffe77143d7aae5b966b693211336919b872de46a
5d3fe5575b14f6f240e86c4c5065e8f3f79a6f20039efce544e7597166c1ae0f

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5D3FE5575B14F6F240E86C4C5065E8F3F79A6F20039EFCE544E7597166C1AE0F"
Last-Modified: Thu, 01 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11017
Expires: Sat, 03 Aug 2024 13:40:23 GMT
Date: Sat, 03 Aug 2024 10:36:46 GMT
Connection: keep-alive

val1d-upge.2zd4t4hkw.workers.dev/favicon.ico

172.67.178.92

200 OK

9.4 kB

URL GET HTTP/3
val1d-upge.2zd4t4hkw.workers.dev/favicon.ico
IP
172.67.178.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://val1d-upge.2zd4t4hkw.workers.dev/
Certificate
IssuerGoogle Trust Services
Subject2zd4t4hkw.workers.dev
FingerprintD6:1A:EA:47:53:25:D6:B4:59:AE:50:62:94:8B:E0:A3:0B:28:77:0C
ValidityTue, 11 Jun 2024 23:48:33 GMT - Mon, 09 Sep 2024 23:48:32 GMT

File type
HTML document, ASCII text, with very long lines (18144)
Size
9.4 kB (9354 bytes)
Hash
5e378e48c595a750fe4d3c89b749c6bd
1c9dd8e268b80ca5f103206883c640311e42420c
58251bfe50134c57bfa13e34f92827a37b684cbeb95cefddc2790470f9ce7611

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	AT&T Inc.
PhishTank	phishing	AT&T

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: val1d-upge.2zd4t4hkw.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://val1d-upge.2zd4t4hkw.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 03 Aug 2024 10:36:44 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZSqxe6WQqgnogy9zDi4Sho4ZpR0nWoebuK7Edt02jsfqqdjEo69SFjDuMEVDsZ1DlcFc6OIhKOTQfQfs%2FmkunDwKCkXuz7k8IRa3skp25Oy5uxw0MHOuPBNiVC5OBSuZsYo3SVP6FBcfXyE1071Y3a%2FAVw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8ad5ab19dd2b0b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

val1d-upge.2zd4t4hkw.workers.dev/style.css

172.67.178.92

200 OK

18 kB

URL GET HTTP/3
val1d-upge.2zd4t4hkw.workers.dev/style.css
IP
172.67.178.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://val1d-upge.2zd4t4hkw.workers.dev/
Certificate
IssuerGoogle Trust Services
Subject2zd4t4hkw.workers.dev
FingerprintD6:1A:EA:47:53:25:D6:B4:59:AE:50:62:94:8B:E0:A3:0B:28:77:0C
ValidityTue, 11 Jun 2024 23:48:33 GMT - Mon, 09 Sep 2024 23:48:32 GMT

File type
HTML document, ASCII text, with very long lines (18144)
Size
18 kB (18195 bytes)
Hash
5e378e48c595a750fe4d3c89b749c6bd
1c9dd8e268b80ca5f103206883c640311e42420c
58251bfe50134c57bfa13e34f92827a37b684cbeb95cefddc2790470f9ce7611

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	AT&T Inc.
PhishTank	phishing	AT&T

HTTP Headers

GET /style.css HTTP/1.1
Host: val1d-upge.2zd4t4hkw.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://val1d-upge.2zd4t4hkw.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 03 Aug 2024 10:36:44 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z%2F9dt08xUZRv7%2FnkHjCcgYg84zoOkou62uGMAiZ0uIH5KmeMQRNAO%2B9zTnhDaTqkvthbMNWUI8Ku3esl%2FJjYFDm%2B08%2FCEyoX3O1yPwB66d7NFqAPF9MDVBndyHG0H%2BVFHWqf%2BqxUVbDdlOGmkvcXzaaKtw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8ad5ab19bd150b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (9)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash