Report - skystorehub.com/wp/asdf/c21pbGxlckBkZW5jb2wuY29t

Report Overview

Visitedpublic

2024-02-05 18:22:23

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20 07:02:03	2024-02-05 13:19:31	983 B	52 kB	104.17.2.184
worksmatter.com	unknown	2024-02-01	2015-12-30 08:22:24	2024-02-03 05:28:10	1.0 kB	440 kB	170.205.52.168
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17 22:46:33	2024-02-05 08:41:12	1.0 kB	54 kB	104.17.24.14
code.jquery.com	634	2005-12-10	2012-05-21 19:28:02	2024-02-05 08:09:59	888 B	61 kB	151.101.194.137
aadcdn.msauth.net	1421	2018-10-25	2018-11-19 11:50:03	2024-02-05 05:43:41	1.6 kB	6.1 kB	13.107.213.53
skystorehub.com	unknown	2023-08-08	2023-08-08 21:09:15	2024-01-30 22:11:31	961 B	808 B	0.0.0.0
pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev	unknown	2022-08-23	2024-02-01 18:11:31	2024-02-03 18:43:02	1.6 kB	29 kB	104.18.3.35

Related reports

Network Intrusion Detection Systems

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-02-01	medium	pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html	Generic/Spear Phishing
2024-02-01	medium	pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html	Generic/Spear Phishing

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	From	Size	First Seen	Last Seen
	worksmatter.com/host/admin/js/sc.php?r=ZW0sZW1haWwsYWRk	ScriptElement	2.5 kB	2024-08-20	2024-08-20
URL worksmatter.com/host/admin/js/sc.php?r=ZW0sZW1haWwsYWRk IP / ASN 170.205.52.168 #397966 READYDEDISLLC Introduced by ScriptElement Embedded false Resource Info First Seen 2024-08-20 Last Seen 2024-08-20 Times Seen 1 Size 2.5 kB (2462 bytes) MD5 4bf24a8fd5e6f41f0b6676735db7c6f8 SHA1 55ea0b25bec79748d75240242788c8f67fd3aa14 SHA256 16fcca71e0d5817019d893293e29101c50fe3d9cebc19b8efa925768f0e99303 Format Code Loading...

	cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	ScriptElement	48 kB	2023-03-07	2025-08-05
URL cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js IP / ASN 104.17.24.14 #13335 CLOUDFLARENET Introduced by ScriptElement Embedded false Resource Info First Seen 2023-03-07 Last Seen 2025-08-05 Times Seen 58009 Size 48 kB (47992 bytes) MD5 cf3402d7483b127ded4069d651ea4a22 SHA1 bde186152457cacf9c35477b5bdda5bcb56b1f45 SHA256 eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc Format Code Loading...

	code.jquery.com/jquery-3.1.1.min.js	ScriptElement	87 kB	2023-03-07	2025-08-05
URL code.jquery.com/jquery-3.1.1.min.js IP / ASN 151.101.194.137 #54113 FASTLY Introduced by ScriptElement Embedded false Resource Info First Seen 2023-03-07 Last Seen 2025-08-05 Times Seen 119966 Size 87 kB (86709 bytes) MD5 e071abda8fe61194711cfc2ab99fe104 SHA1 f647a6d37dc4ca055ced3cf64bbc1f490070acba SHA256 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Format Code Loading...

	unknown	Function	41 B	2023-10-13	2025-08-01
URL IP / ASN 0.0.0.0 #0 Introduced by Function Embedded false Resource Info First Seen 2023-10-13 Last Seen 2025-08-01 Times Seen 46393 Size 41 B (41 bytes) MD5 396ca539065f260203342464a835e282 SHA1 ef8e56c5915475cfd5fac7f66d432b5283f5ae12 SHA256 aa20289c21d02af09587ea4acbccad1b330b649cf058a75434834e95dc721aca Format Code Loading...

	unknown	ScriptElement	11 kB	2024-01-08	2024-08-20
URL IP / ASN 0.0.0.0 #0 Introduced by ScriptElement Embedded false Resource Info First Seen 2024-01-08 Last Seen 2024-08-20 Times Seen 22847 Size 11 kB (11128 bytes) MD5 824b2adda825d9ce13f24c59c6a159e4 SHA1 2fcc87eb02848ad7b303999b3a0987806d43673f SHA256 11bc8b6ad796a66d4598ab1bd32c921a17471ff510096a09746db24353c3c69f Format Code Loading...

	challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	ScriptElement	38 kB	2024-01-22	2024-08-20
URL challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback IP / ASN 104.17.2.184 #13335 CLOUDFLARENET Introduced by ScriptElement Embedded false Resource Info First Seen 2024-01-22 Last Seen 2024-08-20 Times Seen 13694 Size 38 kB (38245 bytes) MD5 382de2d5802b5bd3d87cf2fb3071121d SHA1 d0299a88eb32dbc533d61b024ff6e35956113e29 SHA256 18cbe0edc0b01c71a6c3ffe704550a8bb1cfe7e02839b7dbdc9c44288bf8b59c Format Code Loading...

	HASH	FROM	Size	First Seen	Last Seen
	a858569a304d718afe5dfa3dea8c5f7f	DocumentWrite	254 kB	2024-02-03	2024-08-20
Introduced by DocumentWrite First Seen 2024-02-03 Last Seen 2024-08-20 Times Seen 3 Size 254 kB (254289 bytes) MD5 a858569a304d718afe5dfa3dea8c5f7f SHA1 39b93873b57fe7bf41ab10e3b172ce0653159383 SHA256 d32c58a6e27138fc390bee5fc1a3c64e619fcde76b035d13cfe10cbd7abcc059 Format Code Loading...

HTTP Transactions (16)

URL IP Response Size

pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html

104.18.3.35

653 B

URL HTTPS

pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html

IP / ASN

104.18.3.35

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with very long lines (653), with no line terminators

First Seen2024-02-03

Last Seen2024-08-20

Times Seen3

Size653 B (653 bytes)

MD56085f9981a606bae48f716cb36fd3ae3

SHA10eaac067beca104e96bedeeb9117036d6707a455

SHA256dc7d8c091742db2ddfe646f096a31e43f006902aa879342320c81eac3554acef

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Generic/Spear Phishing

HTTP Headers

GET /link.html HTTP/1.1
Host: pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://skystorehub.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Mon, 05 Feb 2024 18:21:57 GMT
Content-Type: text/html
Content-Length: 653
Connection: keep-alive
Accept-Ranges: bytes
ETag: "6085f9981a606bae48f716cb36fd3ae3"
Last-Modified: Thu, 01 Feb 2024 15:20:14 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 850d2d0f4cfdb50f-OSL

GET challenges.cloudflare.com/turnstile/v0/g/ea25f566/api.js?onload=onloadTurnstileCallback

104.17.2.184

200 OK

13 kB

URL GET HTTPS

challenges.cloudflare.com/turnstile/v0/g/ea25f566/api.js?onload=onloadTurnstileCallback

IP / ASN

104.17.2.184

#13335 CLOUDFLARENET

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typeJavaScript source, ASCII text, with very long lines (38244)

First Seen2024-01-22

Last Seen2024-08-20

Times Seen13694

Size13 kB (13412 bytes)

MD5382de2d5802b5bd3d87cf2fb3071121d

SHA1d0299a88eb32dbc533d61b024ff6e35956113e29

SHA25618cbe0edc0b01c71a6c3ffe704550a8bb1cfe7e02839b7dbdc9c44288bf8b59c

Certificate Info

IssuerCloudflare, Inc.

Subjectchallenges.cloudflare.com

Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E

ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

HTTP Headers

GET /turnstile/v0/g/ea25f566/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Mon, 05 Feb 2024 18:21:57 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 850d2d121ed3569c-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET worksmatter.com/host/admin/js/sc.php?r=ZW0sZW1haWwsYWRk

170.205.52.168

200 OK

1.1 kB

URL GET HTTPS

worksmatter.com/host/admin/js/sc.php?r=ZW0sZW1haWwsYWRk

IP / ASN

170.205.52.168

#397966 READYDEDISLLC

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typeJavaScript source, ASCII text, with CRLF line terminators

First Seen2024-08-20

Last Seen2024-08-20

Times Seen1

Size1.1 kB (1087 bytes)

MD54bf24a8fd5e6f41f0b6676735db7c6f8

SHA155ea0b25bec79748d75240242788c8f67fd3aa14

SHA25616fcca71e0d5817019d893293e29101c50fe3d9cebc19b8efa925768f0e99303

Certificate Info

IssuerLet's Encrypt

Subjectworksmatter.com

Fingerprint81:B3:49:B1:9D:7E:01:7C:1B:D7:87:B2:85:85:4F:6B:A6:AB:79:70

ValidityThu, 01 Feb 2024 13:25:00 GMT - Wed, 01 May 2024 13:24:59 GMT

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /host/admin/js/sc.php?r=ZW0sZW1haWwsYWRk HTTP/1.1
Host: worksmatter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, OPTIONS
vary: Accept-Encoding
content-encoding: gzip
content-length: 1087
content-type: application/javascript; charset=utf-8
date: Mon, 05 Feb 2024 18:21:57 GMT
server: Apache
X-Firefox-Spdy: h2

GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js

104.17.24.14

200 OK

14 kB

URL GET HTTPS

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js

IP / ASN

104.17.24.14

#13335 CLOUDFLARENET

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typeJavaScript source, ASCII text, with very long lines (47992), with no line terminators

First Seen2023-03-07

Last Seen2025-08-05

Times Seen58009

Size14 kB (14107 bytes)

MD5cf3402d7483b127ded4069d651ea4a22

SHA1bde186152457cacf9c35477b5bdda5bcb56b1f45

SHA256eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc

Certificate Info

IssuerCloudflare, Inc.

Subjectsni.cloudflaressl.com

Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D

ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

HTTP Headers

GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 05 Feb 2024 18:21:57 GMT
content-type: application/javascript; charset=utf-8
content-length: 14107
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e2d-bb78"
last-modified: Mon, 04 May 2020 16:09:17 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2728399
expires: Sat, 25 Jan 2025 18:21:57 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PV7%2FtDoDSo2jwb7Xo4GKztGY86WqTRQhY3jBdKiBhzOMP2aK1bq6CPdZpOa5HYeoVTxN4fa7ZbrRGhw%2BxEnrlQl8OiO8AFBIt%2FTd1uAHtzhUPSv0HidaQ5nKMs7%2FKrRdhR6URF9G"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 850d2d155ff6b4eb-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET code.jquery.com/jquery-3.1.1.min.js

151.101.194.137

200 OK

30 kB

URL GET HTTPS

code.jquery.com/jquery-3.1.1.min.js

IP / ASN

151.101.194.137

#54113 FASTLY

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typeJavaScript source, ASCII text, with very long lines (32030)

First Seen2023-03-07

Last Seen2025-08-05

Times Seen119966

Size30 kB (30070 bytes)

MD5e071abda8fe61194711cfc2ab99fe104

SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Certificate Info

IssuerSectigo Limited

Subject*.jquery.com

FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D

ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

HTTP Headers

GET /jquery-3.1.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-152b5"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Mon, 05 Feb 2024 18:21:58 GMT
age: 12356717
x-served-by: cache-lga21947-LGA, cache-hel1410028-HEL
x-cache: HIT, HIT
x-cache-hits: 118, 136925
x-timer: S1707157318.005744,VS0,VE0
vary: Accept-Encoding
content-length: 30070
X-Firefox-Spdy: h2

GET pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/favicon.ico

104.18.3.35

404 Not Found

27 kB

URL GET HTTPS

pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/favicon.ico

IP / ASN

104.18.3.35

#13335 CLOUDFLARENET

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typeHTML document, ASCII text, with very long lines (611)

First Seen2023-04-05

Last Seen2024-09-19

Times Seen52646

Size27 kB (27242 bytes)

MD5df3d48946e8d3f5a83608308edbb4b86

SHA147b9c40c97abf2658df96b1c06109324e15e1a00

SHA256570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Certificate Info

IssuerLet's Encrypt

Subject*.r2.dev

Fingerprint4F:76:7B:87:A0:AD:97:E8:F7:6F:90:89:C3:5D:51:AC:FD:EA:F4:F9

ValiditySat, 09 Dec 2023 16:41:44 GMT - Fri, 08 Mar 2024 16:41:43 GMT

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Mon, 05 Feb 2024 18:21:58 GMT
Content-Type: text/html
Content-Length: 27242
Connection: keep-alive
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 850d2d15ef25b50f-OSL

POST worksmatter.com/host/cca1ff7.php

170.205.52.168

200 OK

438 kB

URL POST HTTPS

worksmatter.com/host/cca1ff7.php

IP / ASN

170.205.52.168

#397966 READYDEDISLLC

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typegzip compressed data, from Unix

First Seen2024-08-20

Last Seen2024-08-20

Times Seen1

Size438 kB (438339 bytes)

MD5c7e820edba8123715a18b613ba7df7f2

SHA19433ac5cadae4b71baa06b02db7cb29a2567b097

SHA25651c2c3febcca57d87353029cdf73826cd642334ffa99d09668d220323a437d64

Certificate Info

IssuerLet's Encrypt

Subjectworksmatter.com

Fingerprint81:B3:49:B1:9D:7E:01:7C:1B:D7:87:B2:85:85:4F:6B:A6:AB:79:70

ValidityThu, 01 Feb 2024 13:25:00 GMT - Wed, 01 May 2024 13:24:59 GMT

HTTP Headers

POST /host/cca1ff7.php HTTP/1.1
Host: worksmatter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 47
Origin: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, OPTIONS
set-cookie: PHPSESSID=bv9270fek1rpnbsva60alaehg6; path=/
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 05 Feb 2024 18:21:58 GMT
server: Apache
X-Firefox-Spdy: h2

GET code.jquery.com/jquery-3.1.1.min.js

151.101.194.137

200 OK

30 kB

URL GET HTTPS

code.jquery.com/jquery-3.1.1.min.js

IP / ASN

151.101.194.137

#54113 FASTLY

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typeJavaScript source, ASCII text, with very long lines (32030)

First Seen2023-03-07

Last Seen2025-08-05

Times Seen119966

Size30 kB (30070 bytes)

MD5e071abda8fe61194711cfc2ab99fe104

SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Certificate Info

IssuerSectigo Limited

Subject*.jquery.com

FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D

ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

HTTP Headers

GET /jquery-3.1.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-152b5"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Mon, 05 Feb 2024 18:22:00 GMT
age: 12356719
x-served-by: cache-lga21947-LGA, cache-hel1410028-HEL
x-cache: HIT, HIT
x-cache-hits: 118, 136926
x-timer: S1707157320.275238,VS0,VE0
vary: Accept-Encoding
content-length: 30070
X-Firefox-Spdy: h2

GET aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg

13.107.213.53

200 OK

2.4 kB

URL GET HTTPS

aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg

IP / ASN

13.107.213.53

#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typeSVG Scalable Vector Graphics image

First Seen2023-04-19

Last Seen2025-08-05

Times Seen85343

Size2.4 kB (2407 bytes)

MD5b59c16ca9bf156438a8a96d45e33db64

SHA14e51b7d3477414b220f688adabd76d3ae6472ee3

SHA256a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8

Certificate Info

IssuerDigiCert Inc

Subjectaadcdn.msauth.net

FingerprintEB:7C:D1:4E:EF:B5:D4:72:25:0B:1A:AF:5F:10:3D:EA:13:80:5A:47

ValidityMon, 29 Jan 2024 00:00:00 GMT - Wed, 29 Jan 2025 23:59:59 GMT

HTTP Headers

GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 05 Feb 2024 18:22:00 GMT
content-type: image/svg+xml
content-length: 2407
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Fri, 11 Mar 2022 11:11:29 GMT
etag: 0x8DA034FE445C10D
x-ms-request-id: 8febf070-b01e-0049-1176-57459c000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240205T182200Z-p4updr70sh4bbafghm2x8cxs9s00000009c0000000001vpk
x-fd-int-roxy-purgeid: 4554691
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg

13.107.213.53

200 OK

199 B

URL GET HTTPS

aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg

IP / ASN

13.107.213.53

#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typeSVG Scalable Vector Graphics image

First Seen2023-04-19

Last Seen2025-08-04

Times Seen47138

Size199 B (199 bytes)

MD527a6d18b56f46818420e60a773c36d4e

SHA1346ec247500fddc51cc1d85b8f4b9a343f7a48d3

SHA2568ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904

Certificate Info

IssuerDigiCert Inc

Subjectaadcdn.msauth.net

FingerprintEB:7C:D1:4E:EF:B5:D4:72:25:0B:1A:AF:5F:10:3D:EA:13:80:5A:47

ValidityMon, 29 Jan 2024 00:00:00 GMT - Wed, 29 Jan 2025 23:59:59 GMT

HTTP Headers

GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 05 Feb 2024 18:22:00 GMT
content-type: image/svg+xml
content-length: 199
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Fri, 17 Jan 2020 19:28:39 GMT
etag: 0x8D79B8374CE7F93
x-ms-request-id: 2dc7f1c3-101e-0007-0172-573490000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240205T182200Z-p4updr70sh4bbafghm2x8cxs9s00000009c0000000001vpq
x-fd-int-roxy-purgeid: 4554691
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg

13.107.213.53

200 OK

1.2 kB

URL GET HTTPS

aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg

IP / ASN

13.107.213.53

#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typeSVG Scalable Vector Graphics image

First Seen2023-05-04

Last Seen2025-08-05

Times Seen81205

Size1.2 kB (1173 bytes)

MD5fe87496cc7a44412f7893a72099c120a

SHA1a0c1458c08a815df63d3cb0406d60be6607ca699

SHA25655ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1

Certificate Info

IssuerDigiCert Inc

Subjectaadcdn.msauth.net

FingerprintEB:7C:D1:4E:EF:B5:D4:72:25:0B:1A:AF:5F:10:3D:EA:13:80:5A:47

ValidityMon, 29 Jan 2024 00:00:00 GMT - Wed, 29 Jan 2025 23:59:59 GMT

HTTP Headers

GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 05 Feb 2024 18:22:00 GMT
content-type: image/svg+xml
content-length: 1173
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Fri, 17 Jan 2020 19:28:39 GMT
etag: 0x8D79B83749623C9
x-ms-request-id: 4676161a-d01e-0063-5976-57daba000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240205T182200Z-p4updr70sh4bbafghm2x8cxs9s00000009c0000000001vpr
x-fd-int-roxy-purgeid: 4554691
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET skystorehub.com/favicon.ico

0.0.0.0

0 B

URL GET HTTPS

skystorehub.com/favicon.ico

IP / ASN

0.0.0.0

Requested byhttps://skystorehub.com/wp/asdf/c21pbGxlckBkZW5jb2wuY29t

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-05

Times Seen5676323

Size0 B (0 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerGoogle Trust Services LLC

Subjectskystorehub.com

Fingerprint1E:2A:31:89:FA:67:4E:CB:69:2D:22:9E:E4:BA:F2:AA:8C:2C:78:EA

ValidityThu, 01 Feb 2024 06:20:14 GMT - Wed, 01 May 2024 06:20:13 GMT

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: skystorehub.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://skystorehub.com/wp/asdf/c21pbGxlckBkZW5jb2wuY29t
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

GET cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

104.17.24.14

200 OK

37 kB

URL GET HTTPS

cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

IP / ASN

104.17.24.14

#13335 CLOUDFLARENET

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typetroff or preprocessor input, ASCII text, with very long lines (372)

First Seen2023-04-05

Last Seen2025-08-05

Times Seen69308

Size37 kB (37414 bytes)

MD5c495654869785bc3df60216616814ad1

SHA10140952c64e3f2b74ef64e050f2fe86eab6624c8

SHA25636e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Certificate Info

IssuerCloudflare, Inc.

Subjectsni.cloudflaressl.com

Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D

ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

HTTP Headers

GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 05 Feb 2024 18:22:00 GMT
content-type: text/css; charset=utf-8
content-length: 5884
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5f-9226"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 6531540
expires: Sat, 25 Jan 2025 18:22:00 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JieR6zhweKFQxWY2gySA7CKqSr3SGtPAFWQdAC1VEsGBtU1ny6NqjnY3p6FpFl3bTNQGuCL8nn8AtSOk07WEeg7ZfWK6Hmu8sp8SNyYzfkibkxw9%2BKo50IcNuwCE5rYMrhJ3ND56"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 850d2d23aa11b518-OSL
alt-svc: h3=":443"; ma=86400

GET skystorehub.com/wp/asdf/c21pbGxlckBkZW5jb2wuY29t

172.67.144.162

200 OK

237 B

URL User Request GET HTTPS

skystorehub.com/wp/asdf/c21pbGxlckBkZW5jb2wuY29t

IP / ASN

172.67.144.162

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeJavaScript source, ASCII text, with no line terminators

First Seen2024-08-20

Last Seen2024-08-20

Times Seen1

Size237 B (237 bytes)

MD56f1043e04b511eb773b2e061257cf2a3

SHA190bf84d5918023fab86cf646079e4614ecc4b3f0

SHA256488c845f8bdcb1cdad0c42d0633ca55dafb12d34decbbbfa2fc591fd943f7fca

Certificate Info

IssuerGoogle Trust Services LLC

Subjectskystorehub.com

Fingerprint1E:2A:31:89:FA:67:4E:CB:69:2D:22:9E:E4:BA:F2:AA:8C:2C:78:EA

ValidityThu, 01 Feb 2024 06:20:14 GMT - Wed, 01 May 2024 06:20:13 GMT

HTTP Headers

GET /wp/asdf/c21pbGxlckBkZW5jb2wuY29t HTTP/1.1
Host: skystorehub.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 05 Feb 2024 18:21:56 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FG%2B7mxl%2FQ0qieXapZ5LlH25sRAgQwqwXHqTG3yQ8m3nN6oNmiUtkaDiCCssqPV%2FJCHtQPQYOsnxoQe%2BmbSFtgQ4exltNQbT17pZmuqyQsdBBkIAZaPP9HGm0spvosVGpFMk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 850d2d0b282db518-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html

104.18.3.35

200 OK

653 B

URL User Request GET HTTPS

pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html

IP / ASN

104.18.3.35

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with very long lines (690), with no line terminators

First Seen2024-02-03

Last Seen2024-08-20

Times Seen3

Size653 B (653 bytes)

MD5cd76e6edc4d85878ada4a6b7b5f5a378

SHA13197378c45015b5346af7f3a9446eb74b020dd44

SHA25676cc54eab2b23c9ad9eb2c0d17f3b602d2eb4cbc102de33dcae6df359540ebba

Certificate Info

IssuerLet's Encrypt

Subject*.r2.dev

Fingerprint4F:76:7B:87:A0:AD:97:E8:F7:6F:90:89:C3:5D:51:AC:FD:EA:F4:F9

ValiditySat, 09 Dec 2023 16:41:44 GMT - Fri, 08 Mar 2024 16:41:43 GMT

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Generic/Spear Phishing

HTTP Headers

GET /link.html HTTP/1.1
Host: pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://skystorehub.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Mon, 05 Feb 2024 18:21:57 GMT
Content-Type: text/html
Content-Length: 653
Connection: keep-alive
Accept-Ranges: bytes
ETag: "6085f9981a606bae48f716cb36fd3ae3"
Last-Modified: Thu, 01 Feb 2024 15:20:14 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 850d2d0f4cfdb50f-OSL

GET challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback

104.17.2.184

302 Found

38 kB

URL GET HTTPS

challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback

IP / ASN

104.17.2.184

#13335 CLOUDFLARENET

Requested byhttps://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/link.html#

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-05

Times Seen5676323

Size38 kB (38245 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerCloudflare, Inc.

Subjectchallenges.cloudflare.com

Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E

ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

HTTP Headers

GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-d1f7bb379085453592fe8e21d30c6bbe.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Mon, 05 Feb 2024 18:21:57 GMT
vary: accept-encoding
cache-control: max-age=300, public
location: /turnstile/v0/g/ea25f566/api.js?onload=onloadTurnstileCallback
access-control-allow-origin: *
server: cloudflare
cf-ray: 850d2d11fea7569c-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2