Report - worker-plain-night-596e.president-post32212.workers.dev/

Report Overview

Submitted URL
worker-plain-night-596e.president-post32212.workers.dev/
IP
188.114.97.1
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-26 17:39:27
Access
public
Website Title
Sharepoint
Final URL
worker-plain-night-596e.president-post32212.workers.dev/
Tags
suspicious
urlquery detections
Suspicious - Suspicious Javascript code

Detections

urlquery
3
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.w3schools.com	17487	2000-03-21	2014-02-05	2024-04-26	460 B	5.8 kB	192.229.133.221
logincdn.msauth.net	2330	2018-10-25	2019-04-23	2024-04-25	1.1 kB	2.5 kB	13.107.246.53
worker-plain-night-596e.president-post32212.workers.dev	unknown	2019-02-08	2024-01-09	2024-04-11	1.0 kB	1.9 MB	188.114.96.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-03-10	medium	worker-plain-night-596e.president-post32212.workers.dev/favicon.ico	Office365
2024-04-26	medium	worker-plain-night-596e.president-post32212.workers.dev/	Office365

PhishTank

Scan Date	Severity	Indicator	Alert
2024-03-08	medium	worker-plain-night-596e.president-post32212.workers.dev/favicon.ico	Microsoft
2024-03-08	medium	worker-plain-night-596e.president-post32212.workers.dev/	Microsoft

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	worker-plain-night-596e.president-post32212.workers.dev/	1.1 MB	2023-10-26	2024-04-26
Pretty URL worker-plain-night-596e.president-post32212.workers.dev/ IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-10-26 15:04:13 Last Seen2024-04-26 19:39:28 Times Seen7 Hash 8f72caa10a6213b28414ffa30b529bc6 2779d336764ed0e0f7c2f0c25b8b34a7ecaeb682 b99ffe05904b915e25f3fec0cca72b69cbae636b177a3bc089686d744abb8fb9 Loading...

	unknown	1.1 MB	2023-10-26	2024-04-26
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-26 15:04:14 Last Seen2024-04-26 19:39:28 Times Seen7 Hash f72d56a97904c4e9a730a1a6c911d65d 1825f7ecfac458219fa008778cfa2097c3e82ffa 3fd893a31006d2cd18a4b3dbf8d3f8eb3b94dc218735b2c4779663bab678c1aa Loading...

		Size	First Seen	Last Seen
	#1 Write - 2e1094858958bff886af06a22a3a0b1d	1.1 MB	2023-10-26	2024-04-26
Pretty Observations First Seen2023-10-26 15:04:14 Last Seen2024-04-26 19:39:28 Times Seen7 Hash 2e1094858958bff886af06a22a3a0b1d fc0668b28a5ed67e9111390985b48586529e3b33 024f1adee35e49c8362eabe5b3eea025d818d16a7fab5bb3cd21cb992fd422fb Loading...

HTTP Transactions (5)

URL IP Response Size

www.w3schools.com/w3css/4/w3.css

192.229.133.221

200 OK

5.3 kB

URL GET HTTP/2
www.w3schools.com/w3css/4/w3.css
IP
192.229.133.221:443
ASN
#15133 EDGECAST

Requested by
https://worker-plain-night-596e.president-post32212.workers.dev/
Certificate
IssuerDigiCert Inc
Subject*.w3schools.com
Fingerprint20:AF:FF:E1:FC:DB:58:C8:05:B7:D2:97:1F:8F:A1:C6:AD:ED:59:3A
ValidityWed, 03 Apr 2024 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT

File type
Unicode text, UTF-8 (with BOM) text
Size
5.3 kB (5256 bytes)
Hash
ba0537e9574725096af97c27d7e54f76
bd46b47d74d344f435b5805114559d45979762d5
4a7611bc677873a0f87fe21727bc3a2a43f57a5ded3b10ce33a0f371a2e6030f

HTTP Headers

GET /w3css/4/w3.css HTTP/1.1
Host: www.w3schools.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://worker-plain-night-596e.president-post32212.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
age: 11656
cache-control: public,max-age=14400,public
content-security-policy: frame-ancestors 'self' https://mycourses.w3schools.com;
content-type: text/css
date: Fri, 26 Apr 2024 17:39:01 GMT
etag: "07b62cad997da1:0+gzip"
last-modified: Fri, 26 Apr 2024 13:01:02 GMT
server: ECS (ska/F716)
vary: Accept-Encoding
x-cache: HIT
x-content-security-policy: frame-ancestors 'self' https://mycourses.w3schools.com;
x-powered-by: ASP.NET
content-length: 5256
X-Firefox-Spdy: h2

logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg

13.107.246.53

200 OK

276 B

URL GET HTTP/2
logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
IP
13.107.246.53:443
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://worker-plain-night-596e.president-post32212.workers.dev/
Certificate
IssuerMicrosoft Corporation
Subjectidentitycdn.msauth.net
Fingerprint15:1B:3E:26:F4:4A:EE:1C:C2:40:74:BB:BD:AE:20:E4:35:B0:40:40
ValidityWed, 17 Jan 2024 06:03:21 GMT - Sat, 11 Jan 2025 06:03:21 GMT

File type
SVG Scalable Vector Graphics image
Size
276 B (276 bytes)
Hash
a9cc2824ef3517b6c4160dcf8ff7d410
8db9aebad84ca6e4225bfdd2458ff3821cc4f064
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

HTTP Headers

GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1
Host: logincdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://worker-plain-night-596e.president-post32212.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:39:01 GMT
content-type: image/svg+xml
content-length: 276
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Wed, 22 Jan 2020 00:38:00 GMT
etag: 0x8D79ED35591CF44
x-ms-request-id: d42dd95b-201e-0074-14bf-94bb96000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240426T173901Z-16c4f695cc58qx282nqc5nyr8g0000000ar00000000076wm
x-fd-int-roxy-purgeid: 67912908
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg

13.107.246.53

200 OK

606 B

URL GET HTTP/2
logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
IP
13.107.246.53:443
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://worker-plain-night-596e.president-post32212.workers.dev/
Certificate
IssuerMicrosoft Corporation
Subjectidentitycdn.msauth.net
Fingerprint15:1B:3E:26:F4:4A:EE:1C:C2:40:74:BB:BD:AE:20:E4:35:B0:40:40
ValidityWed, 17 Jan 2024 06:03:21 GMT - Sat, 11 Jan 2025 06:03:21 GMT

File type
SVG Scalable Vector Graphics image
Size
606 B (606 bytes)
Hash
bcb4d1dc4eae64f0b2b2538209d8435a
4f10568bc1b70bc98d5297b85812c33b3e636766
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea

HTTP Headers

GET /shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg HTTP/1.1
Host: logincdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://worker-plain-night-596e.president-post32212.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:39:01 GMT
content-type: image/svg+xml
content-length: 606
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Wed, 22 Jan 2020 00:38:04 GMT
etag: 0x8D79ED3581609DD
x-ms-request-id: aec33f9a-001e-001e-18b9-95f7a1000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240426T173901Z-16c4f695cc58qx282nqc5nyr8g0000000ar00000000076wk
x-fd-int-roxy-purgeid: 67912908
x-cache-info: L1_T2
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

worker-plain-night-596e.president-post32212.workers.dev/favicon.ico

188.114.96.1

200 OK

777 kB

URL GET HTTP/3
worker-plain-night-596e.president-post32212.workers.dev/favicon.ico
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://worker-plain-night-596e.president-post32212.workers.dev/
Certificate
IssuerLet's Encrypt
Subjectpresident-post32212.workers.dev
Fingerprint03:E4:04:32:CF:E4:3D:9F:F7:50:9A:D6:86:9A:64:AC:54:3F:82:28
ValidityFri, 08 Mar 2024 11:55:39 GMT - Thu, 06 Jun 2024 11:55:38 GMT

File type
HTML document, ASCII text, with very long lines (65520)
Size
777 kB (777074 bytes)
Hash
f494f80a67bd02863b863daa3534984f
620518ba4362c7b88acb6715016b1c69e958636e
99a77f834539fd786fa5067ce01cc525a6225b6ce904465877ab32dfd00549c9

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Office365
PhishTank	phishing	Microsoft

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: worker-plain-night-596e.president-post32212.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://worker-plain-night-596e.president-post32212.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:39:01 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F%2Bxn6hGAOkCTYRwbW8upce%2B96%2B4OHepuT7kjoxflSmH5WValTKirpEfO6GnzShzbrcCZKedi4bNIkET3ehRHaKAH40VUWH0X5InPqL4ViosxrM%2Faic2uoZX7N1pFaBhjuAFkQR1wk52Sc1GhVtTXnoTkSsdWkFPcElfsYxz4nt1avy67OtWA1XOm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a85991282b7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

worker-plain-night-596e.president-post32212.workers.dev/

188.114.96.1

200 OK

1.1 MB

URL User Request GET HTTP/2
worker-plain-night-596e.president-post32212.workers.dev/
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectpresident-post32212.workers.dev
Fingerprint03:E4:04:32:CF:E4:3D:9F:F7:50:9A:D6:86:9A:64:AC:54:3F:82:28
ValidityFri, 08 Mar 2024 11:55:39 GMT - Thu, 06 Jun 2024 11:55:38 GMT

File type

Size
1.1 MB (1148671 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code
OpenPhish	phishing	Office365
PhishTank	phishing	Microsoft

HTTP Headers

GET / HTTP/1.1
Host: worker-plain-night-596e.president-post32212.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:39:01 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JrvH2MlGw8foL2%2FMU%2FXtLdpue29nNl2ndYzEccxdFeW0YwAEL%2FxQMj0bl%2B810iFjouOlbgskT5lk%2FyCbMwQMf9vREQUZAQASXabYLIb6zLT8wJrfPPtg5aBU3PbMNxuyV0hGZ%2BXGMwAQ%2BWzj1EWtvrrJB8MLlNqcAOHb00RchM036QVJWmlrldJr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8598c0fc356aa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (5)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/2

IP

ASN