Report - worker-empty-cell-4c1f.haremu62.workers.dev/

Report Overview

Submitted URL
worker-empty-cell-4c1f.haremu62.workers.dev/
IP
188.114.96.1
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-19 03:53:02
Access
public
Website Title
Sharepoint
Final URL
worker-empty-cell-4c1f.haremu62.workers.dev/
Tags
suspicious
urlquery detections
Suspicious - Suspicious Javascript code

Detections

urlquery
3
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.w3schools.com	17487	2000-03-21	2014-02-05	2024-04-18	448 B	5.8 kB	192.229.133.221
logincdn.msauth.net	2330	2018-10-25	2019-04-23	2024-04-17	1.0 kB	2.5 kB	13.107.246.53
worker-empty-cell-4c1f.haremu62.workers.dev	unknown	2019-02-08	2023-10-05	2024-01-31	981 B	2.3 MB	188.114.97.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	worker-empty-cell-4c1f.haremu62.workers.dev/	Office365
2024-04-18	medium	worker-empty-cell-4c1f.haremu62.workers.dev/	Office365

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	unknown	1.1 MB	2024-04-19	2024-04-19
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-19 05:53:04 Last Seen2024-04-19 05:53:04 Times Seen1 Hash 23043e4c116f40d8eca1372225034f93 63b576ce97e1c7b14d7472d01afd6f6637fbcba3 8c0afb5a26c187c619f1c5efe925698b9523f276b59598f6b2678aa04cd90e7d Loading...

	worker-empty-cell-4c1f.haremu62.workers.dev/	1.1 MB	2024-04-19	2024-04-19
Pretty URL worker-empty-cell-4c1f.haremu62.workers.dev/ IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-19 05:53:04 Last Seen2024-04-19 05:53:04 Times Seen1 Hash 322c8581a5caf3d88a63c37cba9abe16 0a5b34ad656f8d704438f9e646a5f2dc8583da64 f732437194ef8480c62282f789e4e948325c33fc4ad71e38d2f5547a9f43c35a Loading...

		Size	First Seen	Last Seen
	#1 Write - e5fb620c2405e98466c2b01685ce6100	1.1 MB	2024-04-19	2024-04-19
Pretty Observations First Seen2024-04-19 05:53:04 Last Seen2024-04-19 05:53:04 Times Seen1 Hash e5fb620c2405e98466c2b01685ce6100 de2443506528eb38d21e9f6c29f6ff538cd00f70 08f886d565b86488076bea8c19aaa724598e01aa180bf7bf5ab3323c8ad0c131 Loading...

HTTP Transactions (5)

URL IP Response Size

www.w3schools.com/w3css/4/w3.css

192.229.133.221

200 OK

5.3 kB

URL GET HTTP/2
www.w3schools.com/w3css/4/w3.css
IP
192.229.133.221:443
ASN
#15133 EDGECAST

Requested by
https://worker-empty-cell-4c1f.haremu62.workers.dev/
Certificate
IssuerDigiCert Inc
Subject*.w3schools.com
Fingerprint20:AF:FF:E1:FC:DB:58:C8:05:B7:D2:97:1F:8F:A1:C6:AD:ED:59:3A
ValidityWed, 03 Apr 2024 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT

File type
Unicode text, UTF-8 (with BOM) text
Size
5.3 kB (5256 bytes)
Hash
ba0537e9574725096af97c27d7e54f76
bd46b47d74d344f435b5805114559d45979762d5
4a7611bc677873a0f87fe21727bc3a2a43f57a5ded3b10ce33a0f371a2e6030f

HTTP Headers

GET /w3css/4/w3.css HTTP/1.1
Host: www.w3schools.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://worker-empty-cell-4c1f.haremu62.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
age: 5699
cache-control: public,max-age=14400,public
content-security-policy: frame-ancestors 'self' https://mycourses.w3schools.com;
content-type: text/css
date: Fri, 19 Apr 2024 03:52:36 GMT
etag: "076f6bb690da1:0+gzip"
last-modified: Wed, 17 Apr 2024 10:57:32 GMT
server: ECS (ska/F716)
vary: Accept-Encoding
x-cache: HIT
x-content-security-policy: frame-ancestors 'self' https://mycourses.w3schools.com;
x-powered-by: ASP.NET
content-length: 5256
X-Firefox-Spdy: h2

logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg

13.107.246.53

200 OK

276 B

URL GET HTTP/2
logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
IP
13.107.246.53:443
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://worker-empty-cell-4c1f.haremu62.workers.dev/
Certificate
IssuerMicrosoft Corporation
Subjectidentitycdn.msauth.net
Fingerprint15:1B:3E:26:F4:4A:EE:1C:C2:40:74:BB:BD:AE:20:E4:35:B0:40:40
ValidityWed, 17 Jan 2024 06:03:21 GMT - Sat, 11 Jan 2025 06:03:21 GMT

File type
SVG Scalable Vector Graphics image
Size
276 B (276 bytes)
Hash
a9cc2824ef3517b6c4160dcf8ff7d410
8db9aebad84ca6e4225bfdd2458ff3821cc4f064
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

HTTP Headers

GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1
Host: logincdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://worker-empty-cell-4c1f.haremu62.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 03:52:36 GMT
content-type: image/svg+xml
content-length: 276
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Wed, 22 Jan 2020 00:38:00 GMT
etag: 0x8D79ED35591CF44
x-ms-request-id: 0a6b7e73-401e-004e-45f1-909492000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240419T035236Z-17f9dd4c48bvsmhc0mrzzebckc0000000370000000000h1n
x-fd-int-roxy-purgeid: 67912908
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg

13.107.246.53

200 OK

606 B

URL GET HTTP/2
logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
IP
13.107.246.53:443
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://worker-empty-cell-4c1f.haremu62.workers.dev/
Certificate
IssuerMicrosoft Corporation
Subjectidentitycdn.msauth.net
Fingerprint15:1B:3E:26:F4:4A:EE:1C:C2:40:74:BB:BD:AE:20:E4:35:B0:40:40
ValidityWed, 17 Jan 2024 06:03:21 GMT - Sat, 11 Jan 2025 06:03:21 GMT

File type
SVG Scalable Vector Graphics image
Size
606 B (606 bytes)
Hash
bcb4d1dc4eae64f0b2b2538209d8435a
4f10568bc1b70bc98d5297b85812c33b3e636766
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea

HTTP Headers

GET /shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg HTTP/1.1
Host: logincdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://worker-empty-cell-4c1f.haremu62.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 03:52:36 GMT
content-type: image/svg+xml
content-length: 606
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Wed, 22 Jan 2020 00:38:04 GMT
etag: 0x8D79ED3581609DD
x-ms-request-id: adad2f5e-b01e-0031-03a6-91ef8d000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240419T035236Z-17f9dd4c48bvsmhc0mrzzebckc0000000370000000000h1m
x-fd-int-roxy-purgeid: 67912908
x-cache: TCP_HIT
x-cache-info: L1_T2
accept-ranges: bytes
X-Firefox-Spdy: h2

worker-empty-cell-4c1f.haremu62.workers.dev/favicon.ico

188.114.97.1

200 OK

1.1 MB

URL GET HTTP/3
worker-empty-cell-4c1f.haremu62.workers.dev/favicon.ico
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://worker-empty-cell-4c1f.haremu62.workers.dev/
Certificate
IssuerLet's Encrypt
Subjectharemu62.workers.dev
FingerprintB7:71:55:D1:C6:45:FB:B4:F5:FC:25:B2:DE:95:BB:28:FC:EF:EB:2D
ValidityFri, 29 Mar 2024 20:41:30 GMT - Thu, 27 Jun 2024 20:41:29 GMT

File type

Size
1.1 MB (1148661 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Office365

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: worker-empty-cell-4c1f.haremu62.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://worker-empty-cell-4c1f.haremu62.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 19 Apr 2024 03:52:36 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i3SIAIkcdwJcig90t1AnL%2B%2Fd2fHKlhd6hGSYQlnYP0YCELPaeXh7EkXXvYVCqMjQPnrSsbwrVvkX2NO06GkIDOvzzxbvLqRkfo1zWYHoHmUYF0593lv1KqRxsB9OL1zmYfLSkweTuruDgJdD4nC3ztarmr4aFSTjGEYcMdKI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8769f15eea325693-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

worker-empty-cell-4c1f.haremu62.workers.dev/

188.114.97.1

200 OK

1.1 MB

URL User Request GET HTTP/2
worker-empty-cell-4c1f.haremu62.workers.dev/
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectharemu62.workers.dev
FingerprintB7:71:55:D1:C6:45:FB:B4:F5:FC:25:B2:DE:95:BB:28:FC:EF:EB:2D
ValidityFri, 29 Mar 2024 20:41:30 GMT - Thu, 27 Jun 2024 20:41:29 GMT

File type

Size
1.1 MB (1148661 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code
OpenPhish	phishing	Office365

HTTP Headers

GET / HTTP/1.1
Host: worker-empty-cell-4c1f.haremu62.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 03:52:36 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TSmK9cwe6Zeyn652JRUzxOFRFQ5VRKHYxiKNUXLEobzaxPCsg9lW9sHCUFbJlMBt8c%2FNGkhiEpinREfMBQcnNPBMiAdJ3%2FiAe02RwK%2BEjjgYBz70UNzBP%2FhtVC1j%2FD5rY%2BwqV4qOsB2eS8%2FBL2n84qyewRGr17yKL2oRbaYD"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8769f15a1a4a56a5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (5)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/2

IP

ASN