Report - myaol0ne-049c.tovacu.workers.dev/

Report Overview

Submitted URL
myaol0ne-049c.tovacu.workers.dev/
IP
188.114.97.1
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-18 16:06:35
Access
public
Website Title
AOL
Final URL
myaol0ne-049c.tovacu.workers.dev/
Tags
phishing suspicious
urlquery detections
Phishing - Generic phishing
Suspicious - Suspicious Javascript code

Detections

urlquery
7
Network Intrusion Detection
2
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
myaol0ne-049c.tovacu.workers.dev	unknown	2019-02-08	2024-01-30	2024-01-30	948 B	234 kB	188.114.97.1
api.ipify.org	3267	2014-01-05	2014-10-06	2024-04-17	433 B	249 B	104.26.13.205

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-18 16:06:10	low	Client IP	188.114.97.1	ET INFO Observed Cloudflare workers.dev Domain in TLS SNI
2024-04-18 16:06:10	low	Client IP	104.26.13.205	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	myaol0ne-049c.tovacu.workers.dev/	AOL Inc.
2024-04-18	medium	myaol0ne-049c.tovacu.workers.dev/	AOL Inc.

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	unknown	346 B	2024-01-25	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-01-25 04:26:54 Last Seen2024-04-18 18:06:36 Times Seen4 Hash 2ec5fe5ab6ec0b9b2dab20fbb25ddc52 5e635d257ebe90cb76a6d42fe8aa1257a947bad4 845d47383d05caa9883bc1194377740fe1c3830183cdb4d47af62610a1f6e25e Loading...

	api.ipify.org/?format=jsonp&callback=getIP	29 B	2023-03-07	2024-05-01
Pretty URL api.ipify.org/?format=jsonp&callback=getIP IP 104.26.13.205 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:16:09 Last Seen2024-05-01 20:06:22 Times Seen16593 Hash 90a39389063c7c5716745c3b3bb4fba1 a0903c9a7e90fa3c6ddb04d0ce36abbd4c7a004f eaa6745d9d0a7698235cd6af53aad1551d975506c8405d8303282fb6d2f7ab69 Loading...

	unknown	3.0 kB	2024-03-31	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-31 07:00:58 Last Seen2024-04-18 18:06:36 Times Seen2 Hash 337cb8943365470617bef62699208a96 c669c9ddc9502f330fdea5c0e7cbe8f5bcaa493b cb564c36c41046b8d2eef348bc38332062ec0e6f97422f430f61255c1d2e41da Loading...

	myaol0ne-049c.tovacu.workers.dev/	116 kB	2024-03-31	2024-04-18
Pretty URL myaol0ne-049c.tovacu.workers.dev/ IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-31 07:00:58 Last Seen2024-04-18 18:06:36 Times Seen2 Hash ca1cd75b0bad517682f400845ffe15f6 4220a8dee2905372d9e8bbcd759c0827b90cd927 2d412adfea90e0b3cf99a350f2fc0b0edb3d250776a107d923210b81db9c8f6c Loading...

		Size	First Seen	Last Seen
	#1 Write - d4f1158c995301886ecbc23e5d2fd6e0	39 kB	2024-03-31	2024-04-18
Pretty Observations First Seen2024-03-31 07:00:58 Last Seen2024-04-18 18:06:36 Times Seen2 Hash d4f1158c995301886ecbc23e5d2fd6e0 8ae3d5639e3b8adb4341e1ab53d4beedb8adac81 fcbd47ad0b74d1ba3e15616425c77ccf619cab33f014e08b96c92444ec2e029c Loading...

HTTP Transactions (3)

URL IP Response Size

api.ipify.org/?format=jsonp&callback=getIP

104.26.13.205

200 OK

29 B

URL GET HTTP/2
api.ipify.org/?format=jsonp&callback=getIP
IP
104.26.13.205:443
ASN
#13335 CLOUDFLARENET

Requested by
https://myaol0ne-049c.tovacu.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectipify.org
FingerprintC8:1A:05:47:C5:73:C6:CE:DF:1D:A6:DE:00:11:A9:9A:8C:DB:EF:A7
ValidityThu, 21 Mar 2024 19:56:02 GMT - Wed, 19 Jun 2024 19:56:01 GMT

File type
ASCII text, with no line terminators
Size
29 B (29 bytes)
Hash
90a39389063c7c5716745c3b3bb4fba1
a0903c9a7e90fa3c6ddb04d0ce36abbd4c7a004f
eaa6745d9d0a7698235cd6af53aad1551d975506c8405d8303282fb6d2f7ab69

HTTP Headers

GET /?format=jsonp&callback=getIP HTTP/1.1
Host: api.ipify.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://myaol0ne-049c.tovacu.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 16:06:10 GMT
content-type: application/javascript
content-length: 29
vary: Origin
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8765e68ce8f15691-OSL
X-Firefox-Spdy: h2

myaol0ne-049c.tovacu.workers.dev/

188.114.97.1

200 OK

116 kB

URL User Request GET HTTP/2
myaol0ne-049c.tovacu.workers.dev/
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjecttovacu.workers.dev
Fingerprint64:79:26:8A:64:2D:A9:48:D5:F0:C9:B1:35:8A:77:37:4C:56:0E:E2
ValidityFri, 29 Mar 2024 18:10:53 GMT - Thu, 27 Jun 2024 18:10:52 GMT

File type
HTML document, ASCII text, with very long lines (65525)
Size
116 kB (116192 bytes)
Hash
bb69e95f2205642aff09b0fd13d674b0
bd252140e1141330434da80e75781600b6b4d4e1
8e530bfa8206ef971c5d5bb95ea76fce85dba51d3f53db1418ffbdb90633974c

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code
OpenPhish	phishing	AOL Inc.

HTTP Headers

GET / HTTP/1.1
Host: myaol0ne-049c.tovacu.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 16:06:10 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M1W%2F%2Fe%2F3b2xKRPAFBoSL3uIKtk0vwn%2FfMcm7cc4a6pUcSr3Y8k07TN1QJkp5WUvUNiF7RNYHMt1fge4r3DY0uHGrNol7Vq85nM%2F59CbI4D%2FP7DFFpoY%2Bf%2BIuVwf4xKfL3BRE7kIg%2B0fNrvva%2BjJJj4%2FMYw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8765e68b2f9a5687-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

myaol0ne-049c.tovacu.workers.dev/favicon.ico

188.114.97.1

200 OK

116 kB

URL GET HTTP/3
myaol0ne-049c.tovacu.workers.dev/favicon.ico
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://myaol0ne-049c.tovacu.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjecttovacu.workers.dev
Fingerprint64:79:26:8A:64:2D:A9:48:D5:F0:C9:B1:35:8A:77:37:4C:56:0E:E2
ValidityFri, 29 Mar 2024 18:10:53 GMT - Thu, 27 Jun 2024 18:10:52 GMT

File type
HTML document, ASCII text, with very long lines (65525)
Size
116 kB (116192 bytes)
Hash
bb69e95f2205642aff09b0fd13d674b0
bd252140e1141330434da80e75781600b6b4d4e1
8e530bfa8206ef971c5d5bb95ea76fce85dba51d3f53db1418ffbdb90633974c

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	AOL Inc.

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: myaol0ne-049c.tovacu.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://myaol0ne-049c.tovacu.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 18 Apr 2024 16:06:10 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rqsOA%2Bi1%2FNssWXqvK7GdDLCga1IYBCxdWgZIal%2FAKpbCvRajNcRKDO27C3babJh2jA9W4EiU1%2B8w7%2F9mvdzWFQufL8cNd%2BxWSkyK3bQCS145dOzQGLwwraLoLqhKpGLu5csc8pn60eRP0aWqrHDB7XqtKg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8765e68e7d380b59-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (3)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers