muddy-moon-71b4.soznvztbmy1542.workers.dev

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 2606:4700:3037::ac43:b912, located in United States and belongs to CLOUDFLARENET, US. The main domain is muddy-moon-71b4.soznvztbmy1542.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on February 8th 2024. Valid for: 3 months.

This is the only time muddy-moon-71b4.soznvztbmy1542.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3037::ac43:b912	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:200... 2a04:4e42:200::649	54113 (FASTLY) (FASTLY)
3	3

2 2606:4700:3037::ac43:b912 (United States)

ASN13335 (CLOUDFLARENET, US)

muddy-moon-71b4.soznvztbmy1542.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	workers.dev muddy-moon-71b4.soznvztbmy1542.workers.dev	49 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 775	78 KB
3	2

	Domain	Requested by
2	muddy-moon-71b4.soznvztbmy1542.workers.dev	muddy-moon-71b4.soznvztbmy1542.workers.dev
1	code.jquery.com	muddy-moon-71b4.soznvztbmy1542.workers.dev
3	2

This site contains links to these domains. Also see Links.

Domain
www.premierpawn.com

Subject Issuer	Validity	Valid
soznvztbmy1542.workers.dev GTS CA 1P5	`2024-02-08` - `2024-05-08`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://muddy-moon-71b4.soznvztbmy1542.workers.dev/
Frame ID: 205A955EC121119BA50A0887D53EF7A2
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign | SharePoint

Page URL History Show full URLs

http://muddy-moon-71b4.soznvztbmy1542.workers.dev/ HTTP 307
https://muddy-moon-71b4.soznvztbmy1542.workers.dev/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

3
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

127 kB
Transfer

356 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.premierpawn.com/rrt/xxtb/sharepoints/sharepoints.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&email=dXpvaGlmZWFueWlAb3V0bG9vay5jb20=#home
Title: SharePoint

Search URL Search Domain Scan URL

URL: https://www.premierpawn.com/rrt/xxtb/sharepoints/sharepoints.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&email=dXpvaGlmZWFueWlAb3V0bG9vay5jb20=#news
Title: DOC Q0017 - 3512C.Doc

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://muddy-moon-71b4.soznvztbmy1542.workers.dev/ HTTP 307
https://muddy-moon-71b4.soznvztbmy1542.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response muddy-moon-71b4.soznvztbmy1542.workers.dev/ Redirect Chain http://muddy-moon-71b4.soznvztbmy1542.workers.dev/ https://muddy-moon-71b4.soznvztbmy1542.workers.dev/	36 KB 24 KB	77ms 24ms	Document text/html	2606:4700:3037::ac43:b912 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://muddy-moon-71b4.soznvztbmy1542.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:b912 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b967cd999bc9c83c31e6f5edd26ceb8e07ac0e47fcd75715da750d71818c72f4` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-ray 85977867381f6ff3-CDG content-encoding br content-type text/html;charset=UTF-8 date Thu, 22 Feb 2024 13:10:37 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xCnq121HsRC44cAvliuOiMNmz7p1eCPeQj%2BBltBaFIxiL0nYRh0Pwd2vB4e4Ct5zKdPeneQnTYt%2FOfVhEflOYxQczSggAfajHmEJZ%2FQUZP8R69H2tu%2BmMaGGj0feTlK%2BHKe%2BDkbQS7mw0seCU4YtYfZTaP%2FfIHPpwQ1dKuM0ZF182Cw3jjmeVsk%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding Redirect headers Cross-Origin-Resource-Policy Cross-Origin Location https://muddy-moon-71b4.soznvztbmy1542.workers.dev/ Non-Authoritative-Reason HSTS
GET H2	200	myscr584876.js.download Show response muddy-moon-71b4.soznvztbmy1542.workers.dev/index_files/	36 KB 24 KB	26ms 25ms	Script text/html	2606:4700:3037::ac43:b912 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://muddy-moon-71b4.soznvztbmy1542.workers.dev/index_files/myscr584876.js.download Requested by Host: muddy-moon-71b4.soznvztbmy1542.workers.dev URL: https://muddy-moon-71b4.soznvztbmy1542.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:b912 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b967cd999bc9c83c31e6f5edd26ceb8e07ac0e47fcd75715da750d71818c72f4` Request headers accept-language de-DE,de;q=0.9 Referer https://muddy-moon-71b4.soznvztbmy1542.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36 Response headers date Thu, 22 Feb 2024 13:10:37 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ntKGm0p2LzyWX7%2Bar%2BrNuDKExludl6Fi0Hy8xvBC5dIZEulv3RnG%2BASvfCIHO8fbY5CFExGCNlXriTya1BtOFD4cepzPdjhQld%2FqVZXDbpQ%2BXFHwCvzeQemrh5VSu%2FnNZteLqSLt7Oa1pDXMx3KXbg%2BGrED8qA4BqhMueIMtB31qTwaNQPLFfdo%3D"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 85977867685e6ff3-CDG alt-svc h3=":443"; ma=86400
GET H2	200	jquery-1.9.1.js Show response code.jquery.com/	262 KB 78 KB	40ms 6ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.9.1.js Requested by Host: muddy-moon-71b4.soznvztbmy1542.workers.dev URL: https://muddy-moon-71b4.soznvztbmy1542.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash `7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40` Request headers accept-language de-DE,de;q=0.9 Referer https://muddy-moon-71b4.soznvztbmy1542.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36 Response headers date Thu, 22 Feb 2024 13:10:38 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 3183300 x-cache HIT, HIT content-length 79506 x-served-by cache-lga21952-LGA, cache-fra-eddf8230052-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1708607438.016852,VS0,VE0 etag W/"28feccc0-4185d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 16, 93502
GET DATA	200 OK	truncated /	9 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	13 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
muddy-moon-71b4.soznvztbmy1542.workers.dev
2606:4700:3037::ac43:b912
2a04:4e42:200::649
5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece
b967cd999bc9c83c31e6f5edd26ceb8e07ac0e47fcd75715da750d71818c72f4

muddy-moon-71b4.soznvztbmy1542.workers.dev Open in urlscan Pro 2606:4700:3037::ac43:b912 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

127 kBTransfer

356 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

muddy-moon-71b4.soznvztbmy1542.workers.dev Open in urlscan Pro
2606:4700:3037::ac43:b912 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

127 kB
Transfer

356 kB
Size

0
Cookies

3 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!