workers-playground-red-credit-596b.dominickm.workers.dev Open in urlscan Pro
2606:4700:3034::ac43:c4a9  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response workers-playground-red-credit-596b.dominickm.workers.dev/	15 KB 5 KB	126ms 36ms	Document text/html	2606:4700:3034::ac43:c4a9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://workers-playground-red-credit-596b.dominickm.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:c4a9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0967c7ce43f94fc0fff220c107a7d024c13d609d5efcddbc4ab8b500f0a38db0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-ray 84506dc6086b4bc7-BUF content-encoding br content-type text/html;charset=UTF-8 date Sat, 13 Jan 2024 20:35:59 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1v3pPjGTWvi1YdOh%2FpeeFn64EN8vK2ReF%2F2w1oQz9h%2BIwokjzynHUrp8EA7hS%2BT9pwyDcmfMgJ0DtYYBDyyb8UbdMeh14O7DcFNqrs4Lb8wysokCXg3d2gNTv7s7tgw9JIwoyTfU%2FJ2hBQpMISE121BXG3CtjPIcHFZtqq%2BhJp9NiyTMN%2F1dC5YJjjtOFz8F%2B%2BHnCACNOQ%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	docusign-logo.png ada978-docusign.webnotifications.net/docusign/	4 KB 4 KB	1081ms 262ms	Image image/png	54.253.76.144 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ada978-docusign.webnotifications.net/docusign/docusign-logo.png Requested by Host: workers-playground-red-credit-596b.dominickm.workers.dev URL: https://workers-playground-red-credit-596b.dominickm.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 54.253.76.144 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-253-76-144.ap-southeast-2.compute.amazonaws.com Software nginx / Resource Hash e83f8d0b4a78d14185abfca96ee2fbaf18e396a047f725d944ff27a845787279 Request headers accept-language en-US,en;q=0.9 Referer https://workers-playground-red-credit-596b.dominickm.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Sat, 13 Jan 2024 20:36:00 GMT last-modified Sat, 14 May 2022 09:28:58 GMT server nginx accept-ranges bytes etag "1d8677509c266e0" content-length 4064 content-type image/png
GET H2	200	jquery.min.js Show response noon-working-oil.glitch.me/	84 KB 84 KB	397ms 305ms	Script application/javascript	44.208.108.45 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://noon-working-oil.glitch.me/jquery.min.js Requested by Host: workers-playground-red-credit-596b.dominickm.workers.dev URL: https://workers-playground-red-credit-596b.dominickm.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 44.208.108.45 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-208-108-45.compute-1.amazonaws.com Software AmazonS3 / Resource Hash fdce77a6d0053f32d231518a84a71bcab5c86045ed52369da00b89d4284aef46 Request headers accept-language en-US,en;q=0.9 Referer https://workers-playground-red-credit-596b.dominickm.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Sat, 13 Jan 2024 20:35:59 GMT x-amz-version-id nIKo3RWk6KMsp11PBotk5_7eLDGaqkK2 last-modified Fri, 17 Feb 2023 15:17:44 GMT server AmazonS3 x-amz-request-id KQYZ1C9CMB61WWAN etag "b354cc9d56a1da6b0c77604d1b153850" x-amz-server-side-encryption AES256 content-type application/javascript; charset=utf-8 cache-control no-cache accept-ranges bytes content-length 85577 x-amz-id-2 1JL3tY+K13tgpsTLQr4TE/E7Rvjbfrg/qXxidW1/Zkdnq5fl0lv9oKHLAYnTHhMDRjgixlTH1cE=
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	104ms 39ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: workers-playground-red-credit-596b.dominickm.workers.dev URL: https://workers-playground-red-credit-596b.dominickm.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://workers-playground-red-credit-596b.dominickm.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Sat, 13 Jan 2024 20:35:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 852 age 4540136 cdn-cachedat 10/31/2023 18:52:11 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:06 GMT cdn-proxyver 1.04 cdn-requestpullcode 200 server cloudflare etag W/"67176c242e1bdc20603c878dee836df3" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid ed766c17cdf45213b1538ae406b7f7a1 timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 84506dc6c8214bd5-BUF cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| image_save_msg string| no_menu_msg string| smessage function| disableEnterKey function| wccp_free_iscontenteditable function| disable_copy function| disable_copy_ie function| reEnable function| disableSelection function| onlongtouch undefined| timer number| touchduration string| elemtype function| touchstart function| touchend function| wccp_pro_is_passive function| nocontext function| $ function| jQuery object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ada978-docusign.webnotifications.net
noon-working-oil.glitch.me
stackpath.bootstrapcdn.com
workers-playground-red-credit-596b.dominickm.workers.dev
2606:4700:3034::ac43:c4a9
2606:4700::6812:bcf
44.208.108.45
54.253.76.144
0967c7ce43f94fc0fff220c107a7d024c13d609d5efcddbc4ab8b500f0a38db0
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
e83f8d0b4a78d14185abfca96ee2fbaf18e396a047f725d944ff27a845787279
fdce77a6d0053f32d231518a84a71bcab5c86045ed52369da00b89d4284aef46