hello-world-silent-sea-f915.bewovik144.workers.dev

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 2606:4700:3036::ac43:a831, located in United States and belongs to CLOUDFLARENET, US. The main domain is hello-world-silent-sea-f915.bewovik144.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on March 8th 2024. Valid for: 3 months.

This is the only time hello-world-silent-sea-f915.bewovik144.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3036::ac43:a831	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
3	3

2 2606:4700:3036::ac43:a831 (United States)

ASN13335 (CLOUDFLARENET, US)

hello-world-silent-sea-f915.bewovik144.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	workers.dev hello-world-silent-sea-f915.bewovik144.workers.dev	49 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1217	78 KB
3	2

	Domain	Requested by
2	hello-world-silent-sea-f915.bewovik144.workers.dev	hello-world-silent-sea-f915.bewovik144.workers.dev
1	code.jquery.com	hello-world-silent-sea-f915.bewovik144.workers.dev
3	2

This site contains links to these domains. Also see Links.

Domain
www.premierpawn.com

Subject Issuer	Validity	Valid
bewovik144.workers.dev GTS CA 1P5	`2024-03-08` - `2024-06-06`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://hello-world-silent-sea-f915.bewovik144.workers.dev/
Frame ID: 9220A620575708CA8BC7179FDB0D1A14
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign | SharePoint

Page URL History Show full URLs

http://hello-world-silent-sea-f915.bewovik144.workers.dev/ HTTP 307
https://hello-world-silent-sea-f915.bewovik144.workers.dev/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

3
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

127 kB
Transfer

356 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.premierpawn.com/rrt/xxtb/sharepoints/sharepoints.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&email=dXpvaGlmZWFueWlAb3V0bG9vay5jb20=#home
Title: SharePoint

Search URL Search Domain Scan URL

URL: https://www.premierpawn.com/rrt/xxtb/sharepoints/sharepoints.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&email=dXpvaGlmZWFueWlAb3V0bG9vay5jb20=#news
Title: DOC Q0017 - 3512C.Doc

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://hello-world-silent-sea-f915.bewovik144.workers.dev/ HTTP 307
https://hello-world-silent-sea-f915.bewovik144.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response hello-world-silent-sea-f915.bewovik144.workers.dev/ Redirect Chain http://hello-world-silent-sea-f915.bewovik144.workers.dev/ https://hello-world-silent-sea-f915.bewovik144.workers.dev/	36 KB 24 KB	77ms 32ms	Document text/html	2606:4700:3036::ac43:a831 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hello-world-silent-sea-f915.bewovik144.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:a831 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c95356cb6cc79c8d60d8ac51fa038b09055dd814e913c7dae5afd72671b3203f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-ray 868ccc9d48d44d74-FRA content-encoding br content-type text/html;charset=UTF-8 date Sat, 23 Mar 2024 07:44:58 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9LsA0%2F5de1Cw5WZi2w%2FRhv%2BbB5BfQBXVeMG0fzED%2FMJzECy4GxnwBmEG5nVrDXE%2Fb96b4gjc9dvbgMdk5XfIL4iMlI4Qz6WGb55DgU9XoJsCquisbfxrpAO%2BdLc%2FOzAdXc8Ub4J0h9WCmIYsByj0q%2FB%2BFxn4nlwHNat%2FaZdtNxkalSXUjKc0HNRprMJv%2BHwdxg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding Redirect headers Cross-Origin-Resource-Policy Cross-Origin Location https://hello-world-silent-sea-f915.bewovik144.workers.dev/ Non-Authoritative-Reason HSTS
GET H2	200	myscr584876.js.download Show response hello-world-silent-sea-f915.bewovik144.workers.dev/index_files/	36 KB 24 KB	18ms 17ms	Script text/html	2606:4700:3036::ac43:a831 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hello-world-silent-sea-f915.bewovik144.workers.dev/index_files/myscr584876.js.download Requested by Host: hello-world-silent-sea-f915.bewovik144.workers.dev URL: https://hello-world-silent-sea-f915.bewovik144.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:a831 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c95356cb6cc79c8d60d8ac51fa038b09055dd814e913c7dae5afd72671b3203f` Request headers accept-language de-DE,de;q=0.9 Referer https://hello-world-silent-sea-f915.bewovik144.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Sat, 23 Mar 2024 07:44:58 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8ouNgsm3g8M4QdsMhkWmVZDg09Ato%2BQbCmRiFkjbo0i2oh39jMDTICs0Lu7ThQzeGTqzKD%2B3dDhKB7dhIrbq2t%2FFm06XBeJThrIfk5kvq8Jwiz38j40Cl%2BAH5v%2FTEkYPs9CbqsuYTlxd9gIAbyzb%2FQDWRALxCQv2yePIvo5G%2FtdmqwwFfH0NHu3KEOS2kcNcXg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 868ccc9d79074d74-FRA alt-svc h3=":443"; ma=86400
GET H2	200	jquery-1.9.1.js Show response code.jquery.com/	262 KB 78 KB	40ms 6ms	Script application/javascript	2a04:4e42::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.9.1.js Requested by Host: hello-world-silent-sea-f915.bewovik144.workers.dev URL: https://hello-world-silent-sea-f915.bewovik144.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash `7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40` Request headers accept-language de-DE,de;q=0.9 Referer https://hello-world-silent-sea-f915.bewovik144.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Sat, 23 Mar 2024 07:44:58 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 5755761 x-cache HIT, HIT content-length 79506 x-served-by cache-lga21952-LGA, cache-fra-eddf8230138-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1711179899.510879,VS0,VE0 etag W/"28feccc0-4185d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 16, 16224
GET DATA	200 OK	truncated /	9 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	13 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
hello-world-silent-sea-f915.bewovik144.workers.dev
2606:4700:3036::ac43:a831
2a04:4e42::649
5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece
c95356cb6cc79c8d60d8ac51fa038b09055dd814e913c7dae5afd72671b3203f

hello-world-silent-sea-f915.bewovik144.workers.dev Open in urlscan Pro 2606:4700:3036::ac43:a831 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

127 kBTransfer

356 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

hello-world-silent-sea-f915.bewovik144.workers.dev Open in urlscan Pro
2606:4700:3036::ac43:a831 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

127 kB
Transfer

356 kB
Size

0
Cookies

3 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!