worker-cold-mouse-407e.sjshim.workers.dev

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 5 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is worker-cold-mouse-407e.sjshim.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on January 12th 2024. Valid for: 3 months.

This is the only time worker-cold-mouse-407e.sjshim.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	111.90.159.193 111.90.159.193	45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
2	142.250.185.138 142.250.185.138	15169 (GOOGLE) (GOOGLE)
1	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	45.120.70.166 45.120.70.166	3786 (LGDACOM L...) (LGDACOM LG DACOM Corporation)
5	4

1 111.90.159.193 (Malaysia)

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: server1.kamon.la

itproximal.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.138 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

worker-cold-mouse-407e.sjshim.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.120.70.166 (Korea, Republic Of)

ASN3786 (LGDACOM LG DACOM Corporation, KR)

static.hiworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 369	60 KB
1	hiworks.com static.hiworks.com	2 KB
1	workers.dev worker-cold-mouse-407e.sjshim.workers.dev	14 KB
1	itproximal.top itproximal.top	4 KB
5	4

	Domain	Requested by
2	ajax.googleapis.com	itproximal.top worker-cold-mouse-407e.sjshim.workers.dev
1	static.hiworks.com	worker-cold-mouse-407e.sjshim.workers.dev
1	worker-cold-mouse-407e.sjshim.workers.dev	itproximal.top
1	itproximal.top
5	4

This site contains links to these domains. Also see Links.

Domain
www.hiworks.com

Subject Issuer	Validity	Valid
cpanel.itproximal.top R3	`2024-01-15` - `2024-04-14`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
sjshim.workers.dev GTS CA 1P5	`2024-01-12` - `2024-04-11`	3 months	crt.sh
*.hiworks.com GlobalSign RSA OV SSL CA 2018	`2023-06-27` - `2024-07-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://worker-cold-mouse-407e.sjshim.workers.dev/
Frame ID: A052314D7586E37D0CD0568CD2310E32
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

하이웍스 로그인

Page URL History Show full URLs

https://itproximal.top/ Page URL
https://worker-cold-mouse-407e.sjshim.workers.dev/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

79 kB
Transfer

325 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.hiworks.com/
Title: ©Gabia Inc.

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://itproximal.top/ Page URL
https://worker-cold-mouse-407e.sjshim.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
itproximal.top/ 3 KB
4 KB 1075ms
283ms Document
text/html 111.90.159.193
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://itproximal.top/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 111.90.159.193 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: server1.kamon.la
Software: Apache /
Resource Hash: d28b3dd337004abb09e632aeba3c59676b3f4782f1fbaffe01f4b1324478a753

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 3546
Content-Type: text/html
Date: Tue, 16 Jan 2024 04:31:30 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Mon, 15 Jan 2024 22:10:27 GMT
Server: Apache

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 430ms
36ms Script
text/javascript 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: itproximal.top
URL: https://itproximal.top/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f10.1e100.net

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://itproximal.top/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Sun, 14 Jan 2024 17:18:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126805
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30399
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 13 Jan 2025 17:18:08 GMT

GET
H2 200 Primary Request / Show response
worker-cold-mouse-407e.sjshim.workers.dev/ 148 KB
14 KB 478ms
42ms Document
text/html 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://worker-cold-mouse-407e.sjshim.workers.dev/
Requested by: Host: itproximal.top
URL: https://itproximal.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed3bfac7e96cf955191aef355b27df3ca5b81922b15b1540cc79ab71966d8a65

Request headers

Referer: https://itproximal.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-ray: 8463a12b5dfd0e07-MXP
content-encoding: br
content-type: text/html;charset=UTF-8
date: Tue, 16 Jan 2024 04:31:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=csrnYeZT7VW6zFfQAkW0%2FF0yUyc3Bh0YcE%2FYqkhJZowEqnp10JaUrmSlch2SnxgeO7uJZYhFA78zBnYWw8HjJVzuHUagufAgo6MUQrUgUHeN%2B%2Ftey3DoMDSvE0FOCMqhy%2FFjbFkdW17hBTXi3oixhyhsSI2pslcN9cjHlg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 30ms
29ms Script
text/javascript 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: worker-cold-mouse-407e.sjshim.workers.dev
URL: https://worker-cold-mouse-407e.sjshim.workers.dev/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f10.1e100.net

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://worker-cold-mouse-407e.sjshim.workers.dev/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Sun, 14 Jan 2024 17:18:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126805
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30399
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 13 Jan 2025 17:18:08 GMT

GET
H/1.1 200
OK logo.svg
static.hiworks.com/asp/files/ 3 KB
2 KB 2124ms
318ms Image
image/svg+xml 45.120.70.166
LGDACOM LG DACOM ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.hiworks.com/asp/files/logo.svg
Requested by: Host: worker-cold-mouse-407e.sjshim.workers.dev
URL: https://worker-cold-mouse-407e.sjshim.workers.dev/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.120.70.166 , Korea, Republic Of, ASN3786 (LGDACOM LG DACOM Corporation, KR),
Reverse DNS
Software: nginx /
Resource Hash: 6dd5762957434ff1358e79f271e1cf8e9475116ea9cea655050185cf0c82d3c3

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://worker-cold-mouse-407e.sjshim.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 04:31:35 GMT
content-encoding: gzip
last-modified: Mon, 15 Jan 2024 04:24:53 GMT
server: nginx
etag: W/"65a4b395-c3f"
transfer-encoding: chunked
content-type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://itproximal.top/(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://itproximal.top/(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
rendering	warning	URL: https://worker-cold-mouse-407e.sjshim.workers.dev/(Line 3) Message: The key "user-scaleable" is not recognized and ignored.
javascript	warning	URL: https://worker-cold-mouse-407e.sjshim.workers.dev/(Line 3) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://worker-cold-mouse-407e.sjshim.workers.dev/(Line 3) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
itproximal.top
static.hiworks.com
worker-cold-mouse-407e.sjshim.workers.dev
111.90.159.193
142.250.185.138
188.114.96.3
45.120.70.166
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
6dd5762957434ff1358e79f271e1cf8e9475116ea9cea655050185cf0c82d3c3
d28b3dd337004abb09e632aeba3c59676b3f4782f1fbaffe01f4b1324478a753
ed3bfac7e96cf955191aef355b27df3ca5b81922b15b1540cc79ab71966d8a65

worker-cold-mouse-407e.sjshim.workers.dev Open in urlscan Pro 188.114.96.3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

4 Countries

79 kBTransfer

325 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

5 Console Messages

Indicators

worker-cold-mouse-407e.sjshim.workers.dev Open in urlscan Pro
188.114.96.3 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

79 kB
Transfer

325 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions