accounts.security-notifications-google.com Open in urlscan Pro
172.67.141.98 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://accounts.security-notifications-google.com/
Submission: On August 18 via automatic, source certstream-suspicious (August 18th 2024, 2:01:27 pm UTC) — Scanned from US

Summary HTTP 2 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 172.67.141.98, located in United States and belongs to CLOUDFLARENET, US. The main domain is accounts.security-notifications-google.com.
TLS certificate: Issued by WE1 on August 12th 2024. Valid for: 3 months.

This is the only time accounts.security-notifications-google.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address		AS Autonomous System
2	172.67.141.98 172.67.141.98		13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2

2 172.67.141.98 (United States)

ASN13335 (CLOUDFLARENET, US)

accounts.security-notifications-google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	security-notifications-google.com accounts.security-notifications-google.com	380 KB
2	1

	Domain	Requested by
2	accounts.security-notifications-google.com	accounts.security-notifications-google.com
2	1

This site contains links to these domains. Also see Links.

Domain
support.google.com
accounts.google.com

Subject Issuer	Validity	Valid
security-notifications-google.com WE1	`2024-08-12` - `2024-11-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://accounts.security-notifications-google.com/
Frame ID: 81E3291B92DD8943E9CD258C18D073F6
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Gmail

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

486 kB
Transfer

1260 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://support.google.com/accounts?hl=en
Title: Help

Search URL Search Domain Scan URL

URL: https://accounts.google.com/TOS?loc=US&hl=en&privacy=true
Title: Privacy

Search URL Search Domain Scan URL

URL: https://accounts.google.com/TOS?loc=US&hl=en
Title: Terms

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
accounts.security-notifications-google.com/ 1 MB
379 KB 513ms
411ms Document
text/html 172.67.141.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://accounts.security-notifications-google.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.141.98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7440b91b5a633f845ce87a053e51b790605a6d5d2a3aa3e54f35a4212b5405e5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8b526f7888360918-LAX
content-encoding: br
content-type: text/html
date: Sun, 18 Aug 2024 14:01:22 GMT
last-modified: Sat, 17 Aug 2024 20:21:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rnbvs3SHJtaUaxfO71MqnQRrtzzdMF72oemBQpx0qSAVbxOdQx0asinDB%2FiEvXDD6udUD5xHselg2Gds3%2Bm3hwzxgGvwuva3M6Tg7dgG7bjI9UyuSyFStktowg3np8Dk3Vm8WGgLo4pDbt%2FN4TR%2BdRw6NOa2Bg4G8Y4kr9Y%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 email-decode.min.js Show response
accounts.security-notifications-google.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 76ms
75ms Script
application/javascript 172.67.141.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.security-notifications-google.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: accounts.security-notifications-google.com
URL: https://accounts.security-notifications-google.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.141.98 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://accounts.security-notifications-google.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 18 Aug 2024 14:01:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Aug 2024 15:30:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"66b635fa-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tRJ7vzs3MZ%2FlMhyThLYvT4TtYHMnFNnCU1RSQtQD5i%2Fk1VPupqYRd%2B6d8nJHCaR6DoH73W0pLrWhqvnBZitjfls6jysnEdyAF%2F5OWafeYIe5qZqgrTj55tZijWmDOB0N1dhGWegys6cEHtGSVMq%2FbszHdNdX9gRHvnqaHBk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 8b526f7fbf400918-LAX
expires: Tue, 20 Aug 2024 14:01:23 GMT

GET
DATA 200
OK truncated
/ 267 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
DATA 200
OK truncated
/ 21 KB
21 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

Request headers

Referer
Origin: https://accounts.security-notifications-google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 21 KB
21 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

Request headers

Referer
Origin: https://accounts.security-notifications-google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Request headers

Referer
Origin: https://accounts.security-notifications-google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Request headers

Referer
Origin: https://accounts.security-notifications-google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 12 KB
12 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dbb8f45730d91bffff8307cfdf7c82e67745d84cb6063a1f3880fadfad59c57d

Request headers

Referer
Origin: https://accounts.security-notifications-google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0dfa6a82824cf2be6bb8543de6ef56b87daae5dd63f9e68c88f02697f94af740

Request headers

Referer
Origin: https://accounts.security-notifications-google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9ca415df2c57b1f26947351c66ccfaf99d2f8f01b4b8de019a3ae6f3a9c780c7

Request headers

Referer
Origin: https://accounts.security-notifications-google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 53f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361

Request headers

Referer
Origin: https://accounts.security-notifications-google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| myFunction function| nextpass

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.security-notifications-google.com
172.67.141.98
0dfa6a82824cf2be6bb8543de6ef56b87daae5dd63f9e68c88f02697f94af740
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
53f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
7440b91b5a633f845ce87a053e51b790605a6d5d2a3aa3e54f35a4212b5405e5
9ca415df2c57b1f26947351c66ccfaf99d2f8f01b4b8de019a3ae6f3a9c780c7
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
dbb8f45730d91bffff8307cfdf7c82e67745d84cb6063a1f3880fadfad59c57d

accounts.security-notifications-google.com Open in urlscan Pro 172.67.141.98 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

486 kBTransfer

1260 kBSize

0 Cookies

3 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

accounts.security-notifications-google.com Open in urlscan Pro
172.67.141.98 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

486 kB
Transfer

1260 kB
Size

0
Cookies

2 HTTP transactions
9 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!