urlscan.io logo urlscan.io
SecurityTrails logo

accounts-google.mail-subsystem.net Open in urlscan Pro
52.72.145.109  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Submission: On October 24 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 7 HTTP transactions. The main IP is 52.72.145.109, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is accounts-google.mail-subsystem.net.
This is the only time accounts-google.mail-subsystem.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

IP Address AS Autonomous System
1 52.72.145.109 14618 (AMAZON-AES)
1 205.185.208.52 20446 (HIGHWINDS3)
3 2a00:1450:400... 15169 (GOOGLE)
1 151.101.2.110 54113 (FASTLY)
1 162.247.242.21 23467 (NEWRELIC-...)
7 6
1    52.72.145.109 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-72-145-109.compute-1.amazonaws.com
accounts-google.mail-subsystem.net
1    205.185.208.52 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com
3    2a00:1450:4001:819::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
1    151.101.2.110 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com
1    162.247.242.21 (United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-9.nr-data.net
bam.nr-data.net
Domain Requested by
3 fonts.gstatic.com accounts-google.mail-subsystem.net
1 bam.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com accounts-google.mail-subsystem.net
1 code.jquery.com accounts-google.mail-subsystem.net
1 accounts-google.mail-subsystem.net
7 5

This site contains links to these domains. Also see Links.

Domain
support.google.com
accounts.google.com
Subject Issuer Validity Valid
jquery.org
COMODO RSA Domain Validation Secure Server CA		 2018-10-17 -
2020-10-16		 2 years crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2018-10-03 -
2019-04-14		 6 months crt.sh
*.nr-data.net
GeoTrust RSA CA 2018		 2018-01-11 -
2020-03-17		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Frame ID: 7F33666F2C0EDAA251D30AD1C891E470
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Cowboy/i
Overall confidence: 50%
Detected patterns
  • meta csrf-param /authenticity_token/i
Overall confidence: 100%
Detected patterns
  • headers server /Cowboy/i
Overall confidence: 50%
Detected patterns
  • meta csrf-param /authenticity_token/i
Overall confidence: 100%
Detected patterns
  • env /^NREUM/i
Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

7
Requests

43 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

121 kB
Transfer

178 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set x
accounts-google.mail-subsystem.net/ 		48 KB
49 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Protocol
HTTP/1.1
Server
52.72.145.109 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-72-145-109.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
e76815818b43fc75bf65615f7800427c9b5cfec2d635cf1153a00ff531ca6361
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
accounts-google.mail-subsystem.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
Cowboy
Date
Wed, 24 Oct 2018 19:59:36 GMT
Connection
keep-alive
X-Frame-Options
SAMEORIGIN
X-Xss-Protection
1; mode=block
X-Content-Type-Options
nosniff
Content-Type
text/html; charset=utf-8
Etag
"5224ef9efeba82f01c86bb8e08810751"
Cache-Control
max-age=0, private, must-revalidate
Set-Cookie
_bf_session=fa69da20320d788bcfe79401a3867d3a; path=/; HttpOnly
X-Request-Id
6382f35f-b72f-478c-afec-1ca8cd13ee59
X-Runtime
0.037846
Content-Length
49309
Via
1.1 vegur
jquery-3.3.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by
Host: accounts-google.mail-subsystem.net
URL: http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip052.ssl.hwcdn.net
Software
nginx /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Origin
http://accounts-google.mail-subsystem.net

Response headers

Date
Wed, 24 Oct 2018 19:59:37 GMT
Content-Encoding
gzip
Last-Modified
Sat, 20 Jan 2018 17:26:44 GMT
Server
nginx
ETag
W/"5a637bd4-1111d"
Vary
Accept-Encoding
X-HW
1540411177.dop034.fr8.shc,1540411177.dop034.fr8.t,1540411177.cds122.fr8.c
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
24038
truncated
/ 		267 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/svg+xml;charset=UTF-8
4UaGrENHsxJlGDuGo1OIlL3Owp5eKQtG.woff2
fonts.gstatic.com/s/googlesans/v5/ 		13 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/googlesans/v5/4UaGrENHsxJlGDuGo1OIlL3Owp5eKQtG.woff2
Requested by
Host: accounts-google.mail-subsystem.net
URL: http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Protocol
HTTP/1.1
Server
2a00:1450:4001:819::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c03973930be0917e068b56069faf0745f01fd2e17df213b13a81d235ea1ee83c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Origin
http://accounts-google.mail-subsystem.net

Response headers

Date
Tue, 02 Oct 2018 16:52:05 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 24 Jan 2018 02:51:09 GMT
Server
sffe
Age
1912052
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
13736
X-XSS-Protection
1; mode=block
Expires
Wed, 02 Oct 2019 16:52:05 GMT
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v18/ 		10 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: accounts-google.mail-subsystem.net
URL: http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Protocol
HTTP/1.1
Server
2a00:1450:4001:819::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Origin
http://accounts-google.mail-subsystem.net

Response headers

Date
Tue, 02 Oct 2018 06:22:56 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 16 Oct 2017 17:32:51 GMT
Server
sffe
Age
1949801
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
10748
X-XSS-Protection
1; mode=block
Expires
Wed, 02 Oct 2019 06:22:56 GMT
truncated
/ 		356 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bbb22484b6ac90a9bcddc4158e5b530c078c475b78ceab0a9873719ec7e87eb9

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
4UabrENHsxJlGDuGo1OIlLU94YtzCwZsPF4o.woff2
fonts.gstatic.com/s/googlesans/v5/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/googlesans/v5/4UabrENHsxJlGDuGo1OIlLU94YtzCwZsPF4o.woff2
Requested by
Host: accounts-google.mail-subsystem.net
URL: http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Protocol
HTTP/1.1
Server
2a00:1450:4001:819::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a266e6e616dfcd2a0a1f30467d5f69ce1d29068fe82ff5a049779d37b31c5af1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Origin
http://accounts-google.mail-subsystem.net

Response headers

Date
Tue, 02 Oct 2018 16:52:05 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 24 Jan 2018 02:51:16 GMT
Server
sffe
Age
1912052
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
13828
X-XSS-Protection
1; mode=block
Expires
Wed, 02 Oct 2019 16:52:05 GMT
nr-1099.min.js
js-agent.newrelic.com/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1099.min.js
Requested by
Host: accounts-google.mail-subsystem.net
URL: http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
685e511070d7d36ad071ea39c387547c95bf064727890a3e9abf1d0283184794

Request headers

Referer
http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 24 Oct 2018 19:59:37 GMT
content-encoding
gzip
x-amz-request-id
0F91A44CB8BB51BA
x-cache
HIT
status
200
content-length
9139
x-amz-id-2
1kVBDajyPe9yNfvcIt7CQoQq0Tgjcvk5nnkBUcfzhmZSMr1SxtHUg5CkTFq+7J8h180I4bkn1Zg=
x-served-by
cache-fra19120-FRA
last-modified
Tue, 02 Oct 2018 02:58:53 GMT
server
AmazonS3
x-timer
S1540411178.798890,VS0,VE0
etag
"eed931ffe2a555a310715cf8678d32f5"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
17123
c6ef57b9b6
bam.nr-data.net/1/ 		57 B
261 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/c6ef57b9b6?a=12583142&v=1099.d27c17c&to=IFZaQhRfCQ9dS0oUBxBMWEIVHxERWVoOOQEPUFddOVUdE1dKAA%3D%3D&rst=667&ref=http://accounts-google.mail-subsystem.net/x&qt=2&ap=29&be=317&fe=621&dc=560&perf=%7B%22timing%22:%7B%22of%22:1540411177146,%22n%22:0,%22f%22:0,%22dn%22:0,%22dne%22:63,%22c%22:63,%22ce%22:163,%22rq%22:163,%22rp%22:310,%22rpe%22:511,%22dl%22:312,%22di%22:560,%22ds%22:560,%22de%22:561,%22dc%22:620,%22l%22:620,%22le%22:622%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1099.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.21 , United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS
bam-9.nr-data.net
Software
/
Resource Hash
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer
http://accounts-google.mail-subsystem.net/x?a=ePMr5QG4e0Q&t=i1RXWaz-ov5DCv2TiTWCxo35O-I
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Expires
Thu, 01 Jan 1970 00:00:00 GMT
Content-Length
57
Content-Type
text/javascript;charset=ISO-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| NREUM object| newrelic function| __nr_require function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
accounts-google.mail-subsystem.net/ Name: _bf_session
Value: fa69da20320d788bcfe79401a3867d3a

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block