airlock.check.protechsco.com
Open in
urlscan Pro
23.229.151.40
Malicious Activity!
Public Scan
URL:
http://airlock.check.protechsco.com/job/decide/
Submission: On February 22 via automatic, source openphish
Submission: On February 22 via automatic, source openphish
Summary
This website contacted 5 IPs
in 2 countries
across 5 domains to perform 13 HTTP transactions.
The main IP is 23.229.151.40, located in
Scottsdale, United States and
belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US.
The main domain is airlock.check.protechsco.com.
This is the only time airlock.check.protechsco.com was scanned on urlscan.io!
This is the only time airlock.check.protechsco.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 23.229.151.40 23.229.151.40 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
| 2 | 2a00:1450:401... 2a00:1450:4010:c0d::84 | 15169 (GOOGLE) (GOOGLE - Google Inc.) | |
| 1 | 2a00:1450:400... 2a00:1450:400f:808::2003 | 15169 (GOOGLE) (GOOGLE - Google Inc.) | |
| 1 | 2a00:1450:401... 2a00:1450:4010:c0d::12 | 15169 (GOOGLE) (GOOGLE - Google Inc.) | |
| 13 | 5 |
8
23.229.151.40
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-23-229-151-40.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-23-229-151-40.ip.secureserver.net
| airlock.check.protechsco.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
protechsco.com
airlock.check.protechsco.com |
45 KB |
| 2 |
googleusercontent.com
themes.googleusercontent.com |
42 KB |
| 1 |
google.com
mail.google.com |
121 B |
| 1 |
gstatic.com
ssl.gstatic.com |
239 B |
| 0 |
youtube.com
Failed
accounts.youtube.com Failed |
|
| 13 | 5 |
| Domain | Requested by | |
|---|---|---|
| 8 | airlock.check.protechsco.com |
airlock.check.protechsco.com
|
| 2 | themes.googleusercontent.com |
airlock.check.protechsco.com
|
| 1 | mail.google.com |
airlock.check.protechsco.com
|
| 1 | ssl.gstatic.com |
airlock.check.protechsco.com
|
| 0 | accounts.youtube.com Failed |
airlock.check.protechsco.com
|
| 13 | 5 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| support.google.com |
| accounts.google.com |
| www.google.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.googleusercontent.com Google Internet Authority G2 |
2017-02-01 - 2017-04-26 |
3 months | crt.sh |
| mail.google.com Google Internet Authority G2 |
2017-02-01 - 2017-04-26 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
http://airlock.check.protechsco.com/job/decide/
Frame ID: 16644.1
Requests: 11 HTTP requests in this frame
Frame:
http://airlock.check.protechsco.com/job/decide/Gmail_files/CheckConnection.htm
Frame ID: 16644.2
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-550635585×tamp=1487751640405
Frame ID: 16644.3
Requests: 1 HTTP requests in this frame
5 Outgoing links
These are links going to different origins than the main page.
URL: https://support.google.com/accounts/?p=securesignin&hl=en
Title: Learn more
Title: Learn more
Search URL Search Domain Scan URL
URL: https://accounts.google.com/RecoverAccount?service=mail&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F
Title: Need help?
Title: Need help?
Search URL Search Domain Scan URL
URL: https://accounts.google.com/SignUp?service=mail&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F
Title: Create an account
Title: Create an account
Search URL Search Domain Scan URL
URL: https://accounts.google.com/TOS?loc=EG&hl=en
Title: Privacy & Terms
Title: Privacy & Terms
Search URL Search Domain Scan URL
URL: http://www.google.com/support/accounts?hl=en
Title: Help
Title: Help
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
airlock.check.protechsco.com/job/decide/ |
63 KB 22 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css.css
airlock.check.protechsco.com/job/decide/Gmail_files/ |
538 B 280 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo_2x.png
airlock.check.protechsco.com/job/decide/Gmail_files/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
avatar_2x.png
airlock.check.protechsco.com/job/decide/Gmail_files/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo_strip_2x.png
airlock.check.protechsco.com/job/decide/Gmail_files/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
universal_language_settings-21.png
airlock.check.protechsco.com/job/decide/Gmail_files/ |
199 B 199 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
CheckConnection.htm
airlock.check.protechsco.com/job/decide/Gmail_files/ Frame 1664 |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
CheckConnection
accounts.youtube.com/accounts/ Frame 1664 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff
themes.googleusercontent.com/static/fonts/opensans/v7/ |
21 KB 21 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
themes.googleusercontent.com/static/fonts/opensans/v7/ |
21 KB 21 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
checkmark.png
ssl.gstatic.com/ui/v1/menu/ |
239 B 239 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
c.gif
mail.google.com/mail/images/ |
131 B 121 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
airlock.check.protechsco.com/ |
0 0 |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- accounts.youtube.com
- URL
- https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-550635585×tamp=1487751640405
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| airlock.check.protechsco.com/job/decide/Gmail_files | Name: CheckConnectionTempCookie594 Value: 798823 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.youtube.com
airlock.check.protechsco.com
mail.google.com
ssl.gstatic.com
themes.googleusercontent.com
accounts.youtube.com
23.229.151.40
2a00:1450:400f:808::2003
2a00:1450:4010:c0d::12
2a00:1450:4010:c0d::84
08f6820d9c0244e1c1d222306bd9008a99b9bf05777366de83693e6f095e0807
2210e36b5b21e54cd4dc2ccdcc06138db8598d704ebf19052e5caa84edb4a675
4b188a0050e90f7f77af66f85c6ba73a0691f03d8893f888343e8e34af340e72
59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6
691b769a33e9fdb816f5094e96f5097db9e8a8724b13c04dc247f6189a51ad15
6e118069cad6bc385745e97ab703aa49da202a2db08e3d8c335021a4a66c341c
8b2e5ba8089dccceb66536831349b5f34730da240c7a7331a68b2572865d8335
a6a5d7cbfec632fa7463ebca7babf4b1971b785cd1a26b596d58b8a831001136
a97200185f4992c536e4b269f2b8a727c65a25795b99805d80e61bf135f2d4ca
b9876c49ea883cf289637c99b4f29fa51e66c517b31a48fde22ad18e65f2ebc2
be0328cfff391e3afa4e3781181d69cbe61d6d694ab4f62d622e4ad3ac619f3c