grcico.icu Open in urlscan Pro
157.230.97.17  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response grcico.icu/	730 KB 242 KB	159ms 43ms	Document text/html	157.230.97.17 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://grcico.icu:9001/?rid=aPP6E5U Protocol H2 Security TLS 1.3, , AES_128_GCM Server 157.230.97.17 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash 72d5587b2b7be6629a4bc352734c15c49d03e184c5bd422d75a91021967dc179 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html; charset=utf-8 date Thu, 14 Sep 2023 07:08:37 GMT vary Accept-Encoding x-server gophish
GET H2	200	CheckConnection accounts.youtube.com/accounts/ Frame 1E0C	0 0	84ms 38ms	Document text/html	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1838497349&timestamp=1494410966271 Requested by Host: grcico.icu URL: https://grcico.icu:9001/?rid=aPP6E5U Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value Content-Security-Policy frame-ancestors https://accounts.google.com require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport script-src 'report-sample' 'nonce-2G6PGB1wWnClLl58blU7Jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist X-Content-Type-Options nosniff X-Frame-Options ALLOW-FROM https://accounts.google.com X-Xss-Protection 0 Request headers Referer https://grcico.icu:9001/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy frame-ancestors https://accounts.google.com require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport script-src 'report-sample' 'nonce-2G6PGB1wWnClLl58blU7Jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist content-type text/html; charset=utf-8 cross-origin-opener-policy same-origin cross-origin-resource-policy cross-origin date Thu, 14 Sep 2023 07:08:37 GMT expires Mon, 01 Jan 1990 00:00:00 GMT permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=* pragma no-cache server ESF x-content-type-options nosniff x-frame-options ALLOW-FROM https://accounts.google.com x-xss-protection 0
GET DATA	200 OK	truncated /	267 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 Response headers Content-Type image/svg+xml;charset=UTF-8
GET		rs=ABkqax34pTwodLUPj0IR_xgl75kwcVTRZw ssl.gstatic.com/accounts/static/_/js/k=gaia.gaiafe_glif.en.knP5S-0KJx4.O/m=initialpage/am=gggAAABoQEFAjoIV4DE/rt=j/	0 0
GET H2	200	CheckConnection accounts.youtube.com/accounts/ Frame 2290	0 0	68ms 66ms	Document text/html	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1838497349&timestamp=1694675317516 Requested by Host: URL: /accounts/static/_/js/k=gaia.gaiafe_glif.en.knP5S-0KJx4.O/m=glifb,identifier,unknownerror/am=gggAAABoQEFAjoIV4DE/rt=j/d=1/rs=ABkqax34pTwodLUPj0IR_xgl75kwcVTRZw Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value Content-Security-Policy frame-ancestors https://accounts.google.com script-src 'report-sample' 'nonce--MAr6wocVutPgqgUJfjm4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport X-Content-Type-Options nosniff X-Frame-Options ALLOW-FROM https://accounts.google.com X-Xss-Protection 0 Request headers Referer https://grcico.icu:9001/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy frame-ancestors https://accounts.google.com script-src 'report-sample' 'nonce--MAr6wocVutPgqgUJfjm4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport content-type text/html; charset=utf-8 cross-origin-opener-policy same-origin cross-origin-resource-policy cross-origin date Thu, 14 Sep 2023 07:08:37 GMT expires Mon, 01 Jan 1990 00:00:00 GMT permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=* pragma no-cache server ESF x-content-type-options nosniff x-frame-options ALLOW-FROM https://accounts.google.com x-xss-protection 0
POST H2	404	jserror Show response grcico.icu/	19 B 88 B	21ms 18ms	XHR text/plain	157.230.97.17 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://grcico.icu:9001/jserror Requested by Host: URL: /accounts/static/_/js/k=gaia.gaiafe_glif.en.knP5S-0KJx4.O/m=glifb,identifier,unknownerror/am=gggAAABoQEFAjoIV4DE/rt=j/d=1/rs=ABkqax34pTwodLUPj0IR_xgl75kwcVTRZw Protocol H2 Security TLS 1.3, , AES_128_GCM Server 157.230.97.17 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://grcico.icu:9001/?rid=aPP6E5U accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 Content-Type application/x-www-form-urlencoded;charset=UTF-8 Response headers date Thu, 14 Sep 2023 07:08:37 GMT x-content-type-options nosniff content-length 19 vary Accept-Encoding content-type text/plain; charset=utf-8
POST H2	404	jserror Show response grcico.icu/	19 B 43 B	36ms 35ms	XHR text/plain	157.230.97.17 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://grcico.icu:9001/jserror Requested by Host: URL: /accounts/static/_/js/k=gaia.gaiafe_glif.en.knP5S-0KJx4.O/m=glifb,identifier,unknownerror/am=gggAAABoQEFAjoIV4DE/rt=j/d=1/rs=ABkqax34pTwodLUPj0IR_xgl75kwcVTRZw Protocol H2 Security TLS 1.3, , AES_128_GCM Server 157.230.97.17 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://grcico.icu:9001/?rid=aPP6E5U accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 Content-Type application/x-www-form-urlencoded;charset=UTF-8 Response headers date Thu, 14 Sep 2023 07:08:37 GMT x-content-type-options nosniff content-length 19 vary Accept-Encoding content-type text/plain; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

ssl.gstatic.com

URL

https://ssl.gstatic.com/accounts/static/_/js/k=gaia.gaiafe_glif.en.knP5S-0KJx4.O/m=initialpage/am=gggAAABoQEFAjoIV4DE/rt=j/rs=ABkqax34pTwodLUPj0IR_xgl75kwcVTRZw

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| documentPictureInPicture object| WIZ_global_data object| botguard string| viewPathPrefix boolean| cssLoaded string| _F_jsUrl object| _G object| postmessage function| _F_getAverageFps function| _DumpException function| _B_err object| closure_lm_10715 function| setDgResult function| AF_initDataInitializeCallback function| AF_initDataCallback object| ID_wizbind function| wiz_progress object| AF_initDataKeys object| AF_dataServiceRequests object| AF_initDataChunkQueue number| closure_uid_157751642

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://grcico.icu:9001/jserror Message: Failed to load resource: the server responded with a status of 404 ()
security	error	Message: Refused to frame 'https://accounts.youtube.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://accounts.google.com".
network	error	URL: https://grcico.icu:9001/jserror Message: Failed to load resource: the server responded with a status of 404 ()
security	error	Message: Refused to frame 'https://accounts.youtube.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://accounts.google.com".
javascript	error	URL: https://grcico.icu:9001/?rid=aPP6E5U Message: Access to XMLHttpRequest at 'https://ssl.gstatic.com/accounts/static/_/js/k=gaia.gaiafe_glif.en.knP5S-0KJx4.O/m=initialpage/am=gggAAABoQEFAjoIV4DE/rt=j/rs=ABkqax34pTwodLUPj0IR_xgl75kwcVTRZw' from origin 'https://grcico.icu:9001' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ssl.gstatic.com/accounts/static/_/js/k=gaia.gaiafe_glif.en.knP5S-0KJx4.O/m=initialpage/am=gggAAABoQEFAjoIV4DE/rt=j/rs=ABkqax34pTwodLUPj0IR_xgl75kwcVTRZw Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.youtube.com
grcico.icu
ssl.gstatic.com
ssl.gstatic.com
157.230.97.17
2a00:1450:4001:811::200e
72d5587b2b7be6629a4bc352734c15c49d03e184c5bd422d75a91021967dc179
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793