accounts.google.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 3 HTTP transactions. The main IP is 216.58.206.13, located in Mountain View, United States and belongs to GOOGLE - Google LLC, US. The main domain is accounts.google.com.
TLS certificate: Issued by Google Internet Authority G2 on March 7th 2018. Valid for: 3 months.

This is the only time accounts.google.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	199.250.192.229 199.250.192.229	54641 (INMOTI-1) (INMOTI-1 - InMotion Hosting)
2 2	216.58.206.5 216.58.206.5	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	216.58.206.4 216.58.206.4	15169 (GOOGLE) (GOOGLE - Google LLC)
1	216.58.206.13 216.58.206.13	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2

3 199.250.192.229 (Hogansville, United States) 1 redirects

ASN54641 (INMOTI-1 - InMotion Hosting, Inc., US)
PTR: ecbiz244.inmotionhosting.com

purchaseclothing.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.5 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f5.1e100.net

gmail.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mail.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.4 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.13 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f13.1e100.net

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	google.com 2 redirects www.google.com mail.google.com accounts.google.com	447 B
3	purchaseclothing.biz 1 redirects purchaseclothing.biz	44 KB
1	gmail.com 1 redirects gmail.com	213 B
3	3

	Domain	Requested by
3	purchaseclothing.biz	1 redirects purchaseclothing.biz
1	accounts.google.com
1	mail.google.com	1 redirects
1	www.google.com	1 redirects
1	gmail.com	1 redirects
3	5

This site contains no links.

Subject Issuer	Validity	Valid
accounts.google.com Google Internet Authority G2	`2018-03-07` - `2018-05-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=https://mail.google.com/mail/&ss=1&scc=1&ltmpl=googlemail&emr=1&osid=1
Frame ID: 26BFD8006D1F8CEE47EC20B4F7C11B5E
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://purchaseclothing.biz/SSSS.php HTTP 302
http://purchaseclothing.biz/petrurd.php Page URL
http://gmail.com/ HTTP 307
https://gmail.com/ HTTP 301
https://www.google.com/gmail/ HTTP 302
https://mail.google.com/mail/ HTTP 302
https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=https://mail.google... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

3
Requests

33 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

2
IPs

1
Countries

44 kB
Transfer

364 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://purchaseclothing.biz/SSSS.php HTTP 302
http://purchaseclothing.biz/petrurd.php Page URL
http://gmail.com/ HTTP 307
https://gmail.com/ HTTP 301
https://www.google.com/gmail/ HTTP 302
https://mail.google.com/mail/ HTTP 302
https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=https://mail.google.com/mail/&ss=1&scc=1&ltmpl=googlemail&emr=1&osid=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://purchaseclothing.biz/SSSS.php HTTP 302
http://purchaseclothing.biz/petrurd.php

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

petrurd.php Show response
purchaseclothing.biz/
Redirect Chain

http://purchaseclothing.biz/SSSS.php
http://purchaseclothing.biz/petrurd.php

259 B
492 B

270ms
188ms

Document
text/html

199.250.192.229
InMotion Hosting

General

Check archive.org

Show headers Download Go to

Full URL: http://purchaseclothing.biz/petrurd.php
Protocol: HTTP/1.1
Server: 199.250.192.229 Hogansville, United States, ASN54641 (INMOTI-1 - InMotion Hosting, Inc., US),
Reverse DNS: ecbiz244.inmotionhosting.com
Software: Apache / PHP/7.0.22
Resource Hash: 5e52722f54df8741bc01501fd680ec00dee9afb7579130a796d3d913749350bb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: purchaseclothing.biz
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 27 Mar 2018 10:03:07 GMT
Server: Apache
Connection: Keep-Alive
X-Powered-By: PHP/7.0.22
Transfer-Encoding: chunked
Keep-Alive: timeout=3, max=99
Content-Type: text/html; charset=utf-8

Redirect headers

Date: Tue, 27 Mar 2018 10:03:01 GMT
Server: Apache
X-Powered-By: PHP/7.0.22
Transfer-Encoding: chunked
Upgrade: h2,h2c
Location: http://purchaseclothing.biz/petrurd.php
Connection: Upgrade, Keep-Alive
Content-Type: text/html; charset=utf-8
Keep-Alive: timeout=3, max=100

GET
H/1.1 200
OK sidscr.gif
purchaseclothing.biz/ 43 KB
44 KB 92ms
92ms Image
image/gif 199.250.192.229
InMotion Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://purchaseclothing.biz/sidscr.gif
Requested by: Host: purchaseclothing.biz
URL: http://purchaseclothing.biz/petrurd.php
Protocol: HTTP/1.1
Server: 199.250.192.229 Hogansville, United States, ASN54641 (INMOTI-1 - InMotion Hosting, Inc., US),
Reverse DNS: ecbiz244.inmotionhosting.com
Software: Apache /
Resource Hash: 9a51c211be774486298952cc47d5ac94fd0aa9b2ad619988a1c999ca92977ace

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: purchaseclothing.biz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://purchaseclothing.biz/petrurd.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://purchaseclothing.biz/petrurd.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 27 Mar 2018 10:03:07 GMT
Last-Modified: Wed, 21 Mar 2018 13:02:49 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/gif
Keep-Alive: timeout=3, max=100
Content-Length: 44337

GET
H2

200

Primary Request ServiceLogin
accounts.google.com/
Redirect Chain

http://gmail.com/
https://gmail.com/
https://www.google.com/gmail/
https://mail.google.com/mail/
https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=https://mail.google.com/mail/&ss=1&scc=1&ltmpl=googlemail&emr=1&osid=1

320 KB
0

59ms
47ms

Document
text/html

216.58.206.13
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=https://mail.google.com/mail/&ss=1&scc=1&ltmpl=googlemail&emr=1&osid=1

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.58.206.13 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s20-in-f13.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-OZUFDdPpcrhFv0jzucmWQetQ56Y' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:path: /ServiceLogin?service=mail&passive=true&rm=false&continue=https://mail.google.com/mail/&ss=1&scc=1&ltmpl=googlemail&emr=1&osid=1
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: accounts.google.com
referer: http://purchaseclothing.biz/petrurd.php
:scheme: https
:method: GET
Referer: http://purchaseclothing.biz/petrurd.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Tue, 27 Mar 2018 10:03:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
x-auto-login: realm=com.google&args=service%3Dmail%26continue%3Dhttps%253A%252F%252Fmail.google.com%252Fmail%252F
alt-svc: hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
x-xss-protection: 1; mode=block
pragma: no-cache
server: GSE
x-frame-options: DENY
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-security-policy: script-src 'report-sample' 'nonce-OZUFDdPpcrhFv0jzucmWQetQ56Y' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
set-cookie: GAPS=1:zKHLW7-ipRXbVJLg9_i347L_ZhjApQ:vPcyX3hZ2_nxwO7W;Path=/;Expires=Thu, 26-Mar-2020 10:03:13 GMT;Secure;HttpOnly;Priority=HIGH
link: <https://www.google.com/gmail/>; rel="canonical"
expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Mar 2018 10:03:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
status: 302
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=https://mail.google.com/mail/&ss=1&scc=1&ltmpl=googlemail&emr=1&osid=1#
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 255
x-xss-protection: 1; mode=block
expires: Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| WIZ_global_data object| botguard string| viewPathPrefix

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
gmail.com
mail.google.com
purchaseclothing.biz
www.google.com
199.250.192.229
216.58.206.13
216.58.206.4
216.58.206.5
5e52722f54df8741bc01501fd680ec00dee9afb7579130a796d3d913749350bb
9a51c211be774486298952cc47d5ac94fd0aa9b2ad619988a1c999ca92977ace

accounts.google.com Open in urlscan Pro 216.58.206.13 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

33 %HTTPS

0 %IPv6

3 Domains

5 Subdomains

2 IPs

1 Countries

44 kBTransfer

364 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

Indicators

accounts.google.com Open in urlscan Pro
216.58.206.13 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

33 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

2
IPs

1
Countries

44 kB
Transfer

364 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions