urlscan.io logo urlscan.io
SecurityTrails logo

google.loginprotections.com Open in urlscan Pro
154.62.109.199  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://google.loginprotections.com/
Submission: On May 01 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 10 HTTP transactions. The main IP is 154.62.109.199, located in Vilnius, Lithuania and belongs to AS-HOSTINGER, CY. The main domain is google.loginprotections.com.
TLS certificate: Issued by R3 on May 1st 2024. Valid for: 3 months.
This is the only time google.loginprotections.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

IP Address AS Autonomous System
2 154.62.109.199 47583 (AS-HOSTINGER)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 162.19.58.156 16276 (OVH)
5 172.67.139.119 13335 (CLOUDFLAR...)
10 5
Apex Domain
Subdomains		 Transfer
6 fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 1791
ka-f.fontawesome.com — Cisco Umbrella Rank: 4267
189 KB
2 loginprotections.com
google.loginprotections.com
4 KB
1 ibb.co
i.ibb.co — Cisco Umbrella Rank: 11175
29 KB
0 googleapis.com Failed
fonts.googleapis.com Failed
10 4
Domain Requested by
5 ka-f.fontawesome.com kit.fontawesome.com
2 google.loginprotections.com
1 i.ibb.co google.loginprotections.com
1 kit.fontawesome.com google.loginprotections.com
0 fonts.googleapis.com Failed google.loginprotections.com
10 5

This site contains no links.

Subject Issuer Validity Valid
google.loginprotections.com
R3		 2024-05-01 -
2024-07-30		 3 months crt.sh
*.fontawesome.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-12-04 -
2025-01-03		 a year crt.sh
ibb.co
R3		 2024-04-22 -
2024-07-21		 3 months crt.sh
ka-f.fontawesome.com
GTS CA 1P5		 2024-03-05 -
2024-06-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://google.loginprotections.com/
Frame ID: E1D48A204E4BBC10F74C204CA787539B
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Google

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • kit\.fontawesome\.com/([0-9a-z]+).js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

10
Requests

90 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

222 kB
Transfer

335 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
google.loginprotections.com/ 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://google.loginprotections.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
154.62.109.199 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
2b0e28fa93e92ff5aacc4f8bb9a1be090bbf075815ddd74261dbe5b88a092137

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Wed, 01 May 2024 03:18:32 GMT
ETag
W/"66311d1d-15ab"
Last-Modified
Tue, 30 Apr 2024 16:32:29 GMT
Server
nginx/1.18.0 (Ubuntu)
Transfer-Encoding
chunked
css2
fonts.googleapis.com/ 		0
0
cae01f65b9.js
kit.fontawesome.com/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kit.fontawesome.com/cae01f65b9.js
Requested by
Host: google.loginprotections.com
URL: https://google.loginprotections.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c0b2fcbf51fd1461d45b9048a10863c4c1acc6f8004100cd03baa32f5dcb801

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Origin
https://google.loginprotections.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 03:18:32 GMT
content-encoding
gzip
cf-cache-status
MISS
server
cloudflare
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age
3000
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
*
content-type
text/javascript
cache-control
max-age=60, public, stale-while-revalidate=30
cf-ray
87cc9ff54d1f1e5c-FRA
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id
F8s_JWDufi-LhXzDh1pC
Google-Logo-wine.png
i.ibb.co/vwYVFHN/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/vwYVFHN/Google-Logo-wine.png
Requested by
Host: google.loginprotections.com
URL: https://google.loginprotections.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.58.156 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3096358.ip-162-19-58.eu
Software
nginx /
Resource Hash
51a9d448eca1c3d1263c8cb1598c8262eed999d838c1152cb3a0537572db0e26

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 03:18:32 GMT
last-modified
Mon, 22 Apr 2024 06:13:55 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
29805
expires
Thu, 31 Dec 2037 23:55:55 GMT
free.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ 		101 KB
24 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.5.2/css/free.min.css?token=cae01f65b9
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/cae01f65b9.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e9c73fa687cd4110688668977a7caa87f5a1dee0d11f03687bd4871deedf1c1

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 03:18:33 GMT
via
1.1 0363fab377de19b9b4f85394469f6fca.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 02 Apr 2024 15:26:25 GMT
server
cloudflare
etag
W/"7f29cd8c97789aa298af8c61623ca28b"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D16GM5uFmugOsr0nvRN9kRhbE75Ujgx39aqKrQ6BRVU0s23tHuksVyuPSd%2BuO4UA7Z3xHG5knyjXCQkgNnpEq2XwFyHeeXR8ZuX9U8E0M3sbuVe2qTnIxUugG0BpucPQk4p5lHnmOw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
87cc9ff87d494d91-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
zQ1Y-wIel_SVAxat_rasurbTGHQSAbxQBv05MXH8omVWOIfv-qelBQ==
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ 		27 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.5.2/css/free-v4-shims.min.css?token=cae01f65b9
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/cae01f65b9.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4e953827930889e844103c3a6771bd2e9de17d091b36378c40362271858e075

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 03:18:33 GMT
via
1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 02 Apr 2024 15:26:25 GMT
server
cloudflare
etag
W/"940b066040a876fa1dc7b2ee2d222a58"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0JFF4iD9h95%2FAh74zpK%2Fmn691hNN1Zr8yZ4mE8ddTwBHC4Q2yZNDuSLqyEiaF%2Fl5JoZt3Td%2BFpRfE2PmNaTaVLzNgUvDqbB5bhH3EY8p7KL%2FVTcIPmBdP8comvg7XWUhgDikkLjGEg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
87cc9ff87d464d91-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
fy2i-Pevz__kYQ_a89YfmSeLYX7-QtiYdcyiJm2_I3Veh_PfA4j1Pg==
free-v5-font-face.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ 		823 B
983 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.5.2/css/free-v5-font-face.min.css?token=cae01f65b9
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/cae01f65b9.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1dc27b700a62c005e4521b670cac08fb0b4b3e02a73c1ac44e7f9a9784bd672

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 03:18:33 GMT
via
1.1 a4af9b42c2ec29f616825af32712c204.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 02 Apr 2024 15:26:25 GMT
server
cloudflare
etag
W/"a3d53e21a02e37af6cbc00ac63b3cc1e"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=37Y5BYt3%2F%2Fqmdx1EiOW6apEjzZ5PNAJhG14Rv6NbCyoQJcUSo7k8%2BHZ%2BwEjp8URnnGaTiyGS9bkRF6JYDlCbNI03IZPbY4O4jt1T3GkmYmuqvjfRqFd%2BLkKB7vKXJBdGY4pVdi0F2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
87cc9ff87d474d91-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
QTxP6tWK_iAKazSIe79Sux3KptrS0xhMzWxHHZyJn68h7WGV8A95cg==
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ 		2 KB
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.5.2/css/free-v4-font-face.min.css?token=cae01f65b9
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/cae01f65b9.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9699b18200a9d40ed7859411c33cfa2194174a4746d466123107f888d93dc878

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 03:18:33 GMT
via
1.1 b25bc331cb2e5e7e25d9488f5ecdc940.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 02 Apr 2024 15:26:25 GMT
server
cloudflare
etag
W/"9c9f596493867f0e7ef5f9fe99103fce"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8TageVOxCxJkd%2FhchLf21ZSUiOTNv%2BLq27fms7bzZN8rSFslK9quSjirU9mykvBBDLS290iUONXdTQZHyLJqZfq5xRBl0NDvM66ykuMnz8PWto2UvBe%2BeO9lo6Knrl%2BEI9jbG9d53A%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
87cc9ff87d484d91-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
38FouMttoFrQng18bu5hJjdMt13ZN9y6Exj0AFXRZihYoIRgd1KH8A==
favicon.ico
google.loginprotections.com/ 		5 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://google.loginprotections.com/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
154.62.109.199 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
2b0e28fa93e92ff5aacc4f8bb9a1be090bbf075815ddd74261dbe5b88a092137

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 01 May 2024 03:18:33 GMT
Content-Encoding
gzip
Last-Modified
Tue, 30 Apr 2024 16:32:29 GMT
Server
nginx/1.18.0 (Ubuntu)
ETag
W/"66311d1d-15ab"
Transfer-Encoding
chunked
Content-Type
text/html
Connection
keep-alive
free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v6.5.2/webfonts/ 		153 KB
153 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.5.2/webfonts/free-fa-solid-900.woff2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
41dca0965bdfd255f85e7fc8e9a3dc1fe3eb810996c553d4ef2b8872737ee825

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Origin
https://google.loginprotections.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 03:18:33 GMT
via
1.1 22b9ddafebf39d72780d68dad970d218.cloudfront.net (CloudFront)
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
content-length
156388
last-modified
Tue, 02 Apr 2024 15:51:14 GMT
server
cloudflare
etag
"ae015e3286ef56a0daf8e83838a32a88"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yZ4XsISuHhiDHN44hGeUG8zw%2FNzQbIK1tbwc8Qv%2Fy9fOmrGpJfOBYa9X7v8kSR9TBU8wHF9TgzJKwYfwukrSmY4sR5jglMW8ZyDb9nOjpk4%2FApJb72GC6jHRmzfwelMVvVwyDUTCsw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
accept-ranges
bytes
cf-ray
87cc9ff8ed7e4d91-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
MJ1gKWGuPJ19NSHlwjO1vA9xyM5gQ-nu2w3NcuzIHLzfSwlx8iCqLw==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css2?family=arial:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| FontAwesomeKitConfig

0 Cookies