urlscan.io logo urlscan.io
SecurityTrails logo

gmailbb.webservis.ru Open in urlscan Pro
195.16.42.43  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://gmailbb.webservis.ru/1.php
Submission: On December 03 via api from RU — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 11 HTTP transactions. The main IP is 195.16.42.43, located in Russian Federation and belongs to SOVAM-AS PJSC "Vimpelcom", RU. The main domain is gmailbb.webservis.ru.
This is the only time gmailbb.webservis.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

IP Address AS Autonomous System
5 195.16.42.43 3216 (SOVAM-AS ...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
11 4
Apex Domain
Subdomains		 Transfer
5 webservis.ru
gmailbb.webservis.ru
85 KB
2 gstatic.com
ssl.gstatic.com
2 KB
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 36
17 KB
0 google.com Failed
accounts.google.com Failed
mail.google.com Failed
11 4
Domain Requested by
5 gmailbb.webservis.ru gmailbb.webservis.ru
2 ssl.gstatic.com gmailbb.webservis.ru
1 www.google-analytics.com gmailbb.webservis.ru
0 mail.google.com Failed
0 accounts.google.com Failed gmailbb.webservis.ru
11 5

This site contains links to these domains. Also see Links.

Domain
accounts.google.com
www.google.com
mail.google.com
play.google.com
itunes.apple.com
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://gmailbb.webservis.ru/1.php
Frame ID: 188A6A58D9064F983CDD8CA649CAFD2E
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Gmail: электронная почта от Google

Page URL History Show full URLs

  1. http://gmailbb.webservis.ru/1.php HTTP 307
    https://gmailbb.webservis.ru/1.php HTTP 307
    http://gmailbb.webservis.ru/1.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

11
Requests

0 %
HTTPS

67 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

105 kB
Transfer

130 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://gmailbb.webservis.ru/1.php HTTP 307
    https://gmailbb.webservis.ru/1.php HTTP 307
    http://gmailbb.webservis.ru/1.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • http://www.google-analytics.com/ga.js HTTP 307
  • https://www.google-analytics.com/ga.js

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 1.php
gmailbb.webservis.ru/
Redirect Chain
  • http://gmailbb.webservis.ru/1.php
  • https://gmailbb.webservis.ru/1.php
  • http://gmailbb.webservis.ru/1.php
75 KB
75 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://gmailbb.webservis.ru/1.php
Protocol
HTTP/1.1
Server
195.16.42.43 , Russian Federation, ASN3216 (SOVAM-AS PJSC "Vimpelcom", RU),
Reverse DNS
webservis.ru.freehosting.centre.ru
Software
Apache / PHP/4.4.9
Resource Hash
27e1143c791de1891ed8352b36f886cb39d3c7eec70dc89de86777fb39a257aa

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Age
0
Connection
keep-alive
Content-Length
76347
Content-Type
text/html; charset=windows-1251
Date
Tue, 03 Dec 2024 00:05:43 GMT
Server
Apache
Via
1.1 varnish
X-Powered-By
PHP/4.4.9
X-Varnish
160510327

Redirect headers

Location
http://gmailbb.webservis.ru/1.php
Non-Authoritative-Reason
HttpsUpgrades
google_logo_41.png
gmailbb.webservis.ru/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://gmailbb.webservis.ru/google_logo_41.png
Requested by
Host: gmailbb.webservis.ru
URL: http://gmailbb.webservis.ru/1.php
Protocol
HTTP/1.1
Server
195.16.42.43 , Russian Federation, ASN3216 (SOVAM-AS PJSC "Vimpelcom", RU),
Reverse DNS
webservis.ru.freehosting.centre.ru
Software
Apache /
Resource Hash
2991102bf5c783ea6f018731a8939ee97a4d7562a76e8188775447e3c6e0876f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
http://gmailbb.webservis.ru/1.php

Response headers

ETag
"187c97e-18b1-50df046d"
Age
0
Connection
keep-alive
Via
1.1 varnish
Accept-Ranges
bytes
X-Varnish
160510330
Content-Length
6321
Date
Tue, 03 Dec 2024 00:05:43 GMT
Last-Modified
Sat, 29 Dec 2012 14:55:41 GMT
Content-Type
image/png
Server
Apache
filing_cabinet-g42.png
gmailbb.webservis.ru/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://gmailbb.webservis.ru/filing_cabinet-g42.png
Requested by
Host: gmailbb.webservis.ru
URL: http://gmailbb.webservis.ru/1.php
Protocol
HTTP/1.1
Server
195.16.42.43 , Russian Federation, ASN3216 (SOVAM-AS PJSC "Vimpelcom", RU),
Reverse DNS
webservis.ru.freehosting.centre.ru
Software
Apache /
Resource Hash
d5e6375ce8f96f9ca4243b005142c525c5755140c30b082c8faba85e58ad7388

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
http://gmailbb.webservis.ru/1.php

Response headers

ETag
"187c2bf-5a7-50df046c"
Age
0
Connection
keep-alive
Via
1.1 varnish
Accept-Ranges
bytes
X-Varnish
160510331
Content-Length
1447
Date
Tue, 03 Dec 2024 00:05:43 GMT
Last-Modified
Sat, 29 Dec 2012 14:55:40 GMT
Content-Type
image/png
Server
Apache
nosign-r42.png
gmailbb.webservis.ru/ 		795 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://gmailbb.webservis.ru/nosign-r42.png
Requested by
Host: gmailbb.webservis.ru
URL: http://gmailbb.webservis.ru/1.php
Protocol
HTTP/1.1
Server
195.16.42.43 , Russian Federation, ASN3216 (SOVAM-AS PJSC "Vimpelcom", RU),
Reverse DNS
webservis.ru.freehosting.centre.ru
Software
Apache /
Resource Hash
a32f0e99d5833416b25c92c81991b5bd56c998f6c71c254c4b19a198e80f260a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
http://gmailbb.webservis.ru/1.php

Response headers

ETag
"187c982-31b-50df0472"
Age
0
Connection
keep-alive
Via
1.1 varnish
Accept-Ranges
bytes
X-Varnish
160510332
Content-Length
795
Date
Tue, 03 Dec 2024 00:05:43 GMT
Last-Modified
Sat, 29 Dec 2012 14:55:46 GMT
Content-Type
image/png
Server
Apache
mobile_phone-42.gif
gmailbb.webservis.ru/ 		859 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://gmailbb.webservis.ru/mobile_phone-42.gif
Requested by
Host: gmailbb.webservis.ru
URL: http://gmailbb.webservis.ru/1.php
Protocol
HTTP/1.1
Server
195.16.42.43 , Russian Federation, ASN3216 (SOVAM-AS PJSC "Vimpelcom", RU),
Reverse DNS
webservis.ru.freehosting.centre.ru
Software
Apache /
Resource Hash
6f3f99760c210cdd9a6df7ccc3e1fdd91ed1bd615ec3db6ace198e12ffd83352

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
http://gmailbb.webservis.ru/1.php

Response headers

ETag
"187c981-35b-50df0471"
Age
0
Connection
keep-alive
Via
1.1 varnish
Accept-Ranges
bytes
X-Varnish
160510333
Content-Length
859
Date
Tue, 03 Dec 2024 00:05:43 GMT
Last-Modified
Sat, 29 Dec 2012 14:55:45 GMT
Content-Type
image/gif
Server
Apache
googlemail-64.png
accounts.google.com//ssl.gstatic.com/images/icons/product/ 		0
0
google-signin-flat.png
ssl.gstatic.com/accounts/ui/ 		531 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ssl.gstatic.com/accounts/ui/google-signin-flat.png
Requested by
Host: gmailbb.webservis.ru
URL: http://gmailbb.webservis.ru/1.php
Protocol
HTTP/1.1
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
59022682c32e4db4e05c3d0b01bad9bb2d935dd5455356c70017e882fdbc139f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
http://gmailbb.webservis.ru/

Response headers

Cache-Control
public, max-age=31536000
Age
106772
Cross-Origin-Resource-Policy
cross-origin
Report-To
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
X-Content-Type-Options
nosniff
Expires
Mon, 01 Dec 2025 18:26:00 GMT
Accept-Ranges
bytes
Cross-Origin-Opener-Policy-Report-Only
same-origin; report-to="static-on-bigtable"
Content-Length
531
X-XSS-Protection
0
Date
Sun, 01 Dec 2024 18:26:00 GMT
Last-Modified
Thu, 20 Jul 2023 22:48:00 GMT
Content-Type
image/png
Server
sffe
checkmark.png
ssl.gstatic.com/ui/v1/menu/ 		239 B
981 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ssl.gstatic.com/ui/v1/menu/checkmark.png
Requested by
Host: gmailbb.webservis.ru
URL: http://gmailbb.webservis.ru/1.php
Protocol
HTTP/1.1
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2210e36b5b21e54cd4dc2ccdcc06138db8598d704ebf19052e5caa84edb4a675
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
http://gmailbb.webservis.ru/

Response headers

Age
0
Report-To
{"group":"gstatic-ui-assets","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gstatic-ui-assets"}]}
X-Content-Type-Options
nosniff
Expires
Tue, 03 Dec 2024 01:05:32 GMT
Date
Tue, 03 Dec 2024 00:05:32 GMT
Last-Modified
Thu, 21 Nov 2024 02:28:30 GMT
Content-Type
image/png
Vary
Origin
Cache-Control
public, max-age=3600
Cross-Origin-Resource-Policy
cross-origin
Content-Security-Policy-Report-Only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gstatic-ui-assets
Accept-Ranges
bytes
Cross-Origin-Opener-Policy-Report-Only
same-origin; report-to="gstatic-ui-assets"
Content-Length
239
X-XSS-Protection
0
Server
sffe
ga.js
www.google-analytics.com/
Redirect Chain
  • http://www.google-analytics.com/ga.js
  • https://www.google-analytics.com/ga.js
45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/ga.js
Requested by
Host: gmailbb.webservis.ru
URL: http://gmailbb.webservis.ru/1.php
Protocol
H2
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
http://gmailbb.webservis.ru/

Response headers

content-encoding
gzip
age
2147
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:215:0"}],}
x-content-type-options
nosniff
expires
Tue, 03 Dec 2024 01:29:45 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 02 Dec 2024 23:29:45 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:215:0
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
17168
server
Golfe2

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://www.google-analytics.com/ga.js
Non-Authoritative-Reason
HSTS
c.gif
mail.google.com/mail/images/ 		0
0
favicon.ico
accounts.google.com//mail.google.com/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
accounts.google.com
URL
https://accounts.google.com//ssl.gstatic.com/images/icons/product/googlemail-64.png
Domain
mail.google.com
URL
https://mail.google.com/mail/images/c.gif?t=1733184332646
Domain
accounts.google.com
URL
https://accounts.google.com//mail.google.com/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| gaia_hasInnerTextProperty function| gaia_attachEvent function| gaia_getElementsByClass object| botguard function| gaia_parseFragment function| gaia_prefillEmail function| gaia_setFocus function| gaia_onLoginSubmit object| hashParams object| langChooser string| langChooserParam string| langChooserUrl function| gaia_appendParam function| gaia_swapHiResLogo object| _gaq object| BrowserSupport_ boolean| is_browser_supported number| start_time function| SetGmailCookie function| lg function| gaiacb_onLoginSubmit function| StripParam number| fixed function| FixForm function| el object| CP object| quota_elem string| ONE_PX function| LogRoundtripTime function| GetRoundtripTimeFunction function| MaybePingUser function| OnLoad function| updateQuota string| PAD function| format string| google_conversion_type number| google_conversion_id string| google_conversion_language string| google_conversion_format string| google_conversion_color function| LoadConversionScript object| _gat

0 Cookies

1 Console Messages

Source Level URL
Text
recommendation verbose URL: http://gmailbb.webservis.ru/1.php
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o