urlscan.io logo urlscan.io
SecurityTrails logo

test.gwapps.com Open in urlscan Pro
34.160.126.196  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://test.gwapps.com/
Effective URL: https://test.gwapps.com/login
Submission: On July 31 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 34.160.126.196, located in Kansas City, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is test.gwapps.com.
TLS certificate: Issued by WR3 on July 30th 2024. Valid for: 3 months.
This is the only time test.gwapps.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
1 8 34.160.126.196 396982 (GOOGLE-CL...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
9 3
Apex Domain
Subdomains		 Transfer
8 gwapps.com
test.gwapps.com
51 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 641
storage.googleapis.com — Cisco Umbrella Rank: 492
59 KB
9 2
Domain Requested by
8 test.gwapps.com 1 redirects test.gwapps.com
1 storage.googleapis.com test.gwapps.com
1 ajax.googleapis.com test.gwapps.com
9 3

This site contains no links.

Subject Issuer Validity Valid
test.gwapps.com
WR3		 2024-07-30 -
2024-10-28		 3 months crt.sh
upload.video.google.com
WR2		 2024-07-30 -
2024-10-22		 3 months crt.sh
storage.googleapis.com
WR2		 2024-07-30 -
2024-10-22		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://test.gwapps.com/login
Frame ID: 5394B7B525C811285E3E8636368308FF
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

GW Apps - Login

Page URL History Show full URLs

  1. https://test.gwapps.com/ HTTP 302
    https://test.gwapps.com/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

109 kB
Transfer

174 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://test.gwapps.com/ HTTP 302
    https://test.gwapps.com/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
test.gwapps.com/
Redirect Chain
  • https://test.gwapps.com/
  • https://test.gwapps.com/login
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://test.gwapps.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.160.126.196 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
196.126.160.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
7b2e1a2b45f91e4e3494d0255c7155053a3610111c1242c3e64a531857d55de5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
gzip
content-language
de-DE
content-length
1470
content-security-policy-report-only
default-src 'self'; script-src 'self' https://ajax.googleapis.com https://www.gstatic.com https://cdnjs.cloudflare.com https://www.google.com 'nonce-companyNonceValue' 'sha384-1H217gwSVyLSIfaLxHbE7dRb3v4mYCKbpQvzx0cegeju1MVsGrX5xXxAvs/HgeFs'; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; img-src 'self' data: https://public/img/ https://storage.googleapis.com; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://cdnjs.cloudflare.com; connect-src 'self'; media-src 'none'; object-src 'none'; frame-src 'self' https://www.google.com; frame-ancestors 'self';
content-type
text/html;charset=utf-8
date
Wed, 31 Jul 2024 10:06:30 GMT
gw-response
gw-tst-lb-response
server
Google Frontend
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 google
x-cloud-trace-context
5e9119bd4e648d39c4b0dfd599572551
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-language
de-DE
content-length
0
content-security-policy-report-only
default-src 'self'; script-src 'self' https://ajax.googleapis.com https://www.gstatic.com https://cdnjs.cloudflare.com https://www.google.com 'nonce-companyNonceValue' 'sha384-1H217gwSVyLSIfaLxHbE7dRb3v4mYCKbpQvzx0cegeju1MVsGrX5xXxAvs/HgeFs'; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; img-src 'self' data: https://public/img/ https://storage.googleapis.com; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://cdnjs.cloudflare.com; connect-src 'self'; media-src 'none'; object-src 'none'; frame-src 'self' https://www.google.com; frame-ancestors 'self';
content-type
text/html
date
Wed, 31 Jul 2024 10:06:27 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
gw-response
gw-tst-lb-response
location
https://test.gwapps.com/login
server
Google Frontend
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
via
1.1 google
x-cloud-trace-context
10a94356ef4c3a641f9c7b626de69fe9;o=1
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.7.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js
Requested by
Host: test.gwapps.com
URL: https://test.gwapps.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://test.gwapps.com/
Origin
https://test.gwapps.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 30 Jul 2024 17:51:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
58499
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30462
x-xss-protection
0
last-modified
Tue, 12 Sep 2023 02:38:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 30 Jul 2025 17:51:31 GMT
main.css
test.gwapps.com/styles/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://test.gwapps.com/styles/main.css
Requested by
Host: test.gwapps.com
URL: https://test.gwapps.com/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.160.126.196 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
196.126.160.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
52d360e6fb6086e9b14253fce34e85728bae19dc37093ad9e42ae990ed9cf5a7

Request headers

Referer
https://test.gwapps.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 31 Jul 2024 10:06:30 GMT
content-encoding
gzip
via
1.1 google
server
Google Frontend
etag
"taZDdQ"
gw-response
gw-tst-lb-response
content-type
text/css
x-cloud-trace-context
2c5d54f1ef580d74c1d08e85095d5cdc
cache-control
public,max-age=600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
gwapps-logo-wordless.png
storage.googleapis.com/gwapps-resources/ 		28 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://storage.googleapis.com/gwapps-resources/gwapps-logo-wordless.png
Requested by
Host: test.gwapps.com
URL: https://test.gwapps.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::201b Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
1eabac406d63b8e38d62f1c1b73b27be1b4e2ffd2e0bec0cd518fe3673f7515f

Request headers

Referer
https://test.gwapps.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 31 Jul 2024 10:06:30 GMT
x-guploader-uploadid
AHxI1nMgTkbbUAIULIZHNVm9TzRg42Ak0CXqB7q3e_3huGpjivdZ3N9yFZVaDuQYNWm4Lq0Q-u0
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29000
last-modified
Tue, 01 May 2018 00:40:36 GMT
server
UploadServer
etag
"7a8f0d2b00ad700160772061855df3a5"
x-goog-generation
1525135236653448
content-type
image/png
x-goog-hash
crc32c=QHLznw==, md5=eo8NKwCtcAFgdyBhhV3zpQ==
cache-control
public, max-age=3600
x-goog-stored-content-length
29000
accept-ranges
bytes
expires
Wed, 31 Jul 2024 11:06:30 GMT
login-gwapps-logo.png
test.gwapps.com/public/img/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://test.gwapps.com/public/img/login-gwapps-logo.png
Requested by
Host: test.gwapps.com
URL: https://test.gwapps.com/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.160.126.196 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
196.126.160.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
3dbbdaf39da9c2e9f2d87e9dda9bc8cdc11ff5797d1bd823ed9b5827dbf40632

Request headers

Referer
https://test.gwapps.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 31 Jul 2024 10:06:30 GMT
via
1.1 google
server
Google Frontend
etag
"taZDdQ"
gw-response
gw-tst-lb-response
content-type
image/png
x-cloud-trace-context
2c5d54f1ef580d74c1d08e85095d5cdc
cache-control
public,max-age=600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
google_button_logo.png
test.gwapps.com/public/img/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://test.gwapps.com/public/img/google_button_logo.png
Requested by
Host: test.gwapps.com
URL: https://test.gwapps.com/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.160.126.196 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
196.126.160.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
5318990281afe707a7041f8ffbd307405c828a6dd95d3c46cf9de56a2b3d9c84

Request headers

Referer
https://test.gwapps.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 31 Jul 2024 10:06:30 GMT
via
1.1 google
server
Google Frontend
etag
"taZDdQ"
gw-response
gw-tst-lb-response
content-type
image/png
x-cloud-trace-context
2bd1fc415dc9da7f360581f9d88d1afb
cache-control
public,max-age=600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
microsoft_button_logo.png
test.gwapps.com/public/img/ 		455 B
472 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://test.gwapps.com/public/img/microsoft_button_logo.png
Requested by
Host: test.gwapps.com
URL: https://test.gwapps.com/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.160.126.196 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
196.126.160.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
9864fdf995368063ea9a55fb0f6baa42cfb677c33d704f959459b0848dbda8b3

Request headers

Referer
https://test.gwapps.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 31 Jul 2024 10:06:30 GMT
via
1.1 google
server
Google Frontend
etag
"taZDdQ"
gw-response
gw-tst-lb-response
content-type
image/png
x-cloud-trace-context
2bd1fc415dc9da7f360581f9d88d1afb
cache-control
public,max-age=600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
check
test.gwapps.com/auth/user/ 		48 B
90 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://test.gwapps.com/auth/user/check
Requested by
Host: test.gwapps.com
URL: https://test.gwapps.com/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.160.126.196 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
196.126.160.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
4c89307349d9d0d6d921c16d2fed30981151177a9b9d896496b13899f0a82912
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://test.gwapps.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 31 Jul 2024 10:06:31 GMT
via
1.1 google
gw-response
gw-tst-lb-response
content-security-policy-report-only
default-src 'self'; script-src 'self' https://ajax.googleapis.com https://www.gstatic.com https://cdnjs.cloudflare.com https://www.google.com 'nonce-companyNonceValue' 'sha384-1H217gwSVyLSIfaLxHbE7dRb3v4mYCKbpQvzx0cegeju1MVsGrX5xXxAvs/HgeFs'; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; img-src 'self' data: https://public/img/ https://storage.googleapis.com; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://cdnjs.cloudflare.com; connect-src 'self'; media-src 'none'; object-src 'none'; frame-src 'self' https://www.google.com; frame-ancestors 'self';
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
66
x-xss-protection
1; mode=block
server
Google Frontend
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/json
x-cloud-trace-context
ced979f9e4732a2fc5173f123b3badd1
cache-control
private
favicon.ico
test.gwapps.com/public/img/ 		5 KB
664 B 		Other
General
Check archive.org
Download Go to
Full URL
https://test.gwapps.com/public/img/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.160.126.196 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
196.126.160.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
f1f3b807030cda8bfd3757cbcc7d282ef0e2648958297e9a324cc55e69668a5c

Request headers

Referer
https://test.gwapps.com/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 31 Jul 2024 10:06:31 GMT
content-encoding
gzip
via
1.1 google
server
Google Frontend
etag
"taZDdQ"
gw-response
gw-tst-lb-response
content-type
image/vnd.microsoft.icon
x-cloud-trace-context
2f7a6404c04fceb520fabe1dbf5512d6
cache-control
public,max-age=600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| renderPage function| showLoader

1 Cookies

Domain/Path Name / Value
test.gwapps.com/ Name: JSESSIONID
Value: gC3aB44UVRT2DDvWkrzqLQ

2 Console Messages

Source Level URL
Text
security error URL: https://test.gwapps.com/login(Line 27)
Message:
[Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' https://ajax.googleapis.com https://www.gstatic.com https://cdnjs.cloudflare.com https://www.google.com 'nonce-companyNonceValue' 'sha384-1H217gwSVyLSIfaLxHbE7dRb3v4mYCKbpQvzx0cegeju1MVsGrX5xXxAvs/HgeFs'". Either the 'unsafe-inline' keyword, a hash ('sha256-xgBb+A9FF0R3hRSpWOINoIqb6WWkA2bVc5FEIw+CG04='), or a nonce ('nonce-...') is required to enable inline execution.
network error URL: https://test.gwapps.com/auth/user/check
Message:
Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block