google-recovery.com Open in urlscan Pro
44.238.25.241  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response google-recovery.com/	731 KB 240 KB	901ms 387ms	Document text/html	44.238.25.241 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://google-recovery.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 44.238.25.241 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-44-238-25-241.us-west-2.compute.amazonaws.com Software openresty / Resource Hash 3f6954ef869fcb4f42a8f065c99cdcc1436894d157ff0202b3b9b0c88eed25b6 Security Headers Name Value X-Frame-Options sameorigin Request headers :method GET :authority google-recovery.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 server openresty date Wed, 11 Nov 2020 02:40:56 GMT content-type text/html; charset=UTF-8 last-modified Wed, 11 Nov 2020 01:32:17 GMT vary Accept-Encoding etag W/"5fab3f21-b6bfa" x-frame-options sameorigin content-encoding gzip x-cache BYPASS x-service pixie-sh
POST H2	404	jserror Show response google-recovery.com/	552 B 297 B	204ms 204ms	XHR text/html	44.238.25.241 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://google-recovery.com/jserror Requested by Host: URL: /accounts/static/_/js/k=gaia.gaiafe_glif.en.knP5S-0KJx4.O/m=glifb,identifier,unknownerror/am=gggAAABoQEFAjoIV4DE/rt=j/d=1/rs=ABkqax34pTwodLUPj0IR_xgl75kwcVTRZw Protocol H2 Security TLS 1.3, , AES_128_GCM Server 44.238.25.241 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-44-238-25-241.us-west-2.compute.amazonaws.com Software openresty / Resource Hash a980b60a8922f510d2da527e74ec9443a57dcc65444dbd6a3ae87dceb28090eb Security Headers Name Value X-Frame-Options sameorigin Request headers Referer https://google-recovery.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded;charset=UTF-8 Response headers status 404 date Wed, 11 Nov 2020 02:40:57 GMT content-encoding gzip vary Accept-Encoding server openresty x-frame-options sameorigin content-type text/html; charset=UTF-8
GET DATA	200 OK	truncated /	267 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=UTF-8
GET H2	200	CWB0XYA8bzo0kSThX0UTuA.woff2 fonts.gstatic.com/s/roboto/v15/	14 KB 15 KB	25ms 6ms	Font font/woff2	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v15/CWB0XYA8bzo0kSThX0UTuA.woff2 Requested by Host: google-recovery.com URL: https://google-recovery.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7bbc8461b2f4cc870743729ee5d44ce0466ca67618f89a8942b655f8a644e68 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://google-recovery.com Referer https://google-recovery.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 06 Nov 2020 19:59:52 GMT x-content-type-options nosniff last-modified Wed, 14 Jan 2015 22:47:37 GMT server sffe age 369665 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14584 x-xss-protection 0 expires Sat, 06 Nov 2021 19:59:52 GMT
GET H2	200	CheckConnection accounts.youtube.com/accounts/ Frame 045A	0 0	43ms 23ms	Document text/html	2a00:1450:4001:80b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1838497349&timestamp=1494410966271 Requested by Host: google-recovery.com URL: https://google-recovery.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-lFTkS258FR0f9OiOpFu/NA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'nonce-lFTkS258FR0f9OiOpFu/NA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;frame-ancestors https://accounts.google.com X-Content-Type-Options nosniff X-Frame-Options ALLOW-FROM https://accounts.google.com X-Xss-Protection 0 Request headers :method GET :authority accounts.youtube.com :scheme https :path /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1838497349&timestamp=1494410966271 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://google-recovery.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://google-recovery.com/ Response headers status 200 content-type text/html; charset=utf-8 x-frame-options ALLOW-FROM https://accounts.google.com cache-control no-cache, no-store, max-age=0, must-revalidate pragma no-cache expires Mon, 01 Jan 1990 00:00:00 GMT date Wed, 11 Nov 2020 02:40:57 GMT cross-origin-resource-policy cross-origin content-security-policy script-src 'report-sample' 'nonce-lFTkS258FR0f9OiOpFu/NA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'nonce-lFTkS258FR0f9OiOpFu/NA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;frame-ancestors https://accounts.google.com content-encoding gzip server ESF x-xss-protection 0 x-content-type-options nosniff alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| WIZ_global_data object| botguard string| viewPathPrefix boolean| cssLoaded string| _F_jsUrl object| _G object| postmessage function| _F_getAverageFps function| _DumpException function| _B_err object| closure_lm_957407 object| AF_initDataKeys object| AF_dataServiceRequests object| AF_initDataChunkQueue function| AF_initDataCallback undefined| AF_initDataInitializeCallback

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	sameorigin

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.youtube.com
fonts.gstatic.com
google-recovery.com
2a00:1450:4001:80b::200e
2a00:1450:4001:81c::2003
44.238.25.241
3f6954ef869fcb4f42a8f065c99cdcc1436894d157ff0202b3b9b0c88eed25b6
a980b60a8922f510d2da527e74ec9443a57dcc65444dbd6a3ae87dceb28090eb
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
f7bbc8461b2f4cc870743729ee5d44ce0466ca67618f89a8942b655f8a644e68