goon.vip-app.icu Open in urlscan Pro
172.67.185.235  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response goon.vip-app.icu/	381 KB 27 KB	116ms 63ms	Document text/html	172.67.185.235 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://goon.vip-app.icu/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.185.235 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fb744ddd95ca79c5e7dd4f56a9f3a2782deb6b2414de9e1255846512d6c67105 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8f582c38ece536e0-FRA content-encoding zstd content-type text/html; charset=utf-8 date Sat, 21 Dec 2024 13:21:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=0,i report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gFnBvJmoAwtGnE%2Fb7pQeLeMx1%2FEnxOD4JqXsbc1y4C163omuf0uOCm0En%2BI5Q04IyrOEqIydevDaRyrBOsKjQJjlZfDvYr1xKWqPYXRFDQlxCv3H1fnwi4VgRYf5p2BKdKvD"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfCacheStatus;desc="DYNAMIC" cfL4;desc="?proto=QUIC&rtt=6454&min_rtt=6196&rtt_var=1262&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4199&recv_bytes=4488&delivery_rate=870&cwnd=12000&unsent_bytes=0&cid=8f1d81700b998fde&ts=68&x=1" cfExtPri cfHdrFlush;dur=0 vary Accept-Encoding
GET H3	200	new-my.css goon.vip-app.icu/static/index/css/	907 KB 105 KB	48ms 48ms	Stylesheet text/css	172.67.185.235 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://goon.vip-app.icu/static/index/css/new-my.css Requested by Host: goon.vip-app.icu URL: https://goon.vip-app.icu/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.185.235 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cfcd7c5fa4be2d7c6569874a3fdca3dff009885d79aa0f0b1bc2607272010ae8 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://goon.vip-app.icu/ Response headers content-encoding gzip cf-cache-status MISS etag W/"675bf7c8-e2b38" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r5iYZR5NpYTD5axZPgFHBKCc2qx4%2F70R6G7i%2FYyOW6ZvvsgReEP6x7go2uT7IoGAtxMa0W3BvN6oLqKPNPOJUfpK%2FE9%2FlN%2BAY%2F31mZ3eetUhw6qJfaDn5IZPA%2BF5LJwWNIRV"}],"group":"cf-nel","max_age":604800} expires Sun, 22 Dec 2024 01:20:59 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=7986&min_rtt=6182&rtt_var=1509&sent=42&recv=26&lost=0&retrans=0&sent_bytes=32584&recv_bytes=5816&delivery_rate=205808&cwnd=18000&unsent_bytes=0&cid=8f1d81700b998fde&ts=122&x=1", cfExtPri, cfHdrFlush;dur=0 date Sat, 21 Dec 2024 13:21:00 GMT content-type text/css last-modified Fri, 13 Dec 2024 09:00:56 GMT vary Accept-Encoding priority u=0,i=?0 cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8f582c395d3436e0-FRA server cloudflare
GET H2	200	account-recovery-sms-pin.gif ssl.gstatic.com/accounts/	275 KB 276 KB	41ms 10ms	Image image/gif	2a00:1450:4001:82f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif Requested by Host: goon.vip-app.icu URL: https://goon.vip-app.icu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 428d97e19e91bd23dfcf73a96d0dd189c29a18a034373ecbfb2678d1524623f0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://goon.vip-app.icu/ Response headers cache-control public, max-age=31536000 age 401263 cross-origin-resource-policy cross-origin report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} x-content-type-options nosniff expires Tue, 16 Dec 2025 21:53:17 GMT accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" content-length 281782 x-xss-protection 0 date Mon, 16 Dec 2024 21:53:17 GMT last-modified Thu, 03 Oct 2019 10:15:00 GMT content-type image/gif server sffe
GET H2	200	vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response static.cloudflareinsights.com/beacon.min.js/	19 KB 7 KB	38ms 17ms	Script text/javascript	2606:4700::6810:4f49 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 Requested by Host: goon.vip-app.icu URL: https://goon.vip-app.icu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://goon.vip-app.icu Referer https://goon.vip-app.icu/ Response headers cache-control public, max-age=86400 content-encoding gzip etag W/"2024.6.1" cross-origin-resource-policy cross-origin cf-ray 8f582c39b9a6d385-FRA access-control-allow-origin * date Sat, 21 Dec 2024 13:21:00 GMT content-type text/javascript;charset=UTF-8 last-modified Thu, 06 Jun 2024 15:52:56 GMT vary Accept-Encoding server cloudflare
GET H3	200	jquery.js Show response goon.vip-app.icu/static/index/js/	82 KB 33 KB	50ms 49ms	Script application/javascript	172.67.185.235 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://goon.vip-app.icu/static/index/js/jquery.js Requested by Host: goon.vip-app.icu URL: https://goon.vip-app.icu/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.185.235 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 75f97ae3ecb1fa785636a9aea4471d527013bf6a82e6fe5d9cdd48d619e374d9 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://goon.vip-app.icu/ Response headers content-encoding gzip cf-cache-status MISS etag W/"619f41c4-1498b" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oz0pFK3pRrYW%2Bhnsoz%2FMCpQLtpY583DFC2cuGAMIjA%2FFeM%2FfGaWKOi7oCDfxDxEptxcMKuIGglQtvM7vMa3ZpUPc6fARbWQRlRVVubZlbOXy4M49BiodPaEvZQJTOLd0QD4t"}],"group":"cf-nel","max_age":604800} expires Sun, 22 Dec 2024 01:20:59 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=7496&min_rtt=6115&rtt_var=850&sent=126&recv=51&lost=0&retrans=0&sent_bytes=130674&recv_bytes=6907&delivery_rate=1966474&cwnd=39600&unsent_bytes=0&cid=8f1d81700b998fde&ts=156&x=1", cfExtPri, cfHdrFlush;dur=0 date Sat, 21 Dec 2024 13:21:00 GMT content-type application/javascript last-modified Thu, 25 Nov 2021 07:56:52 GMT vary Accept-Encoding priority u=1,i=?0 cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8f582c399d5436e0-FRA server cloudflare
GET DATA	200 OK	truncated /	267 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml;charset=UTF-8
GET H3	200	4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 fonts.gstatic.com/s/googlesans/v58/	51 KB 51 KB	26ms 9ms	Font font/woff2	142.250.185.195 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 Requested by Host: goon.vip-app.icu URL: https://goon.vip-app.icu/static/index/css/new-my.css Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.195 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s52-in-f3.1e100.net Software sffe / Resource Hash 57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://goon.vip-app.icu Referer https://goon.vip-app.icu/ Response headers age 8025 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Sun, 21 Dec 2025 11:07:15 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sat, 21 Dec 2024 11:07:15 GMT last-modified Tue, 23 May 2023 16:36:38 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 52280 x-xss-protection 0 server sffe
POST H3	204	rum Show response goon.vip-app.icu/cdn-cgi/	0 142 B	17ms 16ms	XHR text/plain	172.67.185.235 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://goon.vip-app.icu/cdn-cgi/rum? Requested by Host: static.cloudflareinsights.com URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.185.235 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Referer https://goon.vip-app.icu/ Response headers access-control-max-age 86400 access-control-allow-credentials true access-control-allow-methods POST,OPTIONS x-content-type-options nosniff cf-ray 8f582c3a9e1236e0-FRA access-control-allow-origin https://goon.vip-app.icu date Sat, 21 Dec 2024 13:21:00 GMT vary Origin server cloudflare x-frame-options DENY
GET H3	200	favicon.ico goon.vip-app.icu/	25 KB 11 KB	47ms 47ms	Other image/x-icon	172.67.185.235 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://goon.vip-app.icu/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.185.235 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2a5c83dd7f4634810218ba70e3fe9550fb5d887e349cb46d77419eb1c74bc299 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://goon.vip-app.icu/ Response headers server cloudflare cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status MISS etag W/"6760196c-65d4" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vXihoqTMKA8iCvjvwNm2hR7PXZm0Ka7jmPmTLtLF7y1l0j2Xs%2BsOZ9k8MgVUky1lPKRFtH56tBd857Sjiak9W%2BiieC521RnW9eSLD97Ab9L3I8vT%2BdvCWpWtjL8eW7ohvz98"}],"group":"cf-nel","max_age":604800} cf-ray 8f582c3a9e1336e0-FRA alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=7402&min_rtt=6115&rtt_var=872&sent=170&recv=71&lost=0&retrans=0&sent_bytes=177696&recv_bytes=10285&delivery_rate=1267&cwnd=72000&unsent_bytes=0&cid=8f1d81700b998fde&ts=323&x=1", cfExtPri, cfHdrFlush;dur=0 date Sat, 21 Dec 2024 13:21:00 GMT content-type image/x-icon last-modified Mon, 16 Dec 2024 12:13:32 GMT vary Accept-Encoding priority u=1,i

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| global_id string| gid string| is_hui_chuan function| login function| shuruclear function| select_city function| account_add_class function| google_add_class function| sms_add_class function| phone_add_class function| password_login function| phone_login function| google_login function| sms_login function| xianshi object| __cfBeacon

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			goon.vip-app.icu/	1969-12-31 23:59:59	Name: city_name Value: %E5%BE%B7%E5%9B%BD%EF%BC%88DE%EF%BC%89
			goon.vip-app.icu/	1969-12-31 23:59:59	Name: think_var Value: US

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://goon.vip-app.icu/ Message: [DOM] Found 2 elements with non-unique id #ca: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://goon.vip-app.icu/ Message: [DOM] Found 2 elements with non-unique id #ct: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://goon.vip-app.icu/ Message: [DOM] Found 5 elements with non-unique id #identifierId: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation	verbose	URL: https://goon.vip-app.icu/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
goon.vip-app.icu
ssl.gstatic.com
static.cloudflareinsights.com
142.250.185.195
172.67.185.235
2606:4700::6810:4f49
2a00:1450:4001:82f::2003
2a5c83dd7f4634810218ba70e3fe9550fb5d887e349cb46d77419eb1c74bc299
428d97e19e91bd23dfcf73a96d0dd189c29a18a034373ecbfb2678d1524623f0
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc
75f97ae3ecb1fa785636a9aea4471d527013bf6a82e6fe5d9cdd48d619e374d9
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
cfcd7c5fa4be2d7c6569874a3fdca3dff009885d79aa0f0b1bc2607272010ae8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb744ddd95ca79c5e7dd4f56a9f3a2782deb6b2414de9e1255846512d6c67105