accounts-google.caddy.workers.dev
Open in
urlscan Pro
2606:4700:3036::ac43:d8e9
Malicious Activity!
Public Scan
Effective URL: https://accounts-google.caddy.workers.dev/
Submission: On October 07 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by GTS CA 1P5 on September 19th 2023. Valid for: 3 months.
This is the only time accounts-google.caddy.workers.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3036::ac43:d8e9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 2a00:1450:400... 2a00:1450:4001:80f::2003 | 15169 (GOOGLE) (GOOGLE) | |
4 | 2a00:1450:400... 2a00:1450:4001:82b::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::200e | 15169 (GOOGLE) (GOOGLE) | |
7 | 2a00:1450:400... 2a00:1450:4001:813::200d | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:811::200e | 15169 (GOOGLE) (GOOGLE) | |
29 | 7 |
ASN13335 (CLOUDFLARENET, US)
accounts-google.caddy.workers.dev |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
429 KB |
9 |
google.com
accounts.google.com — Cisco Umbrella Rank: 32 play.google.com — Cisco Umbrella Rank: 37 Failed |
5 KB |
1 |
youtube.com
accounts.youtube.com — Cisco Umbrella Rank: 318 |
|
1 |
workers.dev
accounts-google.caddy.workers.dev |
102 KB |
29 | 4 |
Domain | Requested by | |
---|---|---|
10 | www.gstatic.com |
accounts-google.caddy.workers.dev
www.gstatic.com |
7 | accounts.google.com |
www.gstatic.com
accounts-google.caddy.workers.dev |
4 | fonts.gstatic.com |
accounts-google.caddy.workers.dev
|
2 | play.google.com |
www.gstatic.com
|
1 | accounts.youtube.com |
www.gstatic.com
|
1 | accounts-google.caddy.workers.dev | |
29 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
support.google.com |
accounts.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
caddy.workers.dev GTS CA 1P5 |
2023-09-19 - 2023-12-18 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-09-18 - 2023-12-11 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-09-18 - 2023-12-11 |
3 months | crt.sh |
accounts.google.com GTS CA 1C3 |
2023-09-18 - 2023-12-11 |
3 months | crt.sh |
This page contains 7 frames:
Primary Page:
https://accounts-google.caddy.workers.dev/
Frame ID: 44E7D0FA7D3ECD154A2CFE90AF7657B9
Requests: 20 HTTP requests in this frame
Frame:
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=787003243×tamp=1696682876590
Frame ID: 598E7BDB72C76D17D18E6D685A5F5C55
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: F88C535DE50AE276FDBF84E3F341C2F3
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: 151E1995F2DA1AAFB91094D0D23940CE
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: 958514947EE142DC09F88B3A6637A626
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: 96FC39D5E5B6976B7D74066A31F2A6AC
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: CFA7F06AAC13C51C86E34784BFB6A116
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Accedi - Account GooglePage URL History Show full URLs
-
http://accounts-google.caddy.workers.dev/
HTTP 307
https://accounts-google.caddy.workers.dev/ Page URL
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Scopri di piĆ¹
Search URL Search Domain Scan URL
Title: Guida
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Termini
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://accounts-google.caddy.workers.dev/
HTTP 307
https://accounts-google.caddy.workers.dev/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
accounts-google.caddy.workers.dev/ Redirect Chain
|
581 KB 102 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=_b,_tp
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.it.9T40JrfcWl0.es5.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlF... |
206 KB 72 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
267 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v14/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v14/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=byfTOb,lsjVmc,LEikZe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.it.9T40JrfcWl0.es5.O/ck=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=_b... |
37 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,KUM7Z,oLggrd,inNHtf,L1AAkb,l...
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.it.9T40JrfcWl0.es5.O/ck=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=LE... |
749 KB 222 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.it.9T40JrfcWl0.es5.O/ck=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=Av... |
110 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=RqjULd
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.it.9T40JrfcWl0.es5.O/ck=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=Av... |
19 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=ZwDk9d,RMhBfe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.it.9T40JrfcWl0.es5.O/ck=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=Av... |
3 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=bm51tf
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.it.9T40JrfcWl0.es5.O/ck=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=Av... |
1 KB 736 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=NTMZac,sOXFj,q0xTif,ZZ4WUe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.it.9T40JrfcWl0.es5.O/ck=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=Av... |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CheckConnection
accounts.youtube.com/accounts/ Frame 598E |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
batchexecute
accounts.google.com/v3/signin/_/AccountsSignInUi/data/ Frame |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
batchexecute
accounts.google.com/v3/signin/_/AccountsSignInUi/data/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bscframe
accounts.google.com/_/ Frame F88C |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=wg1P6b
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.it.9T40JrfcWl0.es5.O/ck=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=Av... |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bscframe
accounts.google.com/_/ Frame 151E |
2 KB 904 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bscframe
accounts.google.com/_/ Frame 9585 |
2 KB 850 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=Wt6vjf,hhhU8,FCpbqb,WhJNk
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.it.9T40JrfcWl0.es5.O/ck=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=Av... |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bscframe
accounts.google.com/_/ Frame 96FC |
2 KB 853 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bscframe
accounts.google.com/_/ Frame CFA7 |
2 KB 846 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
log
play.google.com/ Frame |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
browserinfo
accounts.google.com/v3/signin/_/AccountsSignInUi/ Frame |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
browserinfo
accounts.google.com/v3/signin/_/AccountsSignInUi/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
log
play.google.com/ Frame |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- accounts.google.com
- URL
- https://accounts.google.com/v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2F&f.sid=-2530121084113484703&bl=boq_identityfrontendauthuiserver_20231001.08_p0&hl=it&_reqid=53277&rt=c
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true&authuser=0
- Domain
- accounts.google.com
- URL
- https://accounts.google.com/v3/signin/_/AccountsSignInUi/browserinfo?f.sid=-2530121084113484703&bl=boq_identityfrontendauthuiserver_20231001.08_p0&hl=it&_reqid=153277&rt=j
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true&authuser=0
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)42 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| WIZ_global_data number| cc_latency_start_time function| onaft function| _isLazyImage string| cc_aid number| iml_start number| css_size object| cc_latency function| ccTick function| onJsLoad function| onCssLoad function| _isVisible function| _recordImlEl number| prt function| wiz_tick string| _F_cssRowKey string| _F_combinedSignature function| _DumpException object| BOQ_wizbind object| AF_initDataKeys object| AF_dataServiceRequests object| AF_initDataChunkQueue function| AF_initDataCallback undefined| AF_initDataInitializeCallback object| aft_counter function| initAft object| IJ_values object| _wjdd object| default_AccountsSignInUi boolean| BOQ_loadedInitialJS function| _F_installCss function| _B_err object| closure_lm_157165 function| wiz_progress function| _F_getIjData object| _mxNDff boolean| ly11Pc number| closure_uid_390257042 function| nativePrimaryActionHit function| nativeSecondaryActionHit object| botguard2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
accounts-google.caddy.workers.dev/ | Name: __Host-GAPS Value: 1:pPmQ6ViLTdzE31Hs6z_9I_N_6Y0kxQ:3IdCgg_Yw58j9T7g |
|
accounts-google.caddy.workers.dev/ | Name: OTZ Value: 7239648_48_52_123900_48_436380 |
14 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts-google.caddy.workers.dev
accounts.google.com
accounts.youtube.com
fonts.gstatic.com
play.google.com
www.gstatic.com
accounts.google.com
play.google.com
2606:4700:3036::ac43:d8e9
2a00:1450:4001:80e::200e
2a00:1450:4001:80f::2003
2a00:1450:4001:811::200e
2a00:1450:4001:813::200d
2a00:1450:4001:82b::2003
0d23c8023d6bd8c2447d2784e3fced6c094794a4c5b1cb977a54bdbc3e9d0b65
235f27fdebdc0ae736e0681562a6734ff2ea2779392594dd7e7567e90e767737
38a46ad531f4c76aeb03783beb93082a05644649a6fc6ef2b34cd36b802dc44e
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3ed183a527ff6b4065f441728cbf366195158d814c3a6082d7d0b0a4e73f4a2c
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5b121c77fc21a38f1e3ccaef1517c568f58aaf6504b2134e254eb0a3e8d29e20
6074aaed138ef8080ad751dfa27672ba876054ca1c68bb28d89ae0f9fe6f96f2
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
6df5ac1ed8053c5f58664b192e1a98c57d2cb396e9eb648813a54d35d0b4cbad
77a8483f193ec93119fcbaea52d985b5180b86c3794be777af8b66fd661f58a1
85dc155ee7e7ad2234aad7c4265ccec41fdbb7063357228c2dc37bbab55488c2
a021e1e7c41525c4874192ecb55d8584fe6e4dba7c0fa9645056a2be517f41c9
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
ad1dd5930c51caae973e8725d793aef4908f4d3ec94e3b12c29246bb8c6d9313
b1095d85b8ed0e48c24fe15fc5ae7823ca905c22c1c0a9634bdd23c05ecb6aa7
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
c307e0de2b02d26a270ac7da01b84a11408dc656b0177920dc64a9a5f313782f
cbff20a8491458b6594f10eaedde4c5ec0f62f810010fcde9f54eb975b35ca70
d783a83a0ea85b73a66da4e6eb5a82a944d8d706bcbbce66f653483f3a1eb871
e4e4f3aaa995cdf74bd5fc0acc87b602a1d59cd22a524c93b7ca4648d3de7009