accounts-google.caddy.workers.dev
Open in
urlscan Pro
2606:4700:3031::6815:564f
Malicious Activity!
Public Scan
Submission: On May 20 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by GTS CA 1P5 on March 25th 2023. Valid for: 3 months.
This is the only time accounts-google.caddy.workers.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3031::6815:564f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 2404:6800:400... 2404:6800:4004:823::2003 | 15169 (GOOGLE) (GOOGLE) | |
4 | 2404:6800:400... 2404:6800:4004:821::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2404:6800:400... 2404:6800:4004:80f::200e | 15169 (GOOGLE) (GOOGLE) | |
7 | 2404:6800:400... 2404:6800:4004:801::200d | 15169 (GOOGLE) (GOOGLE) | |
30 | 6 |
ASN13335 (CLOUDFLARENET, US)
accounts-google.caddy.workers.dev |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
430 KB |
7 |
google.com
accounts.google.com — Cisco Umbrella Rank: 33 play.google.com Failed |
5 KB |
1 |
youtube.com
accounts.youtube.com — Cisco Umbrella Rank: 846 |
|
1 |
workers.dev
accounts-google.caddy.workers.dev |
94 KB |
30 | 4 |
Domain | Requested by | |
---|---|---|
10 | www.gstatic.com |
accounts-google.caddy.workers.dev
www.gstatic.com |
7 | accounts.google.com |
www.gstatic.com
accounts-google.caddy.workers.dev |
4 | fonts.gstatic.com |
accounts-google.caddy.workers.dev
|
1 | accounts.youtube.com |
www.gstatic.com
|
1 | accounts-google.caddy.workers.dev | |
0 | play.google.com Failed |
www.gstatic.com
|
30 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
support.google.com |
accounts.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.caddy.workers.dev GTS CA 1P5 |
2023-03-25 - 2023-06-23 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
accounts.google.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
This page contains 7 frames:
Primary Page:
https://accounts-google.caddy.workers.dev/
Frame ID: 816CD7FD3ECDAC7722717D488B5A896D
Requests: 23 HTTP requests in this frame
Frame:
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-983085561×tamp=1684570812963
Frame ID: 330770E4DA11F7835DF509B305636F85
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: 65C7988BA33C0C9877963E6C27F300FF
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: E6AD34C3BF336160B860933D6818CD66
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: C764D5BABC414DF50FC60B457458660A
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: EED8A781500F1B4EBE77DB52E306CF76
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: B1D59CB1296FDA5807E52C028E27882A
Requests: 1 HTTP requests in this frame
4 Outgoing links
These are links going to different origins than the main page.
Title: Learn more
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
accounts-google.caddy.workers.dev/ |
563 KB 94 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=_b,_tp,_r
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US._KsYiRpye8w.es5.O/am=BjnHYQM_CH-pzj_jk8MAAAAAAAAAAAALw06A/d=1/excm=_b,_r,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOa... |
204 KB 72 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
267 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v14/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v14/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=byfTOb,lsjVmc,LEikZe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US._KsYiRpye8w.es5.O/ck=boq-identity.AccountsSignInUi.SbBORMldjjc.L.B1.O/am=BjnHYQM_CH-pzj_jk8MAAAAAAAAAAAALw06A/d=1/exm=_... |
37 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,XVq9Qb,xUdipf,OTA3Ae,COQbmf,fKUV3e,aurFic,U0aPgd,kibjWe,nnwwYc,ANCJdb,V3dDOb,G0cNrd,zsCYJ,mWLH9d,NOeYWe,O6y8ed,t2srLd,fqEYIb,PrPYRd,M...
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US._KsYiRpye8w.es5.O/ck=boq-identity.AccountsSignInUi.SbBORMldjjc.L.B1.O/am=BjnHYQM_CH-pzj_jk8MAAAAAAAAAAAALw06A/d=1/exm=L... |
688 KB 219 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=ltDFwf,Rusgnf,Ctsu,UPKV3d,wGM7Jc,IZ1fbc,i5dxUd,m9oV,kSPLL,NTMZac,bTi8wc,i5H9N,SzsEAf,RAnnUd,qPfo0c,PHUIyb,bPkrc,pxq3x,uu7UOe,yRXbo,soHxf,qNG0Fc,ywOR5c,W2YXuc
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US._KsYiRpye8w.es5.O/ck=boq-identity.AccountsSignInUi.SbBORMldjjc.L.B1.O/am=BjnHYQM_CH-pzj_jk8MAAAAAAAAAAAALw06A/d=1/exm=A... |
123 KB 37 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=RqjULd
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US._KsYiRpye8w.es5.O/ck=boq-identity.AccountsSignInUi.SbBORMldjjc.L.B1.O/am=BjnHYQM_CH-pzj_jk8MAAAAAAAAAAAALw06A/d=1/exm=A... |
14 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=ZwDk9d,RMhBfe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US._KsYiRpye8w.es5.O/ck=boq-identity.AccountsSignInUi.SbBORMldjjc.L.B1.O/am=BjnHYQM_CH-pzj_jk8MAAAAAAAAAAAALw06A/d=1/exm=A... |
3 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=bm51tf
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US._KsYiRpye8w.es5.O/ck=boq-identity.AccountsSignInUi.SbBORMldjjc.L.B1.O/am=BjnHYQM_CH-pzj_jk8MAAAAAAAAAAAALw06A/d=1/exm=A... |
1 KB 733 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=sOXFj,q0xTif,ZZ4WUe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US._KsYiRpye8w.es5.O/ck=boq-identity.AccountsSignInUi.SbBORMldjjc.L.B1.O/am=BjnHYQM_CH-pzj_jk8MAAAAAAAAAAAALw06A/d=1/exm=A... |
3 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CheckConnection
accounts.youtube.com/accounts/ Frame 3307 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
batchexecute
accounts.google.com/v3/signin/_/AccountsSignInUi/data/ Frame |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
batchexecute
accounts.google.com/v3/signin/_/AccountsSignInUi/data/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bscframe
accounts.google.com/_/ Frame 65C7 |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=wg1P6b
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US._KsYiRpye8w.es5.O/ck=boq-identity.AccountsSignInUi.SbBORMldjjc.L.B1.O/am=BjnHYQM_CH-pzj_jk8MAAAAAAAAAAAALw06A/d=1/exm=A... |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bscframe
accounts.google.com/_/ Frame E6AD |
2 KB 888 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=Wt6vjf,hhhU8,FCpbqb,WhJNk
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US._KsYiRpye8w.es5.O/ck=boq-identity.AccountsSignInUi.SbBORMldjjc.L.B1.O/am=BjnHYQM_CH-pzj_jk8MAAAAAAAAAAAALw06A/d=1/exm=A... |
6 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bscframe
accounts.google.com/_/ Frame C764 |
2 KB 834 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bscframe
accounts.google.com/_/ Frame EED8 |
2 KB 833 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bscframe
accounts.google.com/_/ Frame B1D5 |
2 KB 831 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
browserinfo
accounts.google.com/v3/signin/_/AccountsSignInUi/ Frame |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
browserinfo
accounts.google.com/v3/signin/_/AccountsSignInUi/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- accounts.google.com
- URL
- https://accounts.google.com/v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2F&f.sid=301965381406611200&bl=boq_identityfrontendauthuiserver_20230514.08_p0&hl=en-US&_reqid=30013&rt=c
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true
- Domain
- accounts.google.com
- URL
- https://accounts.google.com/v3/signin/_/AccountsSignInUi/browserinfo?f.sid=301965381406611200&bl=boq_identityfrontendauthuiserver_20230514.08_p0&hl=en-US&_reqid=130013&rt=j
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)43 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless object| WIZ_global_data number| cc_latency_start_time function| onaft function| _isLazyImage string| cc_aid number| iml_start number| css_size object| cc_latency function| ccTick function| onJsLoad function| onCssLoad function| _isVisible function| _recordImlEl number| prt function| wiz_tick string| _F_cssRowKey string| _F_combinedSignature function| _DumpException object| BOQ_wizbind object| AF_initDataKeys object| AF_dataServiceRequests object| AF_initDataChunkQueue function| AF_initDataCallback undefined| AF_initDataInitializeCallback object| aft_counter function| initAft object| IJ_values object| _wjdd object| default_AccountsSignInUi boolean| BOQ_loadedInitialJS function| _F_installCss function| _B_err object| closure_lm_47722 function| wiz_progress function| _F_getIjData object| _mxNDff boolean| ly11Pc number| closure_uid_648988642 function| nativePrimaryActionHit function| nativeSecondaryActionHit object| botguard3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
accounts-google.caddy.workers.dev/ | Name: __Host-GAPS Value: 1:dNs0G8aN89DSJuQ4leru_XvxIMJ7yg:oiGcKubdnBg3S7yR |
|
.google.com/ | Name: NID Value: 511=MCu5YyFECFITGJzF-vfHQc94j4zAaOKKiHSWcTqXBzMmmWtcIuj-9uj5U5YBxc-aPSihnR3MjwU01powq-Coujje5BfOzX7tG-Ep1yDYpCM91V3OE_pBFhHsd-RBHvEynPYZZbJsZvTTJcG5F9d5f8icnmmtZPzI4Nw1yKmceNs |
|
accounts-google.caddy.workers.dev/ | Name: OTZ Value: 7037780_56_56__56_ |
26 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts-google.caddy.workers.dev
accounts.google.com
accounts.youtube.com
fonts.gstatic.com
play.google.com
www.gstatic.com
accounts.google.com
play.google.com
2404:6800:4004:801::200d
2404:6800:4004:80f::200e
2404:6800:4004:821::2003
2404:6800:4004:823::2003
2606:4700:3031::6815:564f
07d9f81df85f8d0ff6ad6ecc0f164d30d09b52f42941c7846f65c62280b46d9f
281a8bba30776fe78167a5e2a042b8b0af9347f1127314a8779a8b8cbf86d07e
29c37554e20520f8369dc19421cb666d51621ce4fec60f045b0e1d4980a4bb4f
343e06832e9518fc50ad9bb9e068b8285dd0e906e97014e722a266c8d7b3a6c2
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
56880fea3a32137852c3ec59f095f95c6472420ea9d89b9e21e841d39112e6e0
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
6a762e8c3b79591f5349e482a7602301bf2c5e44e2875e00b97f674b189287ca
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
865b05e8d891e2a4740637e9909e107ed50e2cd5d68ac6b949ff760c07f21df3
92405813336ac063d5c8c22e5bb4432fb4b43084ce4b3c69821091e53486fe2a
a4b64a06a7a9bf5bc1ed7bfd3df0ae211f3acec92bdad9bcc2126dac55a48b22
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
b0db5202382f6094aa8bf5a92f08d3b04ee9f2569c80b0f969b7d0df03e0f0f2
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
cb1d6c401f35a521bc7fd35bce3174a4b33b6c616e9e18e93c9c320b2a513fd2
cc49262d897b776a1d4cf87324d53491cc8e0f439133cb1fcf516b8c65665e63
cda267fd6bbd1685e92a47648d9a73f0dce88da72ae3b1696e5cc38fad4b485e
da0bb99eefe08100b45bbe9690618cde0dae0866a08ade469db5997bad3c6c12
e1ab6f37c49304a53f61a3bc15d1399e45ad898089d57b285f58fdc3835ae840
feac8c86d0259a7403a92f52cc3b0d63870fd73f58838bab9e79d1af961396f9