gmail.huypion.tk Open in urlscan Pro
2400:cb00:2048:1::6818:79d0 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://gmail.huypion.tk/ServiceAuth_419.html
Submission: On June 22 via automatic, source phishtank (June 22nd 2017, 10:08:59 pm UTC)

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 2400:cb00:2048:1::6818:79d0, located in United States and belongs to CLOUDFLARENET - CloudFlare, Inc., US. The main domain is gmail.huypion.tk.

This is the only time gmail.huypion.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address	AS Autonomous System
4	2400:cb00:204... 2400:cb00:2048:1::6818:79d0	13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare)
1	2a00:1450:400... 2a00:1450:4001:814::200a	15169 (GOOGLE) (GOOGLE - Google Inc.)
3	2400:cb00:204... 2400:cb00:2048:1::6818:78d0	13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare)
5	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE - Google Inc.)
13	5

4 2400:cb00:2048:1::6818:79d0 (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)

gmail.huypion.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200a (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2400:cb00:2048:1::6818:78d0 (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)

gmail.huypion.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:825::2003 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	huypion.tk gmail.huypion.tk	17 KB
5	gstatic.com ssl.gstatic.com fonts.gstatic.com	49 KB
1	googleapis.com ajax.googleapis.com	33 KB
13	3

	Domain	Requested by
7	gmail.huypion.tk	gmail.huypion.tk ajax.googleapis.com
3	ssl.gstatic.com	gmail.huypion.tk
2	fonts.gstatic.com	gmail.huypion.tk
1	ajax.googleapis.com	gmail.huypion.tk
13	4

This site contains no links.

Subject Issuer	Validity	Valid
*.google.com Google Internet Authority G2	`2017-06-07` - `2017-08-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://gmail.huypion.tk/ServiceAuth_419.html
Frame ID: 18467.1
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

13
Requests

23 %
HTTPS

100 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

99 kB
Transfer

196 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request ServiceAuth_419.html Show response
gmail.huypion.tk/ 23 KB
9 KB 420ms
31ms Document
text/html 2400:cb00:2048:1::6818:79d0
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL: http://gmail.huypion.tk/ServiceAuth_419.html
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::6818:79d0 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx / PHP/5.3.3
Resource Hash: 549cb993772c8aebbf854f9c0cd9325db6ad32b1aa52d08b4df7c5e5bbdbcd32

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 22 Jun 2017 22:08:49 GMT
Content-Encoding: gzip
Server: cloudflare-nginx
X-Powered-By: PHP/5.3.3
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 37328744269a231e-FRA
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ 91 KB
33 KB 11ms
6ms Script
text/javascript 2a00:1450:4001:814::200a
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js

Requested by

Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://gmail.huypion.tk/ServiceAuth_419.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Fri, 26 May 2017 10:34:11 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 20 Dec 2016 18:17:03 GMT
Server: sffe
Age: 2374478
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 33593
X-XSS-Protection: 1; mode=block
Expires: Sat, 26 May 2018 10:34:11 GMT

GET
H/1.1 200
OK to.js Show response
gmail.huypion.tk/file/ 3 KB
1 KB 27ms
27ms Script
text/javascript 2400:cb00:2048:1::6818:79d0
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL: http://gmail.huypion.tk/file/to.js
Requested by: Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::6818:79d0 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx /
Resource Hash: 787cea6938a0d8e476d3f483eb1089a8083486552958ee5d07b96a6dceb83fbb

Request headers

Referer: http://gmail.huypion.tk/ServiceAuth_419.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Thu, 22 Jun 2017 22:08:49 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Thu, 05 Jan 2017 11:43:05 GMT
Server: cloudflare-nginx
ETag: W/"4094e-a88-545576794ce6f"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: public, max-age=2073600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 3732874476cb231e-FRA
Expires: Sun, 16 Jul 2017 22:08:49 GMT

GET
H/1.1 200
OK script.js Show response
gmail.huypion.tk/to/templates/temp/goog/js/ 2 KB
762 B 9ms
8ms Script
text/javascript 2400:cb00:2048:1::6818:78d0
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL: http://gmail.huypion.tk/to/templates/temp/goog/js/script.js?2
Requested by: Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::6818:78d0 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx /
Resource Hash: 1ca35690ae0792db677f9fbcd1f2870ae06392300381c26095a2f83f4d432909

Request headers

Referer: http://gmail.huypion.tk/ServiceAuth_419.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Thu, 22 Jun 2017 22:08:49 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Thu, 05 Jan 2017 11:44:14 GMT
Server: cloudflare-nginx
ETag: W/"40a71-66f-545576bafd4ef"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: public, max-age=2073600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 37328744a17d2768-FRA
Expires: Sun, 16 Jul 2017 22:08:49 GMT

GET
H/1.1 200
OK style.css
gmail.huypion.tk/to/templates/temp/goog/ 25 KB
5 KB 44ms
39ms Stylesheet
text/css 2400:cb00:2048:1::6818:78d0
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL: http://gmail.huypion.tk/to/templates/temp/goog/style.css
Requested by: Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::6818:78d0 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx /
Resource Hash: 72c3fbb29d5c1dd347fe918f32f1300308159e7658383bc8d544650bd13f7e60

Request headers

Referer: http://gmail.huypion.tk/ServiceAuth_419.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Thu, 22 Jun 2017 22:08:49 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Thu, 05 Jan 2017 11:43:20 GMT
Server: cloudflare-nginx
ETag: W/"4098e-6388-545576873284f"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=2073600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 3732874461602768-FRA
Expires: Sun, 16 Jul 2017 22:08:49 GMT

GET
H/1.1 200
OK arrow_back_grey600_24dp.png
gmail.huypion.tk/to/templates/temp/goog/index_files/ 117 B
117 B 9ms
7ms Image
image/png 2400:cb00:2048:1::6818:79d0
CloudFlare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://gmail.huypion.tk/to/templates/temp/goog/index_files/arrow_back_grey600_24dp.png
Requested by: Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::6818:79d0 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx /
Resource Hash: 8d7d4305d9042a6f0a276c0cd646b0f4a18da60a800e844a70f51ad46cc1bd09

Request headers

Referer: http://gmail.huypion.tk/ServiceAuth_419.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Thu, 22 Jun 2017 22:08:49 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 05 Jan 2017 11:44:13 GMT
Server: cloudflare-nginx
ETag: "40a6c-75-545576ba015af"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 37328744a6e2231e-FRA
Content-Length: 117
Expires: Mon, 21 Aug 2017 22:08:49 GMT

GET
H/1.1 200
OK universal_language_settings-21.png
gmail.huypion.tk/to/templates/temp/goog/index_files/ 199 B
199 B 18ms
13ms Image
image/png 2400:cb00:2048:1::6818:79d0
CloudFlare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://gmail.huypion.tk/to/templates/temp/goog/index_files/universal_language_settings-21.png
Requested by: Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::6818:79d0 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx /
Resource Hash: 59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6

Request headers

Referer: http://gmail.huypion.tk/ServiceAuth_419.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Thu, 22 Jun 2017 22:08:49 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 05 Jan 2017 11:44:13 GMT
Server: cloudflare-nginx
ETag: "40a6e-c7-545576ba36d27"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 37328744b5d908b1-FRA
Content-Length: 199
Expires: Mon, 21 Aug 2017 22:08:49 GMT

POST
H/1.1 404
Not Found ads.php Show response
gmail.huypion.tk/templates/ 1 KB
722 B 34ms
28ms XHR
text/html 2400:cb00:2048:1::6818:78d0
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL: http://gmail.huypion.tk/templates/ads.php
Requested by: Host: ajax.googleapis.com
URL: http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::6818:78d0 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx / PHP/5.3.3
Resource Hash: 0e0b0b74b65b34ba43f04d5e39b8a0f7a69fb7c134b1c158fdb407280f3e5673

Request headers

Accept: */*
Referer: http://gmail.huypion.tk/ServiceAuth_419.html
Origin: http://gmail.huypion.tk
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Thu, 22 Jun 2017 22:08:49 GMT
Content-Encoding: gzip
Server: cloudflare-nginx
X-Powered-By: PHP/5.3.3
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Connection: keep-alive
CF-RAY: 37328744a1942360-FRA

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65f0cc24609e92f934f6d7df5ae73d69a58324eca4bb40d1650d3ee8280a000f

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
DATA 200
OK truncated
/ 284 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fc6e1e44fce24fcda33dfd0e0a05a77004b3cd1d81018e9616d6e4145145d0b9

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
S 200 wlogostrip_230x17_1x.png
ssl.gstatic.com/accounts/ui/ 4 KB
4 KB 27ms
9ms Image
image/png 2a00:1450:4001:825::2003
Google Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/accounts/ui/wlogostrip_230x17_1x.png

Requested by

Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:825::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

05cdc120325f04f53e3ec7dbba877500d94db5a47e38fb6a2cc96fa3d1d7664c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://gmail.huypion.tk/to/templates/temp/goog/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

date: Thu, 11 May 2017 14:16:08 GMT
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 3657161
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 4285
x-xss-protection: 1; mode=block
expires: Fri, 11 May 2018 14:16:08 GMT

GET
S 200 avatar_2x.png
ssl.gstatic.com/accounts/ui/ 626 B
635 B 26ms
8ms Image
image/png 2a00:1450:4001:825::2003
Google Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/accounts/ui/avatar_2x.png

Requested by

Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:825::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

cdcc6d6dcda827a694dce8bfa9a1ab41113b629ef1cc11f886866af9194c81d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://gmail.huypion.tk/to/templates/temp/goog/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

date: Tue, 16 May 2017 12:59:37 GMT
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 3229752
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 626
x-xss-protection: 1; mode=block
expires: Wed, 16 May 2018 12:59:37 GMT

GET
H/1.1 200
OK RjgO7rYTmqiVp7vzi-Q5UVtXRa8TVwTICgirnJhmVJw.woff2
fonts.gstatic.com/s/opensans/v13/ 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:825::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v13/RjgO7rYTmqiVp7vzi-Q5UVtXRa8TVwTICgirnJhmVJw.woff2

Requested by

Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:825::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

0a58791af95cd6a2937b3bf6c809ba54c8ed57f1aad54fbdf419687a429a3490

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36
Referer: http://gmail.huypion.tk/to/templates/temp/goog/style.css
Origin: http://gmail.huypion.tk

Response headers

Date: Mon, 15 May 2017 17:04:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 27 Apr 2015 23:46:07 GMT
Server: sffe
Age: 3301485
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 21164
X-XSS-Protection: 1; mode=block
Expires: Tue, 15 May 2018 17:04:04 GMT

GET
H/1.1 200
OK DXI1ORHCpsQm3Vp6mXoaTeXREeHhJi4GEUJI9ob_ak4.woff2
fonts.gstatic.com/s/opensans/v13/ 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:825::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v13/DXI1ORHCpsQm3Vp6mXoaTeXREeHhJi4GEUJI9ob_ak4.woff2

Requested by

Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:825::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

cd85c0f7385522688bad3cf0eb6ee89717a6d156b7859f77dd3b0c70d87922fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36
Referer: http://gmail.huypion.tk/to/templates/temp/goog/style.css
Origin: http://gmail.huypion.tk

Response headers

Date: Thu, 11 May 2017 20:57:34 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 27 Apr 2015 23:46:23 GMT
Server: sffe
Age: 3633075
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 21828
X-XSS-Protection: 1; mode=block
Expires: Fri, 11 May 2018 20:57:34 GMT

GET
S 200 googlelogo_color_112x36dp.png
ssl.gstatic.com/images/branding/googlelogo/1x/ 2 KB
2 KB 25ms
8ms Image
image/png 2a00:1450:4001:825::2003
Google Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_112x36dp.png

Requested by

Host: gmail.huypion.tk
URL: http://gmail.huypion.tk/ServiceAuth_419.html

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:825::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

9ecd5e18216a965021f794cc1fd255767f8437ce1dd6c6c2ff4ceea7ccc0073d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://gmail.huypion.tk/to/templates/temp/goog/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

date: Tue, 16 May 2017 14:54:24 GMT
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 3222865
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 2449
x-xss-protection: 1; mode=block
expires: Wed, 16 May 2018 14:54:24 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			gmail.huypion.tk/	1970-01-01 00:00:00	Name: PHPSESSID Value: 0o8uak6f00ujm24lseafvj37k4
			.huypion.tk/	2018-06-22 22:08:49	Name: __cfduid Value: dac3651418ea2aa6bd088ea90f07146061498169329

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fonts.gstatic.com
gmail.huypion.tk
ssl.gstatic.com
2400:cb00:2048:1::6818:78d0
2400:cb00:2048:1::6818:79d0
2a00:1450:4001:814::200a
2a00:1450:4001:825::2003
05cdc120325f04f53e3ec7dbba877500d94db5a47e38fb6a2cc96fa3d1d7664c
0a58791af95cd6a2937b3bf6c809ba54c8ed57f1aad54fbdf419687a429a3490
0e0b0b74b65b34ba43f04d5e39b8a0f7a69fb7c134b1c158fdb407280f3e5673
1ca35690ae0792db677f9fbcd1f2870ae06392300381c26095a2f83f4d432909
549cb993772c8aebbf854f9c0cd9325db6ad32b1aa52d08b4df7c5e5bbdbcd32
59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
65f0cc24609e92f934f6d7df5ae73d69a58324eca4bb40d1650d3ee8280a000f
72c3fbb29d5c1dd347fe918f32f1300308159e7658383bc8d544650bd13f7e60
787cea6938a0d8e476d3f483eb1089a8083486552958ee5d07b96a6dceb83fbb
8d7d4305d9042a6f0a276c0cd646b0f4a18da60a800e844a70f51ad46cc1bd09
9ecd5e18216a965021f794cc1fd255767f8437ce1dd6c6c2ff4ceea7ccc0073d
cd85c0f7385522688bad3cf0eb6ee89717a6d156b7859f77dd3b0c70d87922fa
cdcc6d6dcda827a694dce8bfa9a1ab41113b629ef1cc11f886866af9194c81d0
fc6e1e44fce24fcda33dfd0e0a05a77004b3cd1d81018e9616d6e4145145d0b9

gmail.huypion.tk Open in urlscan Pro 2400:cb00:2048:1::6818:79d0 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

13 Requests

23 %HTTPS

100 %IPv6

3 Domains

4 Subdomains

5 IPs

2 Countries

99 kBTransfer

196 kBSize

2 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

Indicators

gmail.huypion.tk Open in urlscan Pro
2400:cb00:2048:1::6818:79d0 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

23 %
HTTPS

100 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

99 kB
Transfer

196 kB
Size

2
Cookies

13 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!