www.google.securecloudforce.com Open in urlscan Pro
103.52.168.102 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.google.securecloudforce.com/
Submission: On September 14 via automatic, source certstream-suspicious (September 14th 2021, 11:22:44 am UTC) — Scanned from DE

Summary HTTP 12 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 103.52.168.102, located in Australia and belongs to NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd, AU. The main domain is www.google.securecloudforce.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 14th 2021. Valid for: 3 months.

This is the only time www.google.securecloudforce.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address	AS Autonomous System
6	103.52.168.102 103.52.168.102	135543 (NETWORKDY...) (NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd)
1	2a00:1450:400... 2a00:1450:4007:809::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4007:817::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4007:819::2003	() ()
12	4

6 103.52.168.102 (Australia)

ASN135543 (NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd, AU)
PTR: server-1002.hostingcloud.com.au

www.google.securecloudforce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4007:809::200a (Ireland)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4007:817::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4007:819::2003 (None, )

ASN- ()

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	securecloudforce.com www.google.securecloudforce.com	3 KB
4	googleapis.com ajax.googleapis.com fonts.googleapis.com	33 KB
2	gstatic.com fonts.gstatic.com	28 KB
12	3

	Domain	Requested by
6	www.google.securecloudforce.com	www.google.securecloudforce.com ajax.googleapis.com
3	fonts.googleapis.com	www.google.securecloudforce.com
2	fonts.gstatic.com	fonts.googleapis.com
1	ajax.googleapis.com	www.google.securecloudforce.com
12	4

This site contains links to these domains. Also see Links.

Domain
support.google.com
policies.google.com

Subject Issuer	Validity	Valid
google.securecloudforce.com cPanel, Inc. Certification Authority	`2021-09-14` - `2021-12-13`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.google.securecloudforce.com/
Frame ID: 506C47A93E3AAEF7B6951881B71BAEE1
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Google Account

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

64 kB
Transfer

130 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://support.google.com/chrome/answer/6130773?hl=en
Title: Learn More

Search URL Search Domain Scan URL

URL: https://support.google.com/accounts?hl=en-GB#topic=3382296
Title: Help

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy?gl=AU&hl=en-GB
Title: Privacy

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms?gl=AU&hl=en-GB
Title: Terms

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.google.securecloudforce.com/ 4 KB
996 B 7634ms
280ms Document
text/html 103.52.168.102
NETWORKDYNAMICS-P...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.securecloudforce.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.52.168.102 , Australia, ASN135543 (NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd, AU),
Reverse DNS: server-1002.hostingcloud.com.au
Software: Apache /
Resource Hash: b1c6988110243319be29bc937bcfb7227c1a0e7a7180b8b4e76a2ae923f9b327

Request headers

:method: GET
:authority: www.google.securecloudforce.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Tue, 14 Sep 2021 11:22:33 GMT
server: Apache
last-modified: Tue, 14 Sep 2021 11:22:20 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 881
content-type: text/html

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 5111ms
26ms Script
text/javascript 2a00:1450:4007:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.google.securecloudforce.com
URL: https://www.google.securecloudforce.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:809::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.securecloudforce.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 15:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72853
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 13 Sep 2022 15:08:24 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1022 B 5129ms
30ms Stylesheet
text/css 2a00:1450:4007:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto

Requested by

Host: www.google.securecloudforce.com
URL: https://www.google.securecloudforce.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:817::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

99155f31d46dc469aa872ce824309fae9210fb9357f463b889d617b85b35eb61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.securecloudforce.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 14 Sep 2021 09:23:03 GMT
server: ESF
date: Tue, 14 Sep 2021 11:22:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Sep 2021 11:22:37 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
675 B 5130ms
31ms Stylesheet
text/css 2a00:1450:4007:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Noto%20Sans

Requested by

Host: www.google.securecloudforce.com
URL: https://www.google.securecloudforce.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:817::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

64ca58417fa9726bfbf28f7f71e3f1c69be4ba3aecd87d1b13f6c9b429c76518

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.securecloudforce.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 14 Sep 2021 09:30:41 GMT
server: ESF
date: Tue, 14 Sep 2021 11:22:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Sep 2021 11:22:37 GMT

GET
H2 200 css
fonts.googleapis.com/ 735 B
456 B 5129ms
30ms Stylesheet
text/css 2a00:1450:4007:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Kumbh%20Sans

Requested by

Host: www.google.securecloudforce.com
URL: https://www.google.securecloudforce.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:817::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

31e3718c78efc295a9c470acedba1ddd18951d4e38b688b1dbefe884092dc146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.securecloudforce.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 14 Sep 2021 11:22:37 GMT
server: ESF
date: Tue, 14 Sep 2021 11:22:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Sep 2021 11:22:37 GMT

GET
H2 200 getScreenType.js Show response
www.google.securecloudforce.com/js/ 179 B
158 B 290ms
289ms Script
application/javascript 103.52.168.102
NETWORKDYNAMICS-P...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.securecloudforce.com/js/getScreenType.js
Requested by: Host: www.google.securecloudforce.com
URL: https://www.google.securecloudforce.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.52.168.102 , Australia, ASN135543 (NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd, AU),
Reverse DNS: server-1002.hostingcloud.com.au
Software: Apache /
Resource Hash: a26d8fc44963ae9b8b5ad4ef59f935da5ecdc478b0095965c76a851b75efae36

Request headers

:path: /js/getScreenType.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.google.securecloudforce.com
referer: https://www.google.securecloudforce.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.securecloudforce.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 11:22:33 GMT
content-encoding: br
last-modified: Tue, 14 Sep 2021 11:22:20 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 110

GET
H2 200 stylesheet-global.css
www.google.securecloudforce.com/css/ 47 B
83 B 287ms
287ms Stylesheet
text/css 103.52.168.102
NETWORKDYNAMICS-P...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.securecloudforce.com/css/stylesheet-global.css
Requested by: Host: www.google.securecloudforce.com
URL: https://www.google.securecloudforce.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.52.168.102 , Australia, ASN135543 (NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd, AU),
Reverse DNS: server-1002.hostingcloud.com.au
Software: Apache /
Resource Hash: 5ed01ae938b1779d74b5cbc2a55c779ccd1b7ad7ac9db7aadf8413d7cf63b67c

Request headers

:path: /css/stylesheet-global.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.google.securecloudforce.com
referer: https://www.google.securecloudforce.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.securecloudforce.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 11:22:33 GMT
content-encoding: br
last-modified: Tue, 14 Sep 2021 11:22:20 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 45

GET
H2 200 setIndexStylesheet.js Show response
www.google.securecloudforce.com/js/ 297 B
177 B 291ms
291ms Script
application/javascript 103.52.168.102
NETWORKDYNAMICS-P...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.securecloudforce.com/js/setIndexStylesheet.js
Requested by: Host: www.google.securecloudforce.com
URL: https://www.google.securecloudforce.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.52.168.102 , Australia, ASN135543 (NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd, AU),
Reverse DNS: server-1002.hostingcloud.com.au
Software: Apache /
Resource Hash: 2d230eef95f25e27d29c6dde7b29d27f294d5945d40a809d68a91b3abfedc15f

Request headers

:path: /js/setIndexStylesheet.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.google.securecloudforce.com
referer: https://www.google.securecloudforce.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.securecloudforce.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 11:22:33 GMT
content-encoding: br
last-modified: Tue, 14 Sep 2021 11:22:20 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 145

GET
H2 200 setOtherStylesheet.js Show response
www.google.securecloudforce.com/js/ 299 B
178 B 294ms
293ms Script
application/javascript 103.52.168.102
NETWORKDYNAMICS-P...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.securecloudforce.com/js/setOtherStylesheet.js
Requested by: Host: www.google.securecloudforce.com
URL: https://www.google.securecloudforce.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.52.168.102 , Australia, ASN135543 (NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd, AU),
Reverse DNS: server-1002.hostingcloud.com.au
Software: Apache /
Resource Hash: 4f50a84a8a004ba532c5dfa7205fcbaf946755c22e906603b0eec7cef731d456

Request headers

:path: /js/setOtherStylesheet.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.google.securecloudforce.com
referer: https://www.google.securecloudforce.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.securecloudforce.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 11:22:33 GMT
content-encoding: br
last-modified: Tue, 14 Sep 2021 11:22:20 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 146

GET
H2 200 stylesheet-large.css
www.google.securecloudforce.com/css/ 5 KB
1 KB 820ms
280ms Stylesheet
text/css 103.52.168.102
NETWORKDYNAMICS-P...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.securecloudforce.com/css/stylesheet-large.css
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.52.168.102 , Australia, ASN135543 (NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd, AU),
Reverse DNS: server-1002.hostingcloud.com.au
Software: Apache /
Resource Hash: 6f079a1b47fa39dc6d051d9072a6559435bec16975d6b174aff5c4ef681896be

Request headers

:path: /css/stylesheet-large.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.google.securecloudforce.com
referer: https://www.google.securecloudforce.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.securecloudforce.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 11:22:39 GMT
content-encoding: br
last-modified: Tue, 14 Sep 2021 11:22:20 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1285

GET
H2 200 c4mw1n92AsfhuCq6tVsaoIx1CHIi4kToNorqShNPVo0.woff2
fonts.gstatic.com/s/kumbhsans/v6/ 12 KB
12 KB 5147ms
41ms Font
font/woff2 2a00:1450:4007:819::2003

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/kumbhsans/v6/c4mw1n92AsfhuCq6tVsaoIx1CHIi4kToNorqShNPVo0.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Kumbh%20Sans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:819::2003 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

6e04f3716af5922dcfa435b246e6889a0af54214822457a9150ce0b27517df17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.google.securecloudforce.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 08:40:22 GMT
x-content-type-options: nosniff
age: 268941
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12380
x-xss-protection: 0
last-modified: Wed, 18 Aug 2021 18:03:45 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 11 Sep 2022 08:40:22 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 5130ms
24ms Font
font/woff2 2a00:1450:4007:819::2003

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:819::2003 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.google.securecloudforce.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 17:57:59 GMT
x-content-type-options: nosniff
age: 62684
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 13 Sep 2022 17:57:59 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
www.google.securecloudforce.com
103.52.168.102
2a00:1450:4007:809::200a
2a00:1450:4007:817::200a
2a00:1450:4007:819::2003
2d230eef95f25e27d29c6dde7b29d27f294d5945d40a809d68a91b3abfedc15f
31e3718c78efc295a9c470acedba1ddd18951d4e38b688b1dbefe884092dc146
4f50a84a8a004ba532c5dfa7205fcbaf946755c22e906603b0eec7cef731d456
5ed01ae938b1779d74b5cbc2a55c779ccd1b7ad7ac9db7aadf8413d7cf63b67c
64ca58417fa9726bfbf28f7f71e3f1c69be4ba3aecd87d1b13f6c9b429c76518
6e04f3716af5922dcfa435b246e6889a0af54214822457a9150ce0b27517df17
6f079a1b47fa39dc6d051d9072a6559435bec16975d6b174aff5c4ef681896be
99155f31d46dc469aa872ce824309fae9210fb9357f463b889d617b85b35eb61
a26d8fc44963ae9b8b5ad4ef59f935da5ecdc478b0095965c76a851b75efae36
b1c6988110243319be29bc937bcfb7227c1a0e7a7180b8b4e76a2ae923f9b327
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

www.google.securecloudforce.com Open in urlscan Pro 103.52.168.102 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

75 %IPv6

3 Domains

4 Subdomains

4 IPs

2 Countries

64 kBTransfer

130 kBSize

0 Cookies

4 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

www.google.securecloudforce.com Open in urlscan Pro
103.52.168.102 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

64 kB
Transfer

130 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!