google-qfr.xyz
Open in
urlscan Pro
2606:4700:3036::ac43:c513
Malicious Activity!
Public Scan
Effective URL: https://google-qfr.xyz/?id=s7
Submission: On July 13 via api from US — Scanned from US
Summary
TLS certificate: Issued by WE1 on July 12th 2024. Valid for: 3 months.
This is the only time google-qfr.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2606:4700:303... 2606:4700:3036::ac43:c513 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 52.95.177.16 52.95.177.16 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c0b::84 | 15169 (GOOGLE) (GOOGLE) | |
5 | 2607:f8b0:400... 2607:f8b0:4004:c0b::77 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c1f::5e | 15169 (GOOGLE) (GOOGLE) | |
36 | 6 |
ASN16509 (AMAZON-02, US)
PTR: s3-r-w.ap-southeast-3.amazonaws.com
appdv76.s3.ap-southeast-3.amazonaws.com |
ASN15169 (GOOGLE, US)
lh3.googleusercontent.com |
ASN15169 (GOOGLE, US)
play-lh.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 110 play-lh.googleusercontent.com — Cisco Umbrella Rank: 631 |
4 KB |
3 |
amazonaws.com
appdv76.s3.ap-southeast-3.amazonaws.com — Cisco Umbrella Rank: 767003 |
10 KB |
2 |
google-qfr.xyz
google-qfr.xyz |
650 KB |
1 |
gstatic.com
www.gstatic.com |
1 KB |
0 |
vofzhq.com
Failed
www.vofzhq.com Failed |
|
36 | 5 |
Domain | Requested by | |
---|---|---|
5 | play-lh.googleusercontent.com |
google-qfr.xyz
|
3 | appdv76.s3.ap-southeast-3.amazonaws.com |
google-qfr.xyz
|
2 | google-qfr.xyz |
google-qfr.xyz
|
1 | www.gstatic.com | |
1 | lh3.googleusercontent.com |
google-qfr.xyz
|
0 | www.vofzhq.com Failed |
google-qfr.xyz
|
36 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
google-qfr.xyz WE1 |
2024-07-12 - 2024-10-10 |
3 months | crt.sh |
*.s3.ap-southeast-3.amazonaws.com Amazon RSA 2048 M01 |
2024-06-20 - 2025-06-02 |
a year | crt.sh |
*.googleusercontent.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
edgestatic.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://google-qfr.xyz/?id=s7
Frame ID: 864780DFEADC2A90F6B63F64A3090875
Requests: 36 HTTP requests in this frame
Screenshot
Page Title
7276 – Apps on Google PlayPage URL History Show full URLs
- https://google-qfr.xyz/ Page URL
- https://google-qfr.xyz/?id=s7 Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://google-qfr.xyz/ Page URL
- https://google-qfr.xyz/?id=s7 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
36 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
/
google-qfr.xyz/ |
698 KB 325 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
style.css
www.vofzhq.com//resource/save9/assets/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
clipboard.min.js
www.vofzhq.com//resource/save9/assets/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
qrcode.min.js
www.vofzhq.com//resource/save9/assets/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
import-scripts.js
appdv76.s3.ap-southeast-3.amazonaws.com/adjust/ |
9 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
email-decode.min.js
www.vofzhq.com//resource/save9/assets/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
7276.js
appdv76.s3.ap-southeast-3.amazonaws.com/download-app/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
9906label-adjust-android-ios.js
www.vofzhq.com//resource/save9/assets/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
google-qfr.xyz/ |
698 KB 325 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
style.css
www.vofzhq.com//resource/save9/assets/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
clipboard.min.js
www.vofzhq.com//resource/save9/assets/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
qrcode.min.js
www.vofzhq.com//resource/save9/assets/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
import-scripts.js
appdv76.s3.ap-southeast-3.amazonaws.com/adjust/ |
9 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ACg8ocIViwTDhpGxCyQsQwqTKli-MfAWlNQcq6b_czIEjrBAFA=s32-c-k-cc-mo
lh3.googleusercontent.com/a/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7.png
www.vofzhq.com/resource/save1/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_KiRouu_G6J_2jwePzQ_i5_FMc_SVKT3mI7d7KKq9zca-Nr8bj2bPasawLvk6ajzASQS-90a8hYXeAh0lQ=w96-h32-rw
play-lh.googleusercontent.com/ |
222 B 523 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7-1.png
www.vofzhq.com/resource/save1/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7-2.png
www.vofzhq.com/resource/save1/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7-3.png
www.vofzhq.com/resource/save1/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7-4.png
www.vofzhq.com/resource/save1/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7-5.png
www.vofzhq.com/resource/save1/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iFstqoxDElUVv4T3KxkxP3OTcuFvWF5ZQQjT7aIxy4n2uaVigCCykxeG6EZV9FQ10X1itPj1oORm=s20-rw
play-lh.googleusercontent.com/ |
200 B 290 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
12USW7aflgz466ifDehKTnMoAep_VHxDmKJ6jEBoDZWCSefOC-ThRX14Mqe0r8KF9XCzrpMqJts=s20-rw
play-lh.googleusercontent.com/ |
244 B 335 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
W5DPtvB8Fhmkn5LbFZki_OHL3ZI1Rdc-AFul19UK4f7np2NMjLE5QquD6H0HAeEJ977u3WH4yaQ=s20-rw
play-lh.googleusercontent.com/ |
200 B 287 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ohRyQRA9rNfhp7xLW0MtW1soD8SEX45Oec7MyH3FaxtukWUG_6GKVpvh3JiugzryLi7Bia02HPw=s20-rw
play-lh.googleusercontent.com/ |
164 B 255 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
indonesia.png
www.vofzhq.com/resource/save1/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
email-decode.min.js
www.vofzhq.com//resource/save9/assets/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
7276.js
appdv76.s3.ap-southeast-3.amazonaws.com/download-app/ |
154 B 561 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
9906label-adjust-android-ios.js
www.vofzhq.com//resource/save9/assets/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7.png
www.vofzhq.com//resource/save9/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7-1.png
www.vofzhq.com//resource/save9/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7-2.png
www.vofzhq.com//resource/save9/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7-3.png
www.vofzhq.com//resource/save9/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7-4.png
www.vofzhq.com//resource/save9/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s7-5.png
www.vofzhq.com//resource/save9/assets/image/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon_v3.ico
www.gstatic.com/android/market_images/web/ |
4 KB 1 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/css/style.css
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/js/clipboard.min.js
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/js/qrcode.min.js
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/js/email-decode.min.js
- Domain
- appdv76.s3.ap-southeast-3.amazonaws.com
- URL
- https://appdv76.s3.ap-southeast-3.amazonaws.com/download-app/7276.js
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/js/9906label-adjust-android-ios.js
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/css/style.css
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/js/clipboard.min.js
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/js/qrcode.min.js
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com/resource/save1/assets/image/s7.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com/resource/save1/assets/image/s7-1.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com/resource/save1/assets/image/s7-2.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com/resource/save1/assets/image/s7-3.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com/resource/save1/assets/image/s7-4.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com/resource/save1/assets/image/s7-5.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com/resource/save1/assets/image/indonesia.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/js/email-decode.min.js
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/js/9906label-adjust-android-ios.js
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/image/s7.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/image/s7-1.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/image/s7-2.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/image/s7-3.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/image/s7-4.png
- Domain
- www.vofzhq.com
- URL
- https://www.vofzhq.com//resource/save9/assets/image/s7-5.png
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| urlParams object| downloadLink function| similarGamesClick0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
appdv76.s3.ap-southeast-3.amazonaws.com
google-qfr.xyz
lh3.googleusercontent.com
play-lh.googleusercontent.com
www.gstatic.com
www.vofzhq.com
appdv76.s3.ap-southeast-3.amazonaws.com
www.vofzhq.com
2606:4700:3036::ac43:c513
2607:f8b0:4004:c0b::77
2607:f8b0:4004:c0b::84
2607:f8b0:4004:c1f::5e
52.95.177.16
1899a841d86f48016031006062751e6fe16b1761b7f6a10df87c534d5e07f480
329ad3c7ac436f964c7a8cfcc6a74c859b51cdabd8974a65f0836410b11f2dc5
4ca6122030dea2d2e66cde8f69cc201e27169e9d96380e736e9224c9e320a4f6
510fbe13f4c1c430dc139877f67a3182948d5cac43b748ba12cc41ccfaf015fe
6cd9fdd3b8fdb2df17d4d09fb17006c8eb39a3df753d04d541472a4c8e708284
7163ed07fc099c1d8eb7ad4ea82ab3ac04b9062613a22e0a6b9f9f9943383118
8c66b3cb207515328ac21bdbbda1b90a74d7cac66267352048bfd7e4e1efe627
b20fd6b6562361099d4e03304ded969bf0883f066b441653941958418a381394
de88165fa4d58b4ad531b6f8d8facbc5dc00f73e96b617e503d36fee29c53cec
f343b3015d0545a7d5b719a434135bcae2ac766ed459aeea671e3688b79d1875