urlscan.io logo urlscan.io
SecurityTrails logo

google.loginprotections.com Open in urlscan Pro
154.62.109.199  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://google.loginprotections.com/
Submission: On May 01 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 10 HTTP transactions. The main IP is 154.62.109.199, located in Vilnius, Lithuania and belongs to AS-HOSTINGER, CY. The main domain is google.loginprotections.com.
TLS certificate: Issued by R3 on May 1st 2024. Valid for: 3 months.
This is the only time google.loginprotections.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

IP Address AS Autonomous System
2 154.62.109.199 47583 (AS-HOSTINGER)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 162.19.58.156 16276 (OVH)
5 172.67.139.119 13335 (CLOUDFLAR...)
10 5
Apex Domain
Subdomains		 Transfer
6 fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 1791
ka-f.fontawesome.com — Cisco Umbrella Rank: 4267
189 KB
2 loginprotections.com
google.loginprotections.com
4 KB
1 ibb.co
i.ibb.co — Cisco Umbrella Rank: 11175
29 KB
0 googleapis.com Failed
fonts.googleapis.com Failed
10 4
Domain Requested by
5 ka-f.fontawesome.com kit.fontawesome.com
2 google.loginprotections.com
1 i.ibb.co google.loginprotections.com
1 kit.fontawesome.com google.loginprotections.com
0 fonts.googleapis.com Failed google.loginprotections.com
10 5

This site contains no links.

Subject Issuer Validity Valid
google.loginprotections.com
R3		 2024-05-01 -
2024-07-30		 3 months crt.sh
*.fontawesome.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-12-04 -
2025-01-03		 a year crt.sh
ibb.co
R3		 2024-04-22 -
2024-07-21		 3 months crt.sh
ka-f.fontawesome.com
GTS CA 1P5		 2024-03-05 -
2024-06-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://google.loginprotections.com/
Frame ID: C00B3A8E6C6BBFB6B634E7348257E27F
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Google

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • kit\.fontawesome\.com/([0-9a-z]+).js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

10
Requests

90 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

222 kB
Transfer

335 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
google.loginprotections.com/ 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://google.loginprotections.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
154.62.109.199 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
2b0e28fa93e92ff5aacc4f8bb9a1be090bbf075815ddd74261dbe5b88a092137

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Wed, 01 May 2024 23:20:52 GMT
ETag
W/"66311d1d-15ab"
Last-Modified
Tue, 30 Apr 2024 16:32:29 GMT
Server
nginx/1.18.0 (Ubuntu)
Transfer-Encoding
chunked
css2
fonts.googleapis.com/ 		0
0
cae01f65b9.js
kit.fontawesome.com/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kit.fontawesome.com/cae01f65b9.js
Requested by
Host: google.loginprotections.com
URL: https://google.loginprotections.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c0b2fcbf51fd1461d45b9048a10863c4c1acc6f8004100cd03baa32f5dcb801

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Origin
https://google.loginprotections.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 23:20:52 GMT
content-encoding
gzip
cf-cache-status
REVALIDATED
server
cloudflare
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age
3000
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
*
content-type
text/javascript
cache-control
max-age=60, public, stale-while-revalidate=30
cf-ray
87d38131af7f71b8-FRA
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id
F8s_JWDufi-LhXzDh1pC
Google-Logo-wine.png
i.ibb.co/vwYVFHN/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/vwYVFHN/Google-Logo-wine.png
Requested by
Host: google.loginprotections.com
URL: https://google.loginprotections.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.58.156 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3096358.ip-162-19-58.eu
Software
nginx /
Resource Hash
51a9d448eca1c3d1263c8cb1598c8262eed999d838c1152cb3a0537572db0e26

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 23:20:52 GMT
last-modified
Mon, 22 Apr 2024 06:13:55 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
29805
expires
Thu, 31 Dec 2037 23:55:55 GMT
free.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ 		101 KB
24 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.5.2/css/free.min.css?token=cae01f65b9
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/cae01f65b9.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e9c73fa687cd4110688668977a7caa87f5a1dee0d11f03687bd4871deedf1c1

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 23:20:52 GMT
via
1.1 8fd360cd20d33fa1400394ae41746f66.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
age
65130
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 02 Apr 2024 15:26:25 GMT
server
cloudflare
etag
W/"7f29cd8c97789aa298af8c61623ca28b"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t2X48Bs%2Bg1vvJ44UwCD1InTTl3tN4H9uzMqevIBd5O4AtvVvAOHyznwo9SGN6NmLSImOiK6j1Rxifkm9H6imRxRBNe4eWA0d5hJQGDxoJa1KuSCsnrZGNtcT5RvFbIY6YsYGn%2BKQlg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
87d38132ce7d92c9-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
38JQ7DOk8lqALG8PAWvkXROEMRhVzVTza2NOVz9q3LZyg6htBoJ2mw==
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ 		27 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.5.2/css/free-v4-shims.min.css?token=cae01f65b9
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/cae01f65b9.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4e953827930889e844103c3a6771bd2e9de17d091b36378c40362271858e075

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 23:20:52 GMT
via
1.1 0d4b487d54766de7560aa02de852bbf8.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
age
65130
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 02 Apr 2024 15:26:25 GMT
server
cloudflare
etag
W/"940b066040a876fa1dc7b2ee2d222a58"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FZdDCGVDbFek%2Fi%2FbhmARqaW38OO4yrClXMJL1P8mvoddISKuodnR1PTRb5Sak3FrSXezLisGI1zAnhFNWWO7A1rErlev0Kn6W3mGUcFSz%2Frz59onmAL%2FD%2B8CCkDcOK9e2TMwWkHBIA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
87d38132ce7f92c9-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
7j2l50OPfsoi66gjawxpm4akgC6t2epKc1fUqEeMp7d7671n9GP7vQ==
free-v5-font-face.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ 		823 B
1020 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.5.2/css/free-v5-font-face.min.css?token=cae01f65b9
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/cae01f65b9.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1dc27b700a62c005e4521b670cac08fb0b4b3e02a73c1ac44e7f9a9784bd672

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 23:20:52 GMT
via
1.1 fdc45b521af7652438141328494a79d2.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
age
65130
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 02 Apr 2024 15:26:25 GMT
server
cloudflare
etag
W/"a3d53e21a02e37af6cbc00ac63b3cc1e"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3KXH4DCL5KmAbSES3rqhzzRSjHp%2BLUcM8CJpi0urqNhAuZiviqAJHkk0xWtNU91BfItwNTb7Q5NKEBcKHbeN0Vqj5rTB3t2uoPz4XzV4dK2PlZdggQL2ua%2Bd3sH9LpZovo1Wdv4g9w%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
87d38132ce8092c9-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
QBm0_2ZxNuwbTF_uh66Mj6WzNQlV-TPgOX5VL1MvaiXyCNV4BXoDyQ==
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ 		2 KB
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.5.2/css/free-v4-font-face.min.css?token=cae01f65b9
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/cae01f65b9.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9699b18200a9d40ed7859411c33cfa2194174a4746d466123107f888d93dc878

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 23:20:52 GMT
via
1.1 fd3cce3e0bafd8b312277d0ad9f4762e.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
age
65130
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 02 Apr 2024 15:26:25 GMT
server
cloudflare
etag
W/"9c9f596493867f0e7ef5f9fe99103fce"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N7JAzmrvUZMG38Lo2lEy%2Fo0cufrPcRtNu79gbiWSRxM9dMv5oJhcjrIhrJEBfIcp1Xw2kEmcdom%2FZ%2BIxD7iXcO0KUcDOgvSk%2B%2FKHNJ%2Fn8k1eygVoYt%2Bwi4juNlis6Rl6KaRhUfaBGA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
87d38132ce7c92c9-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
FIflG5_fl199ikSIAxkF7MpzytNUrrQGUnEvPhmWa8lY9g6YoUsMDw==
favicon.ico
google.loginprotections.com/ 		5 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://google.loginprotections.com/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
154.62.109.199 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
2b0e28fa93e92ff5aacc4f8bb9a1be090bbf075815ddd74261dbe5b88a092137

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 01 May 2024 23:20:52 GMT
Content-Encoding
gzip
Last-Modified
Tue, 30 Apr 2024 16:32:29 GMT
Server
nginx/1.18.0 (Ubuntu)
ETag
W/"66311d1d-15ab"
Transfer-Encoding
chunked
Content-Type
text/html
Connection
keep-alive
free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v6.5.2/webfonts/ 		153 KB
153 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.5.2/webfonts/free-fa-solid-900.woff2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
41dca0965bdfd255f85e7fc8e9a3dc1fe3eb810996c553d4ef2b8872737ee825

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://google.loginprotections.com/
Origin
https://google.loginprotections.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 01 May 2024 23:20:53 GMT
via
1.1 747e99d9d8c5e29fdc713cf866bc3f82.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
age
65130
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
content-length
156388
last-modified
Tue, 02 Apr 2024 15:51:14 GMT
server
cloudflare
etag
"ae015e3286ef56a0daf8e83838a32a88"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bmb2nQrfpV5p4kdvxez0Q3doX6TKm4sg3q5hjeNcnTCy7s8Ji1lWy212Nsmic402CLBVpepO1RXPANGY5U3N%2Bd%2BMvQJwxKTjuECsi31mhAmkRTkx32dim4FOpJlb5yaAZOZ7wmPQ7g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
accept-ranges
bytes
cf-ray
87d381335ed992c9-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
mKXCze7402Y40nW6RQpwIB0rRmn5xLFM5G_YcCMQdfwZwz1jw3XAHw==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css2?family=arial:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| FontAwesomeKitConfig

0 Cookies