docs.google.com
Open in
urlscan Pro
64.233.180.101
Malicious Activity!
Public Scan
Submission: On February 07 via api from US — Scanned from CA
Summary
TLS certificate: Issued by WR2 on January 19th 2026. Valid for: 3 months.
This is the only time docs.google.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AT&T (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 64.233.180.101 64.233.180.101 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 1 | 142.251.35.177 142.251.35.177 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 2 | 142.251.40.138 142.251.40.138 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 1 | 172.253.115.132 172.253.115.132 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 4 | 142.251.167.94 142.251.167.94 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 1 | 142.250.217.3 142.250.217.3 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 3 | 142.250.80.14 142.250.80.14 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 19 | 8 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: on-in-f101.1e100.net
| docs.google.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: lga25s78-in-f17.1e100.net
| csp.withgoogle.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: lga25s80-in-f10.1e100.net
| fonts.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: bg-in-f132.1e100.net
| lh7-rt.googleusercontent.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: ww-in-f94.1e100.net
| ssl.gstatic.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: pnlgaa-as-in-f3.1e100.net
| fonts.gstatic.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: lga34s33-in-f14.1e100.net
| play.google.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
google.com
docs.google.com — Cisco Umbrella Rank: 146 play.google.com — Cisco Umbrella Rank: 33 |
781 KB |
| 5 |
gstatic.com
ssl.gstatic.com fonts.gstatic.com |
68 KB |
| 2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 45 |
4 KB |
| 1 |
googleusercontent.com
lh7-rt.googleusercontent.com — Cisco Umbrella Rank: 798 |
20 KB |
| 1 |
withgoogle.com
csp.withgoogle.com — Cisco Umbrella Rank: 287 |
|
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 19 | 6 |
| Domain | Requested by | |
|---|---|---|
| 5 | docs.google.com |
docs.google.com
|
| 4 | ssl.gstatic.com |
docs.google.com
|
| 3 | play.google.com |
docs.google.com
|
| 2 | fonts.googleapis.com |
docs.google.com
|
| 1 | fonts.gstatic.com |
docs.google.com
|
| 1 | lh7-rt.googleusercontent.com |
docs.google.com
|
| 1 | csp.withgoogle.com |
docs.google.com
|
| 0 | invalid Failed |
docs.google.com
|
| 19 | 8 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.google.com WR2 |
2026-01-19 - 2026-04-13 |
3 months | crt.sh |
| *.appspot.com WR2 |
2026-01-12 - 2026-04-06 |
3 months | crt.sh |
| upload.video.google.com WR2 |
2026-01-12 - 2026-04-06 |
3 months | crt.sh |
| *.googleusercontent.com WR2 |
2026-01-19 - 2026-04-13 |
3 months | crt.sh |
| *.gstatic.com WR2 |
2026-01-19 - 2026-04-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&loop=false&delayms=3000
Frame ID: 72D0D5E35E50A900F1A5F49865DF6852
Requests: 18 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
pub
docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/ |
143 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
887848782-viewer_css_ltr.css
docs.google.com/static/presentation/client/css/ |
911 KB 112 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
m=core
docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/ |
1 MB 464 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
/
invalid/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
26981ed0d57bbad37e728ff58134270c
csp.withgoogle.com/csp/proto/ |
0 0 |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
AGV_vUeDvLCouabspwpC-K02sqgitRaNJLRvFmwiOW5h8V2Z3q9FGAOytrMZ8EjosF01YEVR-0SlMpY1RBN-diMyqnxcpPCtJD1cUvnbj_9iDA_G6WmBETQMmEmHomkDU4AeVNCefF5t_wot73S1a1soNa5cTaizU2lMh1_A80Ncx0DM=s2048
lh7-rt.googleusercontent.com/slidesz/ |
20 KB 20 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
4a6a08e5-54a1-4d2a-991f-bb344c78868f
https://docs.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
punchviewer_material_sprite46_grey_medium.svg
ssl.gstatic.com/docs/presentations/images/ |
55 KB 13 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
fonts.gstatic.com/s/roboto/v48/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
punchviewer_material_sprite46_grey_dark.svg
ssl.gstatic.com/docs/presentations/images/ |
55 KB 13 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
netcheck.gif
ssl.gstatic.com/docs/common/ |
43 B 207 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H3 |
log
play.google.com/ |
131 B 151 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
OPTIONS H2 |
log
play.google.com/ |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
m=secondary
docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/ |
455 KB 152 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
m=help
docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/ |
36 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon-2023q4.ico
ssl.gstatic.com/docs/presentations/images/ |
24 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H3 |
log
play.google.com/ |
131 B 151 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- invalid
- URL
- chrome-extension://invalid/
- Domain
- docs.google.com
- URL
- blob:https://docs.google.com/4a6a08e5-54a1-4d2a-991f-bb344c78868f
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AT&T (Telecommunication)38 JavaScript Window variables
These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.
object| ppConfig object| DOCS_timing object| WIZ_global_data object| _docs_flag_initialData function| _F_toggles_initialize function| a object| b object| d string| e object| _F_toggles function| DOCS_attachInitialMaterialFontLoadListener object| DOCS_timingPromises object| _docs_yt_api_youtube_ready_promise object| _$sk object| _F_toggles__$sk object| CLOSURE_DEFINES object| CLOSURE_UNCOMPILED_DEFINES function| DOCS_initializeModules number| U3bHHf function| DOCS_initDocsMobileWeb function| DOCS_initSlidesMobileWeb function| DOCS_initSheetsMobileWeb function| DOCS_installLinkReferrerSanitizer function| onYouTubeIframeAPIReady function| init_viewer object| __punchViewerWorkerInstance object| viewerData object| SK_viewerApp object| DOCS_initialLoadTiming object| closure_lm_574724 object| wizBind object| SK_viewerToastService object| SK_editorEventListener boolean| sup_wp_key number| SK_modelChunkLoadStart number| SK_modelChunkParseStart object| userfeedback function| startFeedback1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .google.com/ | Name: NID Value: 528=WFUEbJru49ST18ORCSg6qWNu-t8__pxJjMbPe-HbKGxWx1wJgAMgUwFa2YnPKv3-_IvZAWP_T2YxjzBJyomKhAqdjHN0QMYwCNJwkZkDi5ZTlE6b1p31NVeYVnUpJzy7XbVgSZs-svYr0ZCpjA3bt5FQJDiXtlh_sf4lPRt7-H4mhcr7jJFcFfjGyRiy5fvwET7NkVbU_jqVgab5lvM |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Content-Security-Policy | require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self' blob:;report-uri https://docs.google.com/presentation/cspreport;script-src 'report-sample' 'nonce-1UJ_AyWr4Asp5ZvQZzHEBg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob: |
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
csp.withgoogle.com
docs.google.com
fonts.googleapis.com
fonts.gstatic.com
invalid
lh7-rt.googleusercontent.com
play.google.com
ssl.gstatic.com
docs.google.com
invalid
142.250.217.3
142.250.80.14
142.251.167.94
142.251.35.177
142.251.40.138
172.253.115.132
64.233.180.101
1d2b1bf6c2921393f0eeb1b21613bb9e1c9144dfda918306ef99dbf0d9d2aee4
1d31f469ed26c1fb1b8a2348f329b45c6eb7214c3f5fbdd53e1d4d3062983cec
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
28fbba342904ed2e7449aa97c37ad1d7bff2016b1780822e65be1e95201f1bbd
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
4ba628219e133cc937a891e725e09749554d5cf43862e45807f4d68c35182c35
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
626a86217a7e26fe96db928c62ec5ad54e1c41a41abf63ca75f0ec17c7d68c45
6f04e79a74c8cc96f21ad21a2a4dff4443e3abacedc7540ae9bd000a590eba13
8fd8206e7d267b7b2340d1f5cc9670e83cb6b5f9a7b7861f709ec6456c7592ae
a5704a2c59946dd10ea8fecb69b31deb6e729501433422fbad8da4ac0abd58da
cee440c67d8c8fd61e06d65d10b9c54f3e465afdba03a7126715ccca43065679
d644f890d4021407715f113dfdd56c6f60963bf5850baa1c58b48a0af70d700c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f9b41bb504c0f7773a898244e1e28486040366380bffebf4f36120835016824c
