docs.google.com
142.251.111.100
Public Scan
Open in
urlscan Pro
Submission Tags: phishing
Submission: On March 29 via api from US — Scanned from CA
Summary
TLS certificate: Issued by WR2 on March 9th 2026. Valid for: 3mo.
This is the only time docs.google.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 4 | 142.251.111.100 142.251.111.100 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 1 | 142.251.111.94 142.251.111.94 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 1 | 142.251.179.94 142.251.179.94 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 6 | 3 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: bk-in-f100.1e100.net
| docs.google.com 9yr old |
ASN15169 (GOOGLE - Google LLC, US)
PTR: bk-in-f94.1e100.net
| fonts.gstatic.com 9yr old |
ASN15169 (GOOGLE - Google LLC, US)
PTR: pd-in-f94.1e100.net
| ssl.gstatic.com 10yr old |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
google.com
docs.google.com — Cisco Umbrella Rank: 327 9yr old |
141 KB |
| 2 |
gstatic.com
fonts.gstatic.com — Cisco Umbrella Rank: 25 9yr old ssl.gstatic.com — Cisco Umbrella Rank: 76 10yr old |
26 KB |
| 6 | 2 |
| Domain | Requested by | |
|---|---|---|
| 4 | docs.google.com |
docs.google.com
|
| 1 | ssl.gstatic.com | |
| 1 | fonts.gstatic.com |
docs.google.com
|
| 6 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.google.com WR2 |
2026-03-09 - 2026-06-01 |
3mo | crt.sh |
| *.gstatic.com WR2 |
2026-03-09 - 2026-06-01 |
3mo | crt.sh |
This page contains 1 frames:
Primary Page:
https://docs.google.com/drawings/d/1028P1REO_YqhnhkO5BUCXjXu2hAfdrsQjd1eLVe8CMU/preview?usp=embed_googleplus
Frame ID: E17C8B0162B67EA8808B91792B7DEBCF
Requests: 6 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
preview
docs.google.com/drawings/d/1028P1REO_YqhnhkO5BUCXjXu2hAfdrsQjd1eLVe8CMU/ |
68 KB 25 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
400077200-preview_css_ltr.css
docs.google.com/static/drawings/client/css/ |
325 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
m=core
docs.google.com/_/drawings/_/js/k=sketchy.preview.en_CA.HCqvmUNDtqE.es5.O/am=AACGAQ/d=0/wt=0/rs=AFJjx_4capuQ_VBwTL-KqqTTM4Cl8R-e7g/ |
139 KB 53 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
AGkPL5GAFfHReEkIyQyCG69IZmrjclNcOSmvMLxT_DZXEr0t6WNy82KY633gtuCCAAL5-9O8zuiZjuKr_3CMA_cKn_Otkfb-LDYnaYPh__KndZS2XwEUzo50RiL51NFiNOI_3rRJYKmHAZKvPK1NKtl8e9Y57Zrm93ACFJJs-GAo
docs.google.com/drawings-images-rt/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiA8.ttf
fonts.gstatic.com/s/roboto/v48/ |
41 KB 26 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon5.ico
ssl.gstatic.com/docs/drawings/images/ |
1 KB 712 B |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
20 JavaScript Window variables
These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.
object| ppConfig object| DOCS_timing object| WIZ_global_data object| _docs_flag_initialData function| _F_toggles_initialize function| a object| b object| d string| e object| _F_toggles function| DOCS_attachInitialMaterialFontLoadListener object| DOCS_timingPromises object| _$sk object| _F_toggles__$sk number| U3bHHf function| DOCS_installLinkReferrerSanitizer function| DOCS_initializeModules object| CLOSURE_DEFINES object| CLOSURE_UNCOMPILED_DEFINES function| init_preview1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .google.com/ | Name: NID Value: 530=CH-l-XPGkJvG0KbQ47M3kXqLl7F95oci2YKMBErWXcKSzNfGvzPFSTz3m7spb_ioUs2a6ejWoxlhO2BRKVlyB1VOVTMw-jy1uv3Wz4_qdTAlk2hPTTNvRVMou4asSycIJNxJDjJ0jfQxy7gxGgl1dxWkge32sWNqzjZJRTpwAVjgR5_JGbU3U7FhHv5qNDc3F3pA1uIaFrLFPTxYbA |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Content-Security-Policy | require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self' blob:;report-uri https://docs.google.com/drawings/cspreport;script-src 'nonce-OzSEAr7ugWz2e0_Md0-VYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' |
| X-Content-Type-Options | nosniff |
| X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
docs.google.com
fonts.gstatic.com
ssl.gstatic.com
142.251.111.100
142.251.111.94
142.251.179.94
67a09262294ed5d0783c5f2ab20d9673654c2de3d038704737ebfe9e826ed613
7ef6146e9a0a7f05e96793b9bc5b48ca92f91d3d9d4aa02987af95e39ae1b625
9fea566760e23830fb440b59122afe4636a63e1997dbeafc60a701bbe213b165
cb6b6361d84fb7ef00619465ba19736ca55c617ae6f547891ff94f21623ba066
cd75b7b0e806dc4509138b2e6ef5ea0241b48366a7efbd825818eeea6ab4c4e6
d83294bfc4391f85a71b0301e0ac788682be0583ddd149018b268da8d40ff554
