sites.google.com
Open in
urlscan Pro
2a00:1450:4001:825::200e
Malicious Activity!
Public Scan
Submission: On September 17 via manual from AU
Summary
TLS certificate: Issued by GTS CA 1O1 on August 26th 2020. Valid for: 3 months.
This is the only time sites.google.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2a00:1450:400... 2a00:1450:4001:825::200e | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:819::200a | 15169 (GOOGLE) (GOOGLE) | |
7 | 2a00:1450:400... 2a00:1450:4001:801::2003 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:81f::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::2001 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:81d::2003 | 15169 (GOOGLE) (GOOGLE) | |
17 | 6 |
ASN15169 (GOOGLE, US)
lh5.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
605 KB |
5 |
google.com
sites.google.com apis.google.com |
126 KB |
2 |
googleapis.com
fonts.googleapis.com |
2 KB |
1 |
googleusercontent.com
lh5.googleusercontent.com |
134 KB |
17 | 4 |
Domain | Requested by | |
---|---|---|
7 | www.gstatic.com |
sites.google.com
www.gstatic.com |
3 | apis.google.com |
sites.google.com
apis.google.com |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | fonts.googleapis.com |
sites.google.com
|
2 | sites.google.com |
www.gstatic.com
|
1 | lh5.googleusercontent.com |
sites.google.com
|
17 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google.com GTS CA 1O1 |
2020-08-26 - 2020-11-18 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-08-26 - 2020-11-18 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-08-26 - 2020-11-18 |
3 months | crt.sh |
*.apis.google.com GTS CA 1O1 |
2020-08-26 - 2020-11-18 |
3 months | crt.sh |
*.googleusercontent.com GTS CA 1O1 |
2020-09-03 - 2020-11-26 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://sites.google.com/view/ghbjnkmldfg/%D8%A7%D9%84%D8%B5%D9%81%D8%AD%D8%A9-%D8%A7%D9%84%D8%B1%D8%A6%D9%8A%D8%B3%D9%8A%D8%A9
Frame ID: 1908BEF32DD8F3559BB4271D0AFAFBE1
Requests: 16 HTTP requests in this frame
Frame:
https://www.gstatic.com/atari/embeds/5de913a2354e93acf4d43c4db53928e5/intermediate-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.hc3rLxj9u8o.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCMtAagp6kGxB19Nep_bTJunj37kww%2Fm%3D__features__&r=549059944
Frame ID: FB820E9EC2485C578CD42784B5802FC5
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
Google Sites (CMS) ExpandDetected patterns
- url /^https?:\/\/sites\.google\.com/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Learn more
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
%D8%A7%D9%84%D8%B5%D9%81%D8%AD%D8%A9-%D8%A7%D9%84%D8%B1%D8%A6%D9%8A%D8%B3%D9%8A%D8%A9
sites.google.com/view/ghbjnkmldfg/ |
62 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 666 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
19 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rs=AGEqA5l9GQttD0QC1aj6ASwcHE8MYNfseQ
www.gstatic.com/_/atari/_/ss/k=atari.vw.KhixqTaAquA.L.W.O/d=1/ct=zgms/ |
412 KB 63 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
client.js
apis.google.com/js/ |
13 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
m=view
www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.EDs1-1WMVbE.O/d=1/ct=zgms/rs=AGEqA5mC2b8f9Rv_coi3qQHKaYXhgzOmRQ/ |
526 KB 173 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
cb=gapi.loaded_0
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=client/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/ |
302 KB 103 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CzW6uAFQWjAj6IYBpbg7WultKkoCGQ5-dMGJ6e9YXaEbOsf9t7OXCpTy-MdZQGfQ32p0XpM=w16383
lh5.googleusercontent.com/ |
134 KB 134 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
logImpressions
sites.google.com/_/view/ |
17 B 480 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
m=A4UTCb,xiqF3,owcnme,qAKInc,sy1v,TGYpv,kbkrpd,X85Uvc,HIeYee,QxOCld,sy2a,abQiW,W26a5e,sy1w,sy1u,sy21,fuVYe,hJUyqe,NpD4ec,OqIWSb,uslqB,PQmzu,oNFsLb,qEW1W,ruhlUe,sy11,sy12,xQtZb,ENNBBf,XxVkUe,gaMBzf,...
www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.EDs1-1WMVbE.O/d=0/ct=zgms/rs=AGEqA5mC2b8f9Rv_coi3qQHKaYXhgzOmRQ/ |
1 MB 327 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
m=EGNJFf
www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.EDs1-1WMVbE.O/d=0/ct=zgms/rs=AGEqA5mC2b8f9Rv_coi3qQHKaYXhgzOmRQ/ |
6 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
m=sy1a,fgj8Rb,sy1c,uY3Nvd,syg,syi,HYv29e
www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.EDs1-1WMVbE.O/d=0/ct=zgms/rs=AGEqA5mC2b8f9Rv_coi3qQHKaYXhgzOmRQ/ |
21 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
m=pB6Zqd,syt,IZT63,SF3gsd,vfuNJf,syo,syn,sym,syr,sys,syu,syy,YNjGDd,n73qwf,syx,syz,PrPYRd,xs1Gy,hc6Ubd,o02Jie,SpsfSb,sy15,sy14,syj,sy13,zbML3c
www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.EDs1-1WMVbE.O/d=0/ct=zgms/rs=AGEqA5mC2b8f9Rv_coi3qQHKaYXhgzOmRQ/ |
24 KB 9 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
cb=gapi.loaded_1
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=gapi_rpc/exm=client/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/ |
271 B 267 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
intermediate-frame-minified.html
www.gstatic.com/atari/embeds/5de913a2354e93acf4d43c4db53928e5/ Frame FB82 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes object| DOCS_timing function| _DumpException object| _docs_flag_initialData object| _docs_flag_cek function| gapiLoaded object| _at_config object| globals object| messages object| gapi object| ___jsl object| gadgets object| osapi object| shindig object| googleapis object| oauth2 object| iframer function| ToolbarApi object| iframes function| IframeBase function| Iframe function| IframeProxy function| IframeWindow object| __gapi_jstiming__ object| default_vw function| _F_getAverageFps object| _bind object| closure_lm_809580 number| closure_uid_789008390 function| _getTimingInstance function| _docsTiming function| MicroscopeImageMetadata object| MicroscopeMaximizeMode object| MicroscopeBackgroundStyle function| MicroscopeState function| MicroscopeSize object| MicroscopeResizeMode object| MicroscopeZoomWidgetMode function| Microscope1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.google.com/ | Name: NID Value: 204=LwQMiD-fWIZRqKx8EXa-I9unqI7YcxrW2PqQLl87SsKjHht1sSszqguSfJNMvqVb03bTBLcPlCGeLUfflmuYvwUrLDkBOhQN-BfNkWpyJqB7msrC3cFxiniDhyEvsjnn2LEqHX-9OMtRNEvneXiwO5zaZiQ7hF_GzfX50lBAYM0 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | base-uri 'self';object-src 'none';report-uri /_/view/cspreport;script-src 'report-sample' 'nonce-3HrNcen5Z/mrSdfLyIeB+g' 'unsafe-inline' 'unsafe-eval';worker-src 'self';frame-ancestors https://data.corp.google.com https://dashboards.corp.google.com https://google-admin.corp.google.com/ |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
apis.google.com
fonts.googleapis.com
fonts.gstatic.com
lh5.googleusercontent.com
sites.google.com
www.gstatic.com
2a00:1450:4001:801::2003
2a00:1450:4001:806::2001
2a00:1450:4001:819::200a
2a00:1450:4001:81d::2003
2a00:1450:4001:81f::200e
2a00:1450:4001:825::200e
0fbf06498e91023c0655e16765cb29bc80b426062c1a84dbd6e24f508b3779ac
42d0e1b54374ac5f979d1efb30727680497c2ec12225c20786b1c2236331ed36
4a888b6fe37f9aaa089b0403b51f7f6ebfd788aaee1547e6724f1285140e68f9
56c0e58ba16ff5c2ff98ec98cba21990666e9b0028323d039d300d881cf86d68
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
62e6303735d15c81e6642f38fa00835fa3defba64ccc9e2642adad51964b43aa
6850ffa2b8e223c17b19e6ec7c3a23074e3b993e48f1975a484a9f479356332e
701651589e3a428f615860b23c9d06cb6deac96ffcffa93c0e8503ced65ed85e
70954ae9ad5f7f4645e09a9386c576a0ab560c142222c0f52d82e5106e35b715
7c1ab91003afa8c7566938f5bb3c378284c063ba6379a49df324a0c6440e5cbb
824184ff41638dee8a27ee8ec3ac403edcb8467b0a274ec439f6038edc892a71
96f1543830cda444b63a4846ced5072ed7be9af6411ddd91da14993cb6c468fe
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
e5656f14040d76caba248110c1241def123064d9bcd0e6a5d8ccdd320fb51f0b
e8447f52dd6f74f02d88950bfb41a648fba9d23f426981e3aec90188002106dc
f392bdc69b8ae4153c16fe26f422c8a58d38f6fa030de0deeeeba32e8b097003