urlscan.io logo urlscan.io
SecurityTrails logo

yguhj.igg.biz Open in urlscan Pro
217.61.21.141  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://yguhj.igg.biz/gmail/Login.htm
Submission: On May 27 via api from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 217.61.21.141, located in Arezzo, Italy and belongs to ARUBACLOUDLTD-ASN, GB. The main domain is yguhj.igg.biz.
This is the only time yguhj.igg.biz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

IP Address AS Autonomous System
1 217.61.21.141 199883 (ARUBACLOU...)
7 216.58.207.67 15169 (GOOGLE)
2 216.58.207.78 15169 (GOOGLE)
1 216.58.207.69 15169 (GOOGLE)
11 4
1    217.61.21.141 (Arezzo, Italy)

ASN199883 (ARUBACLOUDLTD-ASN, GB)
PTR: host141-21-61-217.static.arubacloud.com
yguhj.igg.biz
7    216.58.207.67 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f3.1e100.net
ssl.gstatic.com
2    216.58.207.78 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f14.1e100.net
accounts.youtube.com
www.google-analytics.com
1    216.58.207.69 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f5.1e100.net
mail.google.com
Domain Requested by
7 ssl.gstatic.com yguhj.igg.biz
1 mail.google.com
1 www.google-analytics.com yguhj.igg.biz
1 accounts.youtube.com yguhj.igg.biz
1 yguhj.igg.biz
11 5

This site contains links to these domains. Also see Links.

Domain
accounts.google.com
www.google.com
mail.google.com
Subject Issuer Validity Valid
*.google.com
Google Internet Authority G3		 2018-05-08 -
2018-07-31		 3 months crt.sh

This page contains 2 frames:

Primary Page: http://yguhj.igg.biz/gmail/Login.htm
Frame ID: 5831B2302E7C00F3145625DE79A5CC76
Requests: 10 HTTP requests in this frame

Frame: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-412827725&timestamp=1527380518120
Frame ID: 075A25D7CB0A93E83BB3A120EB21D1E6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

11
Requests

9 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

109 kB
Transfer

135 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8
  • http://www.google-analytics.com/ga.js HTTP 307
  • https://www.google-analytics.com/ga.js

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Login.htm
yguhj.igg.biz/gmail/ 		81 KB
82 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://yguhj.igg.biz/gmail/Login.htm
Protocol
HTTP/1.1
Server
217.61.21.141 Arezzo, Italy, ASN199883 (ARUBACLOUDLTD-ASN, GB),
Reverse DNS
host141-21-61-217.static.arubacloud.com
Software
Apache /
Resource Hash
0ab958b890b00c90e4ffa67e6174578225c66f9d9b029bb4ac5bb416c69a4ee1

Request headers

Host
yguhj.igg.biz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
5831B2302E7C00F3145625DE79A5CC76

Response headers

Date
Sun, 27 May 2018 00:21:57 GMT
Server
Apache
Last-Modified
Thu, 02 Apr 2015 07:00:40 GMT
Accept-Ranges
bytes
Content-Length
83398
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
google_logo_41.png
ssl.gstatic.com/images/logos/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ssl.gstatic.com/images/logos/google_logo_41.png
Requested by
Host: yguhj.igg.biz
URL: http://yguhj.igg.biz/gmail/Login.htm
Protocol
HTTP/1.1
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
a9cef4d58336842dc12848055c5e8d17a02b2fef3eec87e5ad171dc699d49d23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://yguhj.igg.biz/gmail/Login.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 25 May 2018 15:10:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 30 Mar 2017 18:45:00 GMT
Server
sffe
Age
119485
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Length
2408
X-XSS-Protection
1; mode=block
Expires
Sat, 25 May 2019 15:10:33 GMT
google-signin-flat.png
ssl.gstatic.com/accounts/ui/ 		531 B
876 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ssl.gstatic.com/accounts/ui/google-signin-flat.png
Requested by
Host: yguhj.igg.biz
URL: http://yguhj.igg.biz/gmail/Login.htm
Protocol
HTTP/1.1
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
59022682c32e4db4e05c3d0b01bad9bb2d935dd5455356c70017e882fdbc139f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://yguhj.igg.biz/gmail/Login.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 12 Apr 2018 12:42:29 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 21 Apr 2016 03:17:22 GMT
Server
sffe
Age
3843569
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Length
531
X-XSS-Protection
1; mode=block
Expires
Fri, 12 Apr 2019 12:42:29 GMT
filing_cabinet-g42.png
ssl.gstatic.com/images/icons/feature/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ssl.gstatic.com/images/icons/feature/filing_cabinet-g42.png
Requested by
Host: yguhj.igg.biz
URL: http://yguhj.igg.biz/gmail/Login.htm
Protocol
HTTP/1.1
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
d5e6375ce8f96f9ca4243b005142c525c5755140c30b082c8faba85e58ad7388
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://yguhj.igg.biz/gmail/Login.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Sun, 27 May 2018 00:21:58 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 21 Apr 2016 03:17:22 GMT
Server
sffe
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Length
1447
X-XSS-Protection
1; mode=block
Expires
Mon, 27 May 2019 00:21:58 GMT
nosign-r42.png
ssl.gstatic.com/images/icons/feature/ 		795 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ssl.gstatic.com/images/icons/feature/nosign-r42.png
Requested by
Host: yguhj.igg.biz
URL: http://yguhj.igg.biz/gmail/Login.htm
Protocol
HTTP/1.1
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
a32f0e99d5833416b25c92c81991b5bd56c998f6c71c254c4b19a198e80f260a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://yguhj.igg.biz/gmail/Login.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Sun, 27 May 2018 00:21:58 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 21 Apr 2016 03:17:22 GMT
Server
sffe
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Length
795
X-XSS-Protection
1; mode=block
Expires
Mon, 27 May 2019 00:21:58 GMT
mobile_phone-42.gif
ssl.gstatic.com/images/icons/feature/ 		859 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ssl.gstatic.com/images/icons/feature/mobile_phone-42.gif
Requested by
Host: yguhj.igg.biz
URL: http://yguhj.igg.biz/gmail/Login.htm
Protocol
HTTP/1.1
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
6f3f99760c210cdd9a6df7ccc3e1fdd91ed1bd615ec3db6ace198e12ffd83352
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://yguhj.igg.biz/gmail/Login.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Sun, 27 May 2018 00:21:58 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 21 Apr 2016 03:17:22 GMT
Server
sffe
Content-Type
image/gif
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Length
859
X-XSS-Protection
1; mode=block
Expires
Mon, 27 May 2019 00:21:58 GMT
apps-42.png
ssl.gstatic.com/images/icons/product/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ssl.gstatic.com/images/icons/product/apps-42.png
Requested by
Host: yguhj.igg.biz
URL: http://yguhj.igg.biz/gmail/Login.htm
Protocol
HTTP/1.1
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
554561e9a1d94bc562fae38003c0b1d26a97a86c60a0913d1099711037525124
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://yguhj.igg.biz/gmail/Login.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Sun, 27 May 2018 00:21:58 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 21 Apr 2016 03:17:22 GMT
Server
sffe
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Length
1875
X-XSS-Protection
1; mode=block
Expires
Mon, 27 May 2019 00:21:58 GMT
universal_language_settings-21.png
ssl.gstatic.com/images/icons/ui/common/ 		199 B
543 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ssl.gstatic.com/images/icons/ui/common/universal_language_settings-21.png
Requested by
Host: yguhj.igg.biz
URL: http://yguhj.igg.biz/gmail/Login.htm
Protocol
HTTP/1.1
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://yguhj.igg.biz/gmail/Login.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 24 May 2018 14:20:06 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 21 Apr 2016 03:17:22 GMT
Server
sffe
Age
208912
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Length
199
X-XSS-Protection
1; mode=block
Expires
Fri, 24 May 2019 14:20:06 GMT
CheckConnection
accounts.youtube.com/accounts/ Frame 075A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-412827725&timestamp=1527380518120
Requested by
Host: yguhj.igg.biz
URL: http://yguhj.igg.biz/gmail/Login.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.207.78 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f14.1e100.net
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-JCF+EP/gQjDml3tuIQi7GE6zz+M' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
accounts.youtube.com
:scheme
https
:path
/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-412827725&timestamp=1527380518120
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
http://yguhj.igg.biz/gmail/Login.htm
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
5831B2302E7C00F3145625DE79A5CC76
Referer
http://yguhj.igg.biz/gmail/Login.htm

Response headers

status
200
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-JCF+EP/gQjDml3tuIQi7GE6zz+M' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cache-control
no-cache, no-store
pragma
no-cache
expires
Mon, 01-Jan-1990 00:00:00 GMT
content-encoding
gzip
date
Sun, 27 May 2018 00:21:58 GMT
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1355
server
GSE
alt-svc
hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
ga.js
www.google-analytics.com/
Redirect Chain
  • http://www.google-analytics.com/ga.js
  • https://www.google-analytics.com/ga.js
45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/ga.js
Requested by
Host: yguhj.igg.biz
URL: http://yguhj.igg.biz/gmail/Login.htm
Protocol
SPDY
Server
216.58.207.78 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://yguhj.igg.biz/gmail/Login.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 18 May 2018 01:10:24 GMT
server
Golfe2
age
256
date
Sun, 27 May 2018 00:17:42 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
17168
expires
Sun, 27 May 2018 02:17:42 GMT

Redirect headers

Location
https://www.google-analytics.com/ga.js
Non-Authoritative-Reason
HSTS
c.gif
mail.google.com/mail/images/ 		0
371 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mail.google.com/mail/images/c.gif?t=1527380518122
Protocol
SPDY
Server
216.58.207.69 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f5.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://yguhj.igg.biz/gmail/Login.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-type
text/html; charset=UTF-8
expires
Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

73 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| botguard boolean| gaia_hasInnerTextProperty function| gaia_attachEvent function| gaia_getElementsByClass function| gaia_parseFragment function| gaia_prefillEmail function| gaia_setFocus function| gaia_onLoginSubmit boolean| Ga object| G boolean| Gb object| Gc function| Ge function| Gd object| Gf function| Gg function| Gh function| Gi function| Gj function| Gk function| Gm function| Gl object| Gn object| Go function| Gp function| Gq object| Gr string| Gs object| Gt object| Gu object| Gv function| Gw function| Gx function| Gy function| Gz object| hashParams function| G_checkConnectionMain function| G_setPostMessageSupportFlag object| __CHECK_CONNECTION_CONFIG object| langChooser object| langChooserWrap string| langChooserParam string| langChooserUrl function| gaia_appendParam function| gaia_swapHiResLogo object| _gaq object| BrowserSupport_ boolean| is_browser_supported number| start_time function| SetGmailCookie function| lg function| gaiacb_onLoginSubmit function| StripParam number| fixed function| FixForm function| el object| CP object| quota_elem string| ONE_PX function| LogRoundtripTime function| GetRoundtripTimeFunction function| MaybePingUser function| OnLoad function| updateQuota string| PAD function| format string| google_conversion_type number| google_conversion_id string| google_conversion_language string| google_conversion_format string| google_conversion_color function| LoadConversionScript object| _gat

1 Cookies

Domain/Path Name / Value
accounts.youtube.com/accounts Name: CheckConnectionTempCookie180
Value: 752971