urlscan.io logo urlscan.io
SecurityTrails logo

googleservice.live Open in urlscan Pro
51.83.209.70  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://googleservice.live/
Submission Tags: @phishunt_io
Submission: On November 23 via api from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 51.83.209.70, located in France and belongs to OVH, FR. The main domain is googleservice.live.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 22nd 2020. Valid for: 3 months.
This is the only time googleservice.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

Domain Requested by
4 ssl.gstatic.com googleservice.live
2 fonts.gstatic.com googleservice.live
1 mail.google.com
1 googleservice.live
8 4

This site contains links to these domains. Also see Links.

Domain
accounts.google.com
www.google.com
Subject Issuer Validity Valid
*.googleservice.live
Let's Encrypt Authority X3		 2020-11-22 -
2021-02-20		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
mail.google.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://googleservice.live/
Frame ID: D607AD74C336CEC33E49E0A3A17AF385
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

8
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

97 kB
Transfer

163 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
googleservice.live/ 		79 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleservice.live/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.83.209.70 , France, ASN16276 (OVH, FR),
Reverse DNS
server.hostimul.org
Software
LiteSpeed /
Resource Hash
92e3f3cb002e605ce6674cb67452f283206498161291d6fd8e1f3096d2e3d4a0

Request headers

:method
GET
:authority
googleservice.live
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

vary
Accept-Encoding
content-type
text/html; charset=UTF-8
content-encoding
gzip
date
Mon, 23 Nov 2020 01:22:19 GMT
server
LiteSpeed
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
avatar_2x.png
ssl.gstatic.com/accounts/ui/ 		626 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.gstatic.com/accounts/ui/avatar_2x.png
Requested by
Host: googleservice.live
URL: https://googleservice.live/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cdcc6d6dcda827a694dce8bfa9a1ab41113b629ef1cc11f886866af9194c81d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleservice.live/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 22 Nov 2020 16:46:24 GMT
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 10:15:00 GMT
server
sffe
age
30955
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
626
x-xss-protection
0
expires
Mon, 22 Nov 2021 16:46:24 GMT
universal_language_settings-21.png
ssl.gstatic.com/images/icons/ui/common/ 		199 B
288 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.gstatic.com/images/icons/ui/common/universal_language_settings-21.png
Requested by
Host: googleservice.live
URL: https://googleservice.live/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleservice.live/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 18 Nov 2020 17:38:17 GMT
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 10:15:00 GMT
server
sffe
age
373442
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
199
x-xss-protection
0
expires
Thu, 18 Nov 2021 17:38:17 GMT
googlelogo_color_112x36dp.png
ssl.gstatic.com/images/branding/googlelogo/1x/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_112x36dp.png
Requested by
Host: googleservice.live
URL: https://googleservice.live/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9ecd5e18216a965021f794cc1fd255767f8437ce1dd6c6c2ff4ceea7ccc0073d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleservice.live/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 21 Nov 2020 10:08:40 GMT
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
141219
vary
Origin
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2449
x-xss-protection
0
expires
Sun, 21 Nov 2021 10:08:40 GMT
wlogostrip_230x17_1x.png
ssl.gstatic.com/accounts/ui/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.gstatic.com/accounts/ui/wlogostrip_230x17_1x.png
Requested by
Host: googleservice.live
URL: https://googleservice.live/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05cdc120325f04f53e3ec7dbba877500d94db5a47e38fb6a2cc96fa3d1d7664c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleservice.live/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 22 Nov 2020 04:54:11 GMT
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 10:15:00 GMT
server
sffe
age
73688
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4285
x-xss-protection
0
expires
Mon, 22 Nov 2021 04:54:11 GMT
mem5YaGs126MiZpBA-UN_r8OXOhs.ttf
fonts.gstatic.com/s/opensans/v15/ 		39 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UN_r8OXOhs.ttf
Requested by
Host: googleservice.live
URL: https://googleservice.live/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b5f97120805971ceb303f56728f4b940e88a0b0ca8a6185b9561613faa510acb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleservice.live
Referer
https://googleservice.live/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 22 Nov 2020 14:42:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
38418
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24872
x-xss-protection
0
last-modified
Wed, 11 Oct 2017 21:49:34 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 22 Nov 2021 14:42:01 GMT
mem8YaGs126MiZpBA-UFW50e.ttf
fonts.gstatic.com/s/opensans/v15/ 		38 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFW50e.ttf
Requested by
Host: googleservice.live
URL: https://googleservice.live/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0c4595868d57ebb5f2793e22e8493bfe2606cd8c628a039d2d1a4fa79f642b05
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleservice.live
Referer
https://googleservice.live/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 22 Nov 2020 17:02:08 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:47 GMT
server
sffe
age
30011
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38424
x-xss-protection
0
expires
Mon, 22 Nov 2021 17:02:08 GMT
cleardot.gif
mail.google.com/mail/images/ 		43 B
414 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mail.google.com/mail/images/cleardot.gif?t=1606094539914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2005 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-OHdRHx/hcLqKbdlua8WdAw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://mail.google.com/mail/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://googleservice.live/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
script-src 'report-sample' 'nonce-OHdRHx/hcLqKbdlua8WdAw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://mail.google.com/mail/cspreport
x-content-type-options
nosniff
server
GSE
date
Mon, 23 Nov 2020 01:22:19 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif; charset=UTF-8
cache-control
public, max-age=31536000
alt-svc
clear
x-xss-protection
1; mode=block
expires
Tue, 23 Nov 2021 01:22:19 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| gaia_attachEvent object| botguard object| closure_lm_92974 function| gaia_parseFragment function| gaia_prefillEmail object| gaia object| hashParams function| gaia_scrollToElement object| BrowserSupport_ boolean| is_browser_supported number| start_time function| SetGmailCookie function| lg function| StripParam number| fixed function| FixForm function| el string| ONE_PX function| LogRoundtripTime function| GetRoundtripTimeFunction function| MaybePingUser object| passwd_elem function| OnLoad string| google_conversion_type number| google_conversion_id string| google_conversion_language string| google_conversion_format string| google_conversion_color function| LoadConversionScript undefined| form function| gaia_onLoginSubmit

0 Cookies