![](/screenshots/78728705-8228-4e5e-be36-9141666e36af.png)
accounts.jayshri.co
Open in
urlscan Pro
188.114.96.3
Malicious Activity!
Public Scan
Effective URL: https://accounts.jayshri.co/v3/signin/identifier?flowEntry=ServiceLogin&flowName=GlifWebSignIn&hl=en&ifkv=ARZ0qKJD2UZIURKEpR...
Submission: On March 27 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on March 11th 2024. Valid for: 3 months.
This is the only time accounts.jayshri.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 3.208.50.197 3.208.50.197 | 14618 (AMAZON-AES) (AMAZON-AES) | |
4 5 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2a00:1450:400... 2a00:1450:4001:80f::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::2003 | 15169 (GOOGLE) (GOOGLE) | |
9 | 142.250.184.227 142.250.184.227 | () () | |
19 | 6 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-208-50-197.compute-1.amazonaws.com
dramatic-polite-smartphone.glitch.me |
ASN13335 (CLOUDFLARENET, US)
gma-il-dwqf-asd-sad-1.jayshri.co | |
accounts.jayshri.co |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
408 KB |
5 |
jayshri.co
4 redirects
gma-il-dwqf-asd-sad-1.jayshri.co accounts.jayshri.co |
109 KB |
2 |
glitch.me
dramatic-polite-smartphone.glitch.me |
4 KB |
19 | 3 |
Domain | Requested by | |
---|---|---|
12 | www.gstatic.com |
accounts.jayshri.co
www.gstatic.com |
4 | accounts.jayshri.co |
3 redirects
www.gstatic.com
dramatic-polite-smartphone.glitch.me |
2 | dramatic-polite-smartphone.glitch.me | |
1 | fonts.gstatic.com |
accounts.jayshri.co
|
1 | gma-il-dwqf-asd-sad-1.jayshri.co | 1 redirects |
19 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
support.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
glitch.com Amazon RSA 2048 M03 |
2023-12-04 - 2025-01-01 |
a year | crt.sh |
jayshri.co GTS CA 1P5 |
2024-03-11 - 2024-06-09 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://accounts.jayshri.co/v3/signin/identifier?flowEntry=ServiceLogin&flowName=GlifWebSignIn&hl=en&ifkv=ARZ0qKJD2UZIURKEpR7rJ4jhetrdjaGivbEl9wshBavCBMWscmebXxpzB7kM64tO58ftFPHzDboTzw&dsh=S772467929%3A1711559625931605&theme=mn&ddm=0
Frame ID: FC187E2E79DF86032C2F629AC6BCC601
Requests: 18 HTTP requests in this frame
Frame:
https://accounts.jayshri.co/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.jayshri.co&v=108792925×tamp=1711559627666
Frame ID: F225A08A21E80EFEF2874B43D882B044
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.jayshri.co/_/bscframe
Frame ID: C1569F22DD352F007B94E6C0C3C0E800
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/78728705-8228-4e5e-be36-9141666e36af.png)
Page Title
Sign in - Google AccountsPage URL History Show full URLs
- https://dramatic-polite-smartphone.glitch.me/1.html Page URL
-
https://gma-il-dwqf-asd-sad-1.jayshri.co/XVpQjbTB
HTTP 302
https://accounts.jayshri.co/signin/v2/identifier?hl=en&flowName=GlifWebSignIn&flowEntry=ServiceLogin HTTP 302
https://accounts.jayshri.co/ServiceLogin?flowEntry=ServiceLogin&flowName=GlifWebSignIn&hl=en HTTP 302
https://accounts.jayshri.co/InteractiveLogin?flowEntry=ServiceLogin&flowName=GlifWebSignIn&hl=en&ifkv=AR... HTTP 302
https://accounts.jayshri.co/v3/signin/identifier?flowEntry=ServiceLogin&flowName=GlifWebSignIn&hl=en&ifk... Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Learn more about using Guest mode
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://dramatic-polite-smartphone.glitch.me/1.html Page URL
-
https://gma-il-dwqf-asd-sad-1.jayshri.co/XVpQjbTB
HTTP 302
https://accounts.jayshri.co/signin/v2/identifier?hl=en&flowName=GlifWebSignIn&flowEntry=ServiceLogin HTTP 302
https://accounts.jayshri.co/ServiceLogin?flowEntry=ServiceLogin&flowName=GlifWebSignIn&hl=en HTTP 302
https://accounts.jayshri.co/InteractiveLogin?flowEntry=ServiceLogin&flowName=GlifWebSignIn&hl=en&ifkv=ARZ0qKJ3fZLLVfrtNEeidUBktm5e0ECLMX1VEGPPP4vxOQxGvYtANkj7HddCa79y94ug4WJWMFZxvQ HTTP 302
https://accounts.jayshri.co/v3/signin/identifier?flowEntry=ServiceLogin&flowName=GlifWebSignIn&hl=en&ifkv=ARZ0qKJD2UZIURKEpR7rJ4jhetrdjaGivbEl9wshBavCBMWscmebXxpzB7kM64tO58ftFPHzDboTzw&dsh=S772467929%3A1711559625931605&theme=mn&ddm=0 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
1.html
dramatic-polite-smartphone.glitch.me/ |
167 B 553 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
identifier
accounts.jayshri.co/v3/signin/ Redirect Chain
|
626 KB 106 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
dramatic-polite-smartphone.glitch.me/ |
4 KB 4 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=_b,_tp
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlF... |
214 KB 74 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
267 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
fonts.gstatic.com/s/googlesans/v58/ |
51 KB 52 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=byfTOb,lsjVmc,LEikZe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/ck=boq-identity.AccountsSignInUi.7ZqdJfzmn-s.L.B1.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/exm=_b... |
38 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,zu7j8,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inN...
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/ck=boq-identity.AccountsSignInUi.7ZqdJfzmn-s.L.B1.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/exm=LE... |
745 KB 221 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/ck=boq-identity.AccountsSignInUi.7ZqdJfzmn-s.L.B1.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/exm=Av... |
111 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=RqjULd
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/ck=boq-identity.AccountsSignInUi.7ZqdJfzmn-s.L.B1.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/exm=Av... |
19 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=ZwDk9d,RMhBfe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/ck=boq-identity.AccountsSignInUi.7ZqdJfzmn-s.L.B1.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/exm=Av... |
3 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=bm51tf
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/ck=boq-identity.AccountsSignInUi.7ZqdJfzmn-s.L.B1.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/exm=Av... |
1 KB 807 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=w9hDv,VwDzFe,A7fCU
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/ck=boq-identity.AccountsSignInUi.7ZqdJfzmn-s.L.B1.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/exm=Av... |
2 KB 763 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=NTMZac,sOXFj,q0xTif,ZZ4WUe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/ck=boq-identity.AccountsSignInUi.7ZqdJfzmn-s.L.B1.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/exm=A7... |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=iAskyc,ziXSP
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/ck=boq-identity.AccountsSignInUi.7ZqdJfzmn-s.L.B1.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/exm=A7... |
2 KB 791 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
36px.svg
www.gstatic.com/images/branding/productlogos/googleg/v6/ |
749 B 433 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=iCBEqb,nKuFpb
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PDgoK7k5-vo.es5.O/ck=boq-identity.AccountsSignInUi.7ZqdJfzmn-s.L.B1.O/am=P8AiOhwLgBhxHvgARYGQAQAAAAAAAAAAawCbAQ/d=1/exm=A7... |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
CheckConnection
accounts.jayshri.co/accounts/ Frame F225 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
batchexecute
accounts.jayshri.co/v3/signin/_/AccountsSignInUi/data/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
bscframe
accounts.jayshri.co/_/ Frame C156 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- accounts.jayshri.co
- URL
- https://accounts.jayshri.co/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.jayshri.co&v=108792925×tamp=1711559627666
- Domain
- accounts.jayshri.co
- URL
- https://accounts.jayshri.co/v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=7573305600355578086&bl=boq_identityfrontendauthuiserver_20240310.08_p1&hl=en&_reqid=65628&rt=c
- Domain
- accounts.jayshri.co
- URL
- https://accounts.jayshri.co/_/bscframe
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)29 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onpagereveal object| WIZ_global_data number| cc_latency_start_time function| onaft function| _isLazyImage string| cc_aid number| iml_start number| css_size object| cc_latency function| ccTick function| onJsLoad function| onCssLoad function| _isVisible function| _recordImlEl number| prt function| wiz_tick string| _F_cssRowKey string| _F_combinedSignature function| _DumpException object| BOQ_wizbind function| _wjdc object| AF_initDataKeys object| AF_dataServiceRequests object| AF_initDataChunkQueue function| AF_initDataCallback undefined| AF_initDataInitializeCallback object| IJ_values object| aft_counter function| initAft2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.jayshri.co/ | Name: seds Value: 546700b09379c510dd5a7694570e0b3b350ffe027964d1758474e137c0a6a085 |
|
accounts.jayshri.co/ | Name: __Host-GAPS Value: 1:-5farYjiBjBdYeRO5GEFwdGzf5p1rg:-tM80Sa4DH4ec9mw |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.jayshri.co
dramatic-polite-smartphone.glitch.me
fonts.gstatic.com
gma-il-dwqf-asd-sad-1.jayshri.co
www.gstatic.com
accounts.jayshri.co
142.250.184.227
188.114.96.3
2a00:1450:4001:80f::2003
2a00:1450:4001:813::2003
3.208.50.197
06bf0be4135f861869578ff79b192b44edcfe764ad71d27f53560b7b0040a9b2
12bc87afc8abc1ecd596c5f9fd9ef3f075fb0b942e72d95dd5241bc05b770294
1e7f9de895ac7b56934148acbf49071f85989566a006037a044bdb69026046eb
4c7757602409dfd84c77f54941edb8478dfea663b3221a945ccd466dc6c4940d
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc
767ab36e1369b249d3164da03c4e96da2e52896c5c76aef99a6a8761bddf6cd2
8a594b69a665e6b8f18ca7552a26a4d3966f960af6d38ebdef487ea149eb46e1
90e1b7312d430638c419f7b3a88df48c10c95f5915dd15f09e53fcc89c1e3993
9f3a9f140e8df1b2810af7f05608837a51cc4138586f57bf78ad3bf676054c4c
a4380ab92721961c74200e4239809a35f7b6d1a39c3951ccfc4b430479203091
a6ae95cbe364be4c6bfe29f7b1a027204d4dc37a372d13f7f1254a7bfff55ece
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
b0f1f868784f488de5c031ffecadb6060639dc3666ec1e90953f9aa97e28b7df
c411c0df58f64f55ee5246b91b8c50f90e8efab7287f524f213a40c168a14377
e5773339e56dd15d8daab94ce6ed5d444d1ef0b61355e20854234605bb2e755b