googleservice.live
Open in
urlscan Pro
51.83.209.70
Malicious Activity!
Public Scan
Submission: On November 22 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by googleservice.live on November 22nd 2020. Valid for: a year.
This is the only time googleservice.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 51.83.209.70 51.83.209.70 | 16276 (OVH) (OVH) | |
4 | 2a00:1450:400... 2a00:1450:4001:815::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:814::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2005 | 15169 (GOOGLE) (GOOGLE) | |
8 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
gstatic.com
ssl.gstatic.com fonts.gstatic.com |
56 KB |
1 |
google.com
mail.google.com |
414 B |
1 |
googleservice.live
googleservice.live |
26 KB |
8 | 3 |
Domain | Requested by | |
---|---|---|
4 | ssl.gstatic.com |
googleservice.live
|
2 | fonts.gstatic.com |
googleservice.live
|
1 | mail.google.com | |
1 | googleservice.live | |
8 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
accounts.google.com |
www.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
googleservice.live googleservice.live |
2020-11-22 - 2021-11-22 |
a year | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
mail.google.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://googleservice.live/
Frame ID: 3CDDB53BC603F298F50A610F54A5A9BA
Requests: 8 HTTP requests in this frame
7 Outgoing links
These are links going to different origins than the main page.
Title: Hesabımı bul
Search URL Search Domain Scan URL
Title: Farklı bir hesapla oturum aç
Search URL Search Domain Scan URL
Title: Hesap oluştur
Search URL Search Domain Scan URL
Title: Google Hakkında
Search URL Search Domain Scan URL
Title: Gizlilik
Search URL Search Domain Scan URL
Title: Şartlar
Search URL Search Domain Scan URL
Title: Yardım
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
googleservice.live/ |
79 KB 26 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
avatar_2x.png
ssl.gstatic.com/accounts/ui/ |
626 B 984 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
universal_language_settings-21.png
ssl.gstatic.com/images/icons/ui/common/ |
199 B 286 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
googlelogo_color_112x36dp.png
ssl.gstatic.com/images/branding/googlelogo/1x/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wlogostrip_230x17_1x.png
ssl.gstatic.com/accounts/ui/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UN_r8OXOhs.ttf
fonts.gstatic.com/s/opensans/v15/ |
39 KB 24 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFW50e.ttf
fonts.gstatic.com/s/opensans/v15/ |
38 KB 24 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cleardot.gif
mail.google.com/mail/images/ |
43 B 414 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)40 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| gaia_attachEvent object| botguard object| closure_lm_812543 function| gaia_parseFragment function| gaia_prefillEmail object| gaia object| hashParams function| gaia_scrollToElement object| BrowserSupport_ boolean| is_browser_supported number| start_time function| SetGmailCookie function| lg function| StripParam number| fixed function| FixForm function| el string| ONE_PX function| LogRoundtripTime function| GetRoundtripTimeFunction function| MaybePingUser object| passwd_elem function| OnLoad string| google_conversion_type number| google_conversion_id string| google_conversion_language string| google_conversion_format string| google_conversion_color function| LoadConversionScript undefined| form function| gaia_onLoginSubmit0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.gstatic.com
googleservice.live
mail.google.com
ssl.gstatic.com
2a00:1450:4001:808::2005
2a00:1450:4001:814::2003
2a00:1450:4001:815::2003
51.83.209.70
05cdc120325f04f53e3ec7dbba877500d94db5a47e38fb6a2cc96fa3d1d7664c
0c4595868d57ebb5f2793e22e8493bfe2606cd8c628a039d2d1a4fa79f642b05
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6
92e3f3cb002e605ce6674cb67452f283206498161291d6fd8e1f3096d2e3d4a0
9ecd5e18216a965021f794cc1fd255767f8437ce1dd6c6c2ff4ceea7ccc0073d
b5f97120805971ceb303f56728f4b940e88a0b0ca8a6185b9561613faa510acb
cdcc6d6dcda827a694dce8bfa9a1ab41113b629ef1cc11f886866af9194c81d0