accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net Open in urlscan Pro
35.182.118.111 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.sky...
Effective URL:
https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo...
Submission: On September 23 via api (September 23rd 2023, 11:58:54 pm UTC) from US — Scanned from US

Summary HTTP 7 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 35.182.118.111, located in Montreal, Canada and belongs to AMAZON-02, US. The main domain is accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net.
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on September 20th 2023. Valid for: a year.

This is the only time accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 4	35.182.118.111 35.182.118.111	16509 (AMAZON-02) (AMAZON-02)
3	35.183.55.117 35.183.55.117	16509 (AMAZON-02) (AMAZON-02)
7	3

4 35.182.118.111 (Montreal, Canada) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-182-118-111.ca-central-1.compute.amazonaws.com

accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.183.55.117 (Montreal, Canada)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-183-55-117.ca-central-1.compute.amazonaws.com

www.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	myshn.net 2 redirects accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net www.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net Failed	145 KB
7	1

	Domain	Requested by
4	accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net	2 redirects accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net
2	fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net	accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net
1	www.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net	accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net
7	3

This site contains links to these domains. Also see Links.

Domain
support.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net

Subject Issuer	Validity	Valid
gsuite.demo74-google.skyhighdemo74.myshn.net GlobalSign RSA OV SSL CA 2018	`2023-09-20` - `2024-10-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&followup=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&ifkv=AYZoVhe_ibr8cTqTOYIgWeDAE_ga-uM8YhitNwhN-CGRv_OFk-seQ7QswRDYnuFBPPnab6sfc4bTxg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S890111254%3A1695513529336371&theme=glif
Frame ID: E55A40DC083DA4BEB6ECBF18D222A904
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in - Google Accounts

Page URL History Show full URLs

https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com.gsui... HTTP 302
https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/InteractiveLogin?continue=https://accounts.google.com.gsuite.demo74-google.s... HTTP 302
https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo7... Page URL

Page Statistics

7
Requests

71 %
HTTPS

0 %
IPv6

1
Domains

3
Subdomains

3
IPs

1
Countries

142 kB
Transfer

624 kB
Size

4
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://support.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/chrome/answer/6130773?hl=en-US
Title: Learn more

Search URL Search Domain Scan URL

URL: https://support.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/accounts?hl=en-US&p=account_iph
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&followup=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F HTTP 302
https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/InteractiveLogin?continue=https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/&followup=https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/&passive=1209600&ifkv=AYZoVhcOHESNSYRhL4wZI4xAurJ75CkpLJlsDrkF_a5YM49tfUcr9mF6tWjuOQwwM-xxeHyWGS54 HTTP 302
https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&followup=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&ifkv=AYZoVhe_ibr8cTqTOYIgWeDAE_ga-uM8YhitNwhN-CGRv_OFk-seQ7QswRDYnuFBPPnab6sfc4bTxg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S890111254%3A1695513529336371&theme=glif Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request identifier Show response
accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/
Redirect Chain

https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&foll...
https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/InteractiveLogin?continue=https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/&followup=https://account...
https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&followup=htt...

588 KB
102 KB

378ms
377ms

Document
text/html

35.182.118.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&followup=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&ifkv=AYZoVhe_ibr8cTqTOYIgWeDAE_ga-uM8YhitNwhN-CGRv_OFk-seQ7QswRDYnuFBPPnab6sfc4bTxg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S890111254%3A1695513529336371&theme=glif

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.182.118.111 Montreal, Canada, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-182-118-111.ca-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

409e64a73a9a9cddd35f464abd689b9aa316e5954f70c43cb4e1750005404552

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Zewig3W5G_gxM2PQfFsvwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 102457
Content-Security-Policy: script-src 'report-sample' 'nonce-Zewig3W5G_gxM2PQfFsvwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'
Content-Type: text/html; charset=utf-8
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"
Cross-Origin-Resource-Policy: same-site
Date: Sat, 23 Sep 2023 23:58:49 GMT
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
Pragma: no-cache
Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Robots-Tag: none
X-SkyHigh-Version: BuildNumber=18, BuildDate=2022-03-15 05:46
X-XSS-Protection: 0
x-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/
x-ua-compatible: IE=edge

Redirect headers

Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 414
Content-Security-Policy: script-src 'report-sample' 'nonce-pr0Qf4Wsmh2oPipgC22DRQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
Content-Type: text/html; charset=UTF-8
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"
Date: Sat, 23 Sep 2023 23:58:49 GMT
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Location: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&followup=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&ifkv=AYZoVhe_ibr8cTqTOYIgWeDAE_ga-uM8YhitNwhN-CGRv_OFk-seQ7QswRDYnuFBPPnab6sfc4bTxg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S890111254%3A1695513529336371&theme=glif
Pragma: no-cache
Report-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Robots-Tag: none
X-SkyHigh-Version: BuildNumber=18, BuildDate=2022-03-15 05:46
X-XSS-Protection: 1; mode=block

POST
H/1.1 204
No Content cspreport
accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/_/AccountsSignInUi/ 0
2 KB 250ms
131ms Other
text/html 35.182.118.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/_/AccountsSignInUi/cspreport

Requested by

Host: accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net
URL: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&followup=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&ifkv=AYZoVhe_ibr8cTqTOYIgWeDAE_ga-uM8YhitNwhN-CGRv_OFk-seQ7QswRDYnuFBPPnab6sfc4bTxg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S890111254%3A1695513529336371&theme=glif

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.182.118.111 Montreal, Canada, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-182-118-111.ca-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3hRgxVr175G-oSNjG34Ejg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: application/csp-report

Response headers

Date: Sat, 23 Sep 2023 23:58:50 GMT
Content-Security-Policy: script-src 'report-sample' 'nonce-3hRgxVr175G-oSNjG34Ejg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
Server: nginx
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
X-SkyHigh-Version: BuildNumber=18, BuildDate=2022-03-15 05:46
X-Robots-Tag: none
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 502
Bad Gateway m=_b,_tp
www.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.XCHOJI6Wf1s.es5.O/am=DgARM48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/excm=_b,_tp,... 0
0 335ms
102ms Script
text/plain 35.183.55.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.XCHOJI6Wf1s.es5.O/am=DgARM48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlH5nDdRoNjK5bQM48u9OBVQcAY9hQ/m=_b,_tp
Requested by: Host: accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net
URL: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&followup=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&ifkv=AYZoVhe_ibr8cTqTOYIgWeDAE_ga-uM8YhitNwhN-CGRv_OFk-seQ7QswRDYnuFBPPnab6sfc4bTxg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S890111254%3A1695513529336371&theme=glif
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.183.55.117 Montreal, Canada, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-183-55-117.ca-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sat, 23 Sep 2023 23:58:50 GMT
Server: nginx
Connection: keep-alive
X-SkyHigh-Version: BuildNumber=18, BuildDate=2022-03-15 05:46
X-Robots-Tag: none
Content-Length: 40

GET
DATA 200
OK truncated
/ 267 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/googlesans/v14/ 0
0

GET KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/roboto/v18/ 0
0

GET
H/1.1 200
OK KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/roboto/v18/ 15 KB
16 KB 429ms
208ms Font
font/woff2 35.183.55.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.183.55.117 Montreal, Canada, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-183-55-117.ca-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/
Origin: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sat, 23 Sep 2023 23:58:50 GMT
X-Content-Type-Options: nosniff
Age: 27695
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Length: 15552
X-XSS-Protection: 0
Last-Modified: Mon, 16 Oct 2017 17:33:02 GMT
Server: nginx
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
X-SkyHigh-Version: BuildNumber=18, BuildDate=2022-03-15 05:46
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Robots-Tag: none
Expires: Sun, 22 Sep 2024 16:17:15 GMT

GET
H/1.1 200
OK 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/googlesans/v14/ 21 KB
22 KB 437ms
215ms Font
font/woff2 35.183.55.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.183.55.117 Montreal, Canada, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-183-55-117.ca-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/
Origin: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sat, 23 Sep 2023 23:58:50 GMT
X-Content-Type-Options: nosniff
Age: 26674
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Length: 21700
X-XSS-Protection: 0
Last-Modified: Mon, 22 Apr 2019 23:43:33 GMT
Server: nginx
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
X-SkyHigh-Version: BuildNumber=18, BuildDate=2022-03-15 05:46
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Robots-Tag: none
Expires: Sun, 22 Sep 2024 16:34:16 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net
URL: https://fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Domain: fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net
URL: https://fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/	1970-01-21 00:34:33	Name: __Host-GAPS Value: 1:4PLC7dddyC07Lngnw8BPmWKLfC32tA:g7UL9EUcmc-mKN9w
accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/	1969-12-31 23:59:59	Name: Priority Value: HIGH
.gsuite.demo74-google.skyhighdemo74.myshn.net/	1969-12-31 23:59:59	Name: SHN-VH-session Value: a7a5b61d-e4ba-472c-ad11-5bbeacd94d74\|1695515329297
.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/	1970-01-20 19:22:04	Name: NID Value: 511=G-ko7Wnmt4FbkywTkgtlD2_PGzY8ugrssKXt9Mn5j8TiT7aMmmoiH8Iz4kU1UM-BY1-AnSLw1EQE2YxRgoREazEV0Q9v1h8pDfqwyUhg8izZ--iQcwLZWg5nJ5OAbO2IvCgM_7-1T92WurLWO0MXUOgmLmQsgNOa6cnIVexZDck

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.XCHOJI6Wf1s.es5.O/am=DgARM48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlH5nDdRoNjK5bQM48u9OBVQcAY9hQ/m=_b,_tp Message: Failed to load resource: the server responded with a status of 502 (Bad Gateway)
javascript	error	URL: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&followup=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&ifkv=AYZoVhe_ibr8cTqTOYIgWeDAE_ga-uM8YhitNwhN-CGRv_OFk-seQ7QswRDYnuFBPPnab6sfc4bTxg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S890111254%3A1695513529336371&theme=glif Message: Access to font at 'https://fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2' from origin 'https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&followup=https%3A%2F%2Faccounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net%2F&ifkv=AYZoVhe_ibr8cTqTOYIgWeDAE_ga-uM8YhitNwhN-CGRv_OFk-seQ7QswRDYnuFBPPnab6sfc4bTxg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S890111254%3A1695513529336371&theme=glif Message: Access to font at 'https://fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2' from origin 'https://accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Zewig3W5G_gxM2PQfFsvwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net
fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net
www.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net
fonts.gstatic.com.gsuite.demo74-google.skyhighdemo74.myshn.net
35.182.118.111
35.183.55.117
409e64a73a9a9cddd35f464abd689b9aa316e5954f70c43cb4e1750005404552
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net Open in urlscan Pro 35.182.118.111 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

71 %HTTPS

0 %IPv6

1 Domains

3 Subdomains

3 IPs

1 Countries

142 kBTransfer

624 kBSize

4 Cookies

2 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

29 JavaScript Global Variables

4 Cookies

5 Console Messages

Security Headers

Indicators

accounts.google.com.gsuite.demo74-google.skyhighdemo74.myshn.net Open in urlscan Pro
35.182.118.111 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

71 %
HTTPS

0 %
IPv6

1
Domains

3
Subdomains

3
IPs

1
Countries

142 kB
Transfer

624 kB
Size

4
Cookies

7 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!