![](/screenshots/95a594c6-6eb5-4420-a3ac-81f8631d8ad7.png)
www.api.account.google.fajarcode.com
Open in
urlscan Pro
2001:df7:5300:2::69
Malicious Activity!
Public Scan
Submission: On September 13 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 13th 2022. Valid for: 3 months.
This is the only time www.api.account.google.fajarcode.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2001:df7:5300... 2001:df7:5300:2::69 | 138115 (IDNIC-DEN...) (IDNIC-DENEVA-AS-ID PT Deneva) | |
7 | 2a00:1450:400... 2a00:1450:4001:801::2003 | 15169 (GOOGLE) (GOOGLE) | |
4 | 2a00:1450:400... 2a00:1450:4001:80e::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:810::200e | 15169 (GOOGLE) (GOOGLE) | |
5 | 2a00:1450:400... 2a00:1450:4001:80f::200d | 15169 (GOOGLE) (GOOGLE) | |
6 | 2a00:1450:400... 2a00:1450:4001:813::200e | 15169 (GOOGLE) (GOOGLE) | |
33 | 7 |
ASN138115 (IDNIC-DENEVA-AS-ID PT Deneva, ID)
www.api.account.google.fajarcode.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
google.com
accounts.google.com — Cisco Umbrella Rank: 126 play.google.com — Cisco Umbrella Rank: 76 Failed |
2 KB |
11 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
348 KB |
2 |
youtube.com
accounts.youtube.com — Cisco Umbrella Rank: 2137 |
|
1 |
fajarcode.com
www.api.account.google.fajarcode.com |
85 KB |
33 | 4 |
Domain | Requested by | |
---|---|---|
7 | www.gstatic.com |
www.api.account.google.fajarcode.com
www.gstatic.com |
6 | play.google.com |
www.gstatic.com
|
5 | accounts.google.com |
www.api.account.google.fajarcode.com
www.gstatic.com |
4 | fonts.gstatic.com |
www.api.account.google.fajarcode.com
|
2 | accounts.youtube.com |
www.api.account.google.fajarcode.com
www.gstatic.com |
1 | www.api.account.google.fajarcode.com | |
33 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
accounts.google.com |
support.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
api.account.google.fajarcode.com R3 |
2022-09-13 - 2022-12-12 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-08-22 - 2022-11-14 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2022-08-22 - 2022-11-14 |
3 months | crt.sh |
accounts.google.com GTS CA 1C3 |
2022-08-29 - 2022-11-21 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://www.api.account.google.fajarcode.com/
Frame ID: 4384720F8C749B4F1143274637188B9D
Requests: 24 HTTP requests in this frame
Frame:
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=855669132×tamp=1663032470736
Frame ID: BF31A382F0CA1B871C59BFB28F93ACF0
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.google.com/_/bscframe
Frame ID: 2A4CAD7BE10EB52264EB608E1DB7CA65
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=855669132×tamp=1663040731982
Frame ID: 93563580D24820602B97D2D1E001EDC9
Requests: 1 HTTP requests in this frame
6 Outgoing links
These are links going to different origins than the main page.
Title: Lupa email?
Search URL Search Domain Scan URL
Title: Pelajari lebih lanjut
Search URL Search Domain Scan URL
Title: Buat akun
Search URL Search Domain Scan URL
Title: Bantuan
Search URL Search Domain Scan URL
Title: Privasi
Search URL Search Domain Scan URL
Title: Persyaratan
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.api.account.google.fajarcode.com/ |
623 KB 85 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=_b,_tp,_r
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.id.pV3p6TGM2kk.es5.O/am=MAEIYgIKDAAAAAAAAAAAMOAAAQ/d=1/excm=_b,_r,_tp,identifierview/ed=1/dg=0/wt=2/rs=AOaEmlGfdIOJI_PjTIRo4k... |
185 KB 65 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
267 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v14/ |
21 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v14/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CheckConnection
accounts.youtube.com/accounts/ Frame BF31 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bscframe
accounts.google.com/_/ Frame 2A4C |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=n73qwf,zwU6q,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,rXHJjc,njlZCf,byfTOb,lsjVmc,xUdipf,OTA3Ae,COQbmf,fKUV3e,aurFic,U0aPgd,kKw6r,ANCJdb,IAEjzb,NTMZac,i5dxUd,m9oV,NAySvc,O6y8ed,t2srLd,XP0Iwc,PrPY...
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.id.pV3p6TGM2kk.es5.O/ck=boq-identity.AccountsSignInUi.I-nx2ng089I.L.B1.O/am=MAEIYgIKDAAAAAAAAAAAMOAAAQ/d=1/exm=_b,_r,_tp/excm... |
565 KB 186 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=ltDFwf,Rusgnf,bjrrWe,QCqtlc,i5H9N,bTi8wc,PHUIyb,ZY6Tf,uu7UOe,WI6cU,soHxf,Xq93uf,qNG0Fc,ywOR5c
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.id.pV3p6TGM2kk.es5.O/ck=boq-identity.AccountsSignInUi.I-nx2ng089I.L.B1.O/am=MAEIYgIKDAAAAAAAAAAAMOAAAQ/d=1/exm=A2sInc,AD1APd,... |
57 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=ZwDk9d,RMhBfe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.id.pV3p6TGM2kk.es5.O/ck=boq-identity.AccountsSignInUi.I-nx2ng089I.L.B1.O/am=MAEIYgIKDAAAAAAAAAAAMOAAAQ/d=1/exm=A2sInc,AD1APd,... |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=bm51tf
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.id.pV3p6TGM2kk.es5.O/ck=boq-identity.AccountsSignInUi.I-nx2ng089I.L.B1.O/am=MAEIYgIKDAAAAAAAAAAAMOAAAQ/d=1/exm=A2sInc,AD1APd,... |
1 KB 719 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=sOXFj,q0xTif,ZZ4WUe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.id.pV3p6TGM2kk.es5.O/ck=boq-identity.AccountsSignInUi.I-nx2ng089I.L.B1.O/am=MAEIYgIKDAAAAAAAAAAAMOAAAQ/d=1/exm=A2sInc,AD1APd,... |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
jserror
accounts.google.com/v3/signin/_/AccountsSignInUi/ |
0 29 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
jserror
accounts.google.com/v3/signin/_/AccountsSignInUi/ |
0 29 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
CheckConnection
accounts.youtube.com/accounts/ Frame 9356 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
jserror
accounts.google.com/v3/signin/_/AccountsSignInUi/ |
0 29 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
log
play.google.com/ Frame |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=Wt6vjf,hhhU8,FCpbqb,WhJNk
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.id.pV3p6TGM2kk.es5.O/ck=boq-identity.AccountsSignInUi.I-nx2ng089I.L.B1.O/am=MAEIYgIKDAAAAAAAAAAAMOAAAQ/d=1/exm=A2sInc,AD1APd,... |
6 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
ngx_pagespeed_beacon
accounts.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
log
play.google.com/ Frame |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
log
play.google.com/ Frame |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
log
play.google.com/ Frame |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
log
play.google.com/ Frame |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
browserinfo
accounts.google.com/v3/signin/_/AccountsSignInUi/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
browserinfo
accounts.google.com/v3/signin/_/AccountsSignInUi/ Frame |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
log
play.google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
log
play.google.com/ Frame |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true&authuser=0
- Domain
- accounts.google.com
- URL
- https://accounts.google.com/ngx_pagespeed_beacon?url=https%3A%2F%2Fwww.api.account.google.fajarcode.com%2F
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true&authuser=0
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true&authuser=0
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true&authuser=0
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true&authuser=0
- Domain
- accounts.google.com
- URL
- https://accounts.google.com/v3/signin/_/AccountsSignInUi/browserinfo?f.sid=-6375578428904908234&bl=boq_identityfrontendauthuiserver_20220904.17_p0&hl=id&_reqid=13535&rt=j
- Domain
- play.google.com
- URL
- https://play.google.com/log?format=json&hasfast=true&authuser=0
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)52 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| WIZ_global_data number| cc_latency_start_time function| onaft function| _isLazyImage string| cc_aid number| iml_start number| css_size object| cc_latency function| ccTick function| onJsLoad function| onCssLoad function| _isVisible function| _recordImlEl number| prt function| wiz_tick string| _F_cssRowKey string| _F_combinedSignature function| _DumpException object| BOQ_wizbind object| AF_initDataKeys object| AF_dataServiceRequests object| AF_initDataChunkQueue function| AF_initDataCallback undefined| AF_initDataInitializeCallback object| aft_counter function| initAft object| IJ_values object| _wjdd object| pagespeed object| default_AccountsSignInUi boolean| BOQ_loadedInitialJS function| _F_installCss function| _B_err object| closure_lm_16328 function| wiz_progress function| _F_getIjData object| _mxNDff function| onFetchPhoneNumberInfo boolean| ly11Pc number| closure_uid_2163049362 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.google.com/ | Name: NID Value: 511=YLGbC5a8mpBjFdW9BYu1FAthAKsByFrRJKH0b6VA32QDtP4NgXdV53sXqi8ko4djwEN_HxHfF2N88w0PokKUcr821A_Z9U8jN-7mCmmJLEWQn5Bk8H0mWX-xa_sIJAKCkO4njGnFPF3d8ozF4HXUaiC23sEe_zNiMjzxccUQTiI |
|
www.api.account.google.fajarcode.com/ | Name: OTZ Value: 6678946_56_56__56_ |
19 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src * data: 'unsafe-eval' 'unsafe-inline' |
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload always |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.google.com
accounts.youtube.com
fonts.gstatic.com
play.google.com
www.api.account.google.fajarcode.com
www.gstatic.com
accounts.google.com
play.google.com
2001:df7:5300:2::69
2a00:1450:4001:801::2003
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::200d
2a00:1450:4001:810::200e
2a00:1450:4001:813::200e
369e5d9822c9efc07201befb9bd250316052018c0516555fb9c7c7428f675505
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5f3669a237b4517507bcf7f9eaf50f552eaa3bd9d062ccc67e46afb292255590
69f70d6b6feb756327387b113b6a1685d2ae06e1e6500dbfdf286910b363fd78
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
b11b57bfa917a3017249f6086d3635c2222ae3386f23eadc4f2f3f3d14fc797e
b1251eac41279350a035839b0837b6d165383fb0086051938d97236734017df1
b5cf5cf37283b1c59e7849848332339c4a70ed0187e29a2161ff93219272d271
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
cb7d2507ee7d189358b16fecd92af303fc2569bccf529ff24bc277d8804157f6
ceb6bb60b4c2bac67545b0dffe33fe2fb6f8ca53dc84efcbaa6260d30d894ffb
e2afb9b2633d809e1de80587d3ef72375844483a703878403aa4bde4d5e3edb7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855