![](/screenshots/980d4df6-d8a6-4210-97dd-10bdebd76a89.png)
sites.google.com
Open in
urlscan Pro
2a00:1450:4001:831::200e
Malicious Activity!
Public Scan
Effective URL: https://sites.google.com/view/ivordocx/home
Submission: On June 16 via manual from US
Summary
TLS certificate: Issued by GTS CA 1C3 on May 24th 2021. Valid for: 3 months.
This is the only time sites.google.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Adobe (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 205.139.111.117 205.139.111.117 | 3561 (CENTURYLI...) (CENTURYLINK-LEGACY-SAVVIS) | |
1 1 | 52.58.148.216 52.58.148.216 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2a00:1450:400... 2a00:1450:4001:831::200e | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
6 | 2a00:1450:400... 2a00:1450:4001:829::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:82a::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:802::2001 | 15169 (GOOGLE) (GOOGLE) | |
5 | 2a00:1450:400... 2a00:1450:4001:82a::2003 | 15169 (GOOGLE) (GOOGLE) | |
20 | 7 |
ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US)
PTR: us-api.mimecast.com
protect-us.mimecast.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-148-216.eu-central-1.compute.amazonaws.com
linkprotect.cudasvc.com |
ASN15169 (GOOGLE, US)
lh6.googleusercontent.com |
ASN15169 (GOOGLE, US)
lh5.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
441 KB |
5 |
google.com
sites.google.com apis.google.com |
121 KB |
2 |
googleusercontent.com
lh6.googleusercontent.com lh5.googleusercontent.com |
1004 KB |
2 |
googleapis.com
fonts.googleapis.com |
2 KB |
2 |
mimecast.com
2 redirects
protect-us.mimecast.com |
2 KB |
1 |
cudasvc.com
1 redirects
linkprotect.cudasvc.com |
655 B |
20 | 6 |
Domain | Requested by | |
---|---|---|
6 | www.gstatic.com |
sites.google.com
www.gstatic.com |
5 | fonts.gstatic.com |
fonts.googleapis.com
|
3 | sites.google.com |
www.gstatic.com
|
2 | apis.google.com |
sites.google.com
apis.google.com |
2 | fonts.googleapis.com |
sites.google.com
|
2 | protect-us.mimecast.com | 2 redirects |
1 | lh5.googleusercontent.com |
sites.google.com
|
1 | lh6.googleusercontent.com |
sites.google.com
|
1 | linkprotect.cudasvc.com | 1 redirects |
20 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google.com GTS CA 1C3 |
2021-05-24 - 2021-08-16 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
*.apis.google.com GTS CA 1C3 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
*.googleusercontent.com GTS CA 1C3 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sites.google.com/view/ivordocx/home
Frame ID: 27DF6F56E5235798744EB74E5FCE0B2C
Requests: 20 HTTP requests in this frame
Screenshot
![](/screenshots/980d4df6-d8a6-4210-97dd-10bdebd76a89.png)
Page URL History Show full URLs
-
https://protect-us.mimecast.com/s/RRlqCYElPwtAgzDPU0ZIwR?domain=linkprotect.cudasvc.com
HTTP 307
https://protect-us.mimecast.com/redirect/eNqtVm1v2zYQ_iuFgPWTrfBdZLBudZ2lcNqkSbOkQOfBoMiTrcUSVYlO6xT57zvJTZt... HTTP 307
https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fsites.google.com%2fview%2fivordocx%2fhome&c=E,1,IADI3olM... HTTP 302
https://sites.google.com/view/ivordocx/home Page URL
Detected technologies
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: CLICK HERE TO VIEW DOCUMENT SHARED
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://protect-us.mimecast.com/s/RRlqCYElPwtAgzDPU0ZIwR?domain=linkprotect.cudasvc.com
HTTP 307
https://protect-us.mimecast.com/redirect/eNqtVm1v2zYQ_iuFgPWTrfBdZLBudZ2lcNqkSbOkQOfBoMiTrcUSVYlO6xT57zvJTZtk2bcahq174fHuubvH_pq0ronJfuJs20Wo0892HaF9uYK2jHYJaWiXyShZB5fs01HSgoOyibGsAGXFuJY0owRfaMMwbJTYGK1blXURMOrX-Te5gjp282T_L9QU5RpObAUozpM8-G26itU8Gc2TbmXpoJVUOOkI-IwQlhuvpGGaKq2U4rnXBS9yrfHiu1NMquFc0Su9zqUQyjEPxAqvMJZhLndQSGkzBUYBxaiaag5FjrGVULlkjttsiFd5OQTj1nirWA54bWGokdQZojhIpSkIagfnNoR4_rMTQHj_3DY7gCJ8ifM9RGi9K7a86fWKKHU7ehLMiP4PwHRZYR0zuTSWQYbXOVC5cSDB58ppZowX1hL9GExL0KtgWIpgUhJnQTAKHgqnJLG2EFwaI4UkRjHPcRpkBqBoQTXOhbfiAZiFzcFljHDqnZcZdRIkB2-ttiaTnj8F5s9J4L9gNmtb1vfR5NkTYMbW1l1Vdl0Z6hTu4L8DFYjLCQdRaOZzYpyQ3meWEi2sUESrTChPpSkeg6pxLBSnmB_NOFdCZ9YVhdXO4gdoLqjUQmI7sszh5PFcoSonzvhCY_MeTShTUkuWZ2gxUhfaZYT1I8YsnmDqKVB_TgL3Qa2g65Aq5nttgdPExl3c5Dn4-wBTQg27_fsWqcSXSCI948xqlJrSJ_ta4INFhkmmF-cTNaFKoskOXtMVuKuL9293CmwF6ibOodhVtluhZAiRuJVWaldoZRjF5SuE65mj31rUeso0iP5I7Vs8cVUhKZXdy_I6tKkLVW_Z5P-g5TCs1-Hzs4sGVbGKx2FTY37JBqmxrQwqe7b8wW1YSdmU96itvhueDwONjp5Nd7Q6YAGVLde7jfx_sh08faiGCUXXh7YdhND1qAmJ3ctw4LJdYT_S-p7FG9tC_ex4qPZRCo8xeHzvA33ZDDpGTMoYSzVLaSYHyyp0cbCFTcx7tMZlo22KE5Hmtm2t23i7C3O7g_QkePzpSAjJUC4bfHwYFbVVt-zrS3599XZy-p6R41dcC04ZYQeKTNQBf2UO1HRKjJhOyKF5-cAtxeKb1jOSNm3wKaa1DuGqT-G3PvRuVGM33MsoUVQR3BxpcA_QvmnXaFnF2HT787353rqsrzBOxIlN-1K6azdUs4eOv9sXg-Mv3P7CCnx3ZYQuXYawXEPvharrEj7jVw-mD-4LPq5CBc_diz9GdDSbHMx4WB-ffIKb97Nie5TPNq9fb-HgZLr9UnXh5JJ_aD8s4dPscEH52U0Mk5t26d0MPo3fHQm1VdQeCjVZHB1dcLs9fX39UQXpLq9I83Gy1Itp_ebd5Gx5YCanZFYfnTo3Gz2P2ya8oP0Q9du1XLgxLDYdoQtc-8U1UpYeU7L4voeLHUqDffFtDcbYvLEwSL1a4K8yxlpuhoaRy-JUTS_PTmN5eH51UZ-fbXjW_31weBLrbt2u-fe3vIXlbqm_wTzedGnPLs52cdjN238ByoGZVA HTTP 307
https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fsites.google.com%2fview%2fivordocx%2fhome&c=E,1,IADI3olMNqezRIfyJbIuGGyeDNCyxmsoNV3WrWgeqIF_13QztoAzrgdcIeq-OJ46y61aF46A_JJU3ayPGvZ6o5cVk0pZAg8_CnKOAQgD9AP0InJPccI,&typo=1 HTTP 302
https://sites.google.com/view/ivordocx/home Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home
sites.google.com/view/ivordocx/ Redirect Chain
|
46 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 829 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
16 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rs=AGEqA5mdaMVYq-SwA6kCfG3by3MSSIwMGw
www.gstatic.com/_/atari/_/ss/k=atari.vw.7HdG_M9fR94.L.W.O/d=1/ |
533 KB 81 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
client.js
apis.google.com/js/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fW2_AA3YhIUZkYsC8LY4doZ8u-bciZDoA_auOPoEBG0RyrTWkY4UqELFwYNApUO0MIMNIFKonlVOWZv3SkfRbsM=w16383
lh6.googleusercontent.com/ |
34 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
m=view
www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.j9q1Gm1BAvk.O/d=1/rs=AGEqA5k8yyCtYq7ovIhzJi2OiWnaxdEUbQ/ |
494 KB 167 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
cb=gapi.loaded_0
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.p7L79FLXQCw.O/m=client/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCO6hl1EejjzC-wrWbDdgTxPi0Gs8g/ |
304 KB 104 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aA3DJmSigmZ0Zf0NaCyRZk9trYJUPvUV09PCfKefbbigQW-pMiSXpH9Xu4-pbVXN05HC58RDZe7KmQNorgASTuE=w16383
lh5.googleusercontent.com/ |
969 KB 970 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jizfRExUiTo99u79B_mh0O6tLQ.woff2
fonts.gstatic.com/s/ptsans/v12/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v12/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
u-440qyriQwlOrhSvowK_l5-fCZM.woff2
fonts.gstatic.com/s/merriweather/v22/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-29 |
logImpressions
sites.google.com/_/view/ |
17 B 64 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
m=MpJwZc,n73qwf,A4UTCb,qAKInc,sy2j,TGYpv,HIeYee,QxOCld,sy2y,YXyON,sy32,abQiW,NpD4ec,qEW1W,oNFsLb,ruhlUe,KUM7Z,sy2l,sy30,zPx2U,YLQSd,sy2,sy7,yyxWAc,sy12,sy13,sy14,xQtZb,yf2Bs,PQmzu,rHjpXd,sy2m,fNFZH...
www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.j9q1Gm1BAvk.O/d=0/rs=AGEqA5k8yyCtYq7ovIhzJi2OiWnaxdEUbQ/ |
75 KB 26 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
m=pB6Zqd,syu,IZT63,SF3gsd,vfuNJf,syq,syo,syv,O8k1Cd,sy15,siKnQd,syp,syt,syz,YNjGDd,syy,sy10,PrPYRd,xs1Gy,hc6Ubd,o02Jie,SpsfSb,sy17,sy16,syl,zbML3c
www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.j9q1Gm1BAvk.O/d=0/rs=AGEqA5k8yyCtYq7ovIhzJi2OiWnaxdEUbQ/ |
26 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
m=Y9atKf,NTMZac,sy1m,gJzDyc,sy1g,uY3Nvd,syh,syj,HYv29e
www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.j9q1Gm1BAvk.O/d=0/rs=AGEqA5k8yyCtYq7ovIhzJi2OiWnaxdEUbQ/ |
18 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
m=sy26,sy20,sy2g,sy2i,fuVYe,vVEdxc,sy2b,CG0Qwb
www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.j9q1Gm1BAvk.O/d=0/rs=AGEqA5k8yyCtYq7ovIhzJi2OiWnaxdEUbQ/ |
27 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
logImpressions
sites.google.com/_/view/ |
17 B 424 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Adobe (Consumer)41 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| DOCS_timing function| _DumpException object| _docs_flag_initialData object| _docs_flag_cek function| gapiLoaded object| _at_config object| globals object| messages object| gapi object| ___jsl function| bgImgLoaded object| default_vw object| _bind object| closure_lm_550482 number| closure_uid_844077128 object| osapi object| gapix object| gadgets object| iframer object| __gapi_jstiming__ object| shindig function| ToolbarApi object| iframes function| IframeBase function| Iframe function| IframeProxy function| IframeWindow object| googleapis function| _getTimingInstance function| _docsTiming0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | base-uri 'self';object-src 'none';report-uri /_/view/cspreport;script-src 'report-sample' 'nonce-DmXSBnCAkIZHvs5NSbHqfw' 'unsafe-inline' 'unsafe-eval';worker-src 'self';frame-ancestors https://google-admin.corp.google.com/ |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
apis.google.com
fonts.googleapis.com
fonts.gstatic.com
lh5.googleusercontent.com
lh6.googleusercontent.com
linkprotect.cudasvc.com
protect-us.mimecast.com
sites.google.com
www.gstatic.com
205.139.111.117
2a00:1450:4001:802::2001
2a00:1450:4001:811::2001
2a00:1450:4001:829::2003
2a00:1450:4001:829::200a
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::200e
2a00:1450:4001:831::200e
52.58.148.216
01096beb2fdab1c6fca4041e9d75097025c02dca2d1e1e7d76512bc98783c2c1
1e93b530a651320569bb9a1e5afdefa40ef6a77f7d1887a27cb4f5cc049b57a3
35823a90041e7e13f75c535aa7eaed0ea89eafa9530b51556fbea532727c5988
35e9108b587afaf4024625231bbfbb3018ac3c7e6b2ea8e3c1e5f70cc8aff6d9
3908f8af0090a29188690a2b272cfcb88cb802755b6d19b38f9384485f3f4750
3cf94d7f901b97a6697f2e7ac4b4688779b0c705f48939a2e09bc86d7c24e350
5591ac432df60d67fffcd11ee431d7587a913195aadb0d8b42db53ff32264b05
5624bdb5ab8f901184549f3e529a488e557d77bfbfa1ac7dc6f0c0e2d7b345ae
6a464a826a7d0a37a9e5a6d2e1b8fdeab0293e28d7880bcb1d8352540116a20f
7bef45a2d66e62100d6a4dad1b713dde1def59a7b963618e1d96c56593be00ec
824184ff41638dee8a27ee8ec3ac403edcb8467b0a274ec439f6038edc892a71
8ab278431ba6ee37a8d936b66c6ed574a687605e722afa013975c8f2546d8cfb
8d870a1640a7703395211595b305eacd15e8157b1c06d3d135119c2c53806018
95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cf90c4b49b4607ae3f1039b5636063eb8387b893253c226348b673cc00ab4fd1
da1a63a10b52159d228c2e42ea36b941811f9f33b2f8367f32369e51ed59b75e
e19e5fec549d0d871301c8196f4a954abe8d6913464a1ac511f81ef71529f89b