URL: http://34.143.198.6/
Submission: On May 16 via automatic, source urlhaus — Scanned from SG

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 34.143.198.6, located in Singapore, Singapore and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is 34.143.198.6.
This is the only time 34.143.198.6 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

IP Address AS Autonomous System
2 34.143.198.6 396982 (GOOGLE-CL...)
1 74.125.68.95 15169 (GOOGLE)
4 64.233.170.94 15169 (GOOGLE)
1 142.251.175.94 15169 (GOOGLE)
1 74.125.68.113 15169 (GOOGLE)
9 5
Apex Domain
Subdomains
Transfer
5 gstatic.com
ssl.gstatic.com
fonts.gstatic.com
64 KB
1 youtube.com
accounts.youtube.com — Cisco Umbrella Rank: 321
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 33
2 KB
9 3
Domain Requested by
4 ssl.gstatic.com 34.143.198.6
1 accounts.youtube.com 34.143.198.6
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com 34.143.198.6
9 4

This site contains links to these domains. Also see Links.

Domain
accounts.google.com
www.google.com
Subject Issuer Validity Valid
upload.video.google.com
GTS CA 1C3
2024-04-16 -
2024-07-09
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2024-04-16 -
2024-07-09
3 months crt.sh
*.google.com
GTS CA 1C3
2024-04-16 -
2024-07-09
3 months crt.sh

This page contains 2 frames:

Primary Page: http://34.143.198.6/
Frame ID: 897ED1E5E36F1611AF05946A1B28E99B
Requests: 8 HTTP requests in this frame

Frame: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-190951695&timestamp=1715847145069
Frame ID: 0320D996BE221104F9CCB3C0C6F4A81F
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Sign in - Google Accounts

Page URL History Show full URLs

  1. http://34.143.198.6/ HTTP 307
    https://34.143.198.6/ HTTP 307
    http://34.143.198.6/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

9
Requests

78 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

124 kB
Transfer

132 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://34.143.198.6/ HTTP 307
    https://34.143.198.6/ HTTP 307
    http://34.143.198.6/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
34.143.198.6/
Redirect Chain
  • http://34.143.198.6/
  • https://34.143.198.6/
  • http://34.143.198.6/
58 KB
58 KB
Document
General
Full URL
http://34.143.198.6/
Protocol
HTTP/1.0
Server
34.143.198.6 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
6.198.143.34.bc.googleusercontent.com
Software
BaseHTTP/0.6 Python/3.8.10 /
Resource Hash
513a5c68322d30bb1bae13ee4e72fa7348676b338fb89960f86464c783504542

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content_type
text/html
Date
Thu, 16 May 2024 08:12:24 GMT
Server
BaseHTTP/0.6 Python/3.8.10

Redirect headers

Location
http://34.143.198.6/
Non-Authoritative-Reason
HttpsUpgrades
css
fonts.googleapis.com/
11 KB
2 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,400&lang=en
Requested by
Host: 34.143.198.6
URL: http://34.143.198.6/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.68.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sc-in-f95.1e100.net
Software
ESF /
Resource Hash
26ab2fd4afb5c57248a2007a588878f05464d27dfa0d46a35cadcd00b2bb8972
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
http://34.143.198.6/
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 16 May 2024 08:12:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 16 May 2024 08:12:25 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 16 May 2024 08:12:25 GMT
logo_2x.png
ssl.gstatic.com/accounts/ui/
5 KB
5 KB
Image
General
Full URL
https://ssl.gstatic.com/accounts/ui/logo_2x.png
Requested by
Host: 34.143.198.6
URL: http://34.143.198.6/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.233.170.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sg-in-f94.1e100.net
Software
sffe /
Resource Hash
749ecb257b4dabd6c2d346578fcbe63a96bf94c1f2366496409296167f03b7a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
http://34.143.198.6/
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 11:31:09 GMT
x-content-type-options
nosniff
last-modified
Tue, 27 Jun 2023 17:28:00 GMT
server
sffe
age
74476
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5274
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 15 May 2025 11:31:09 GMT
avatar_2x.png
ssl.gstatic.com/accounts/ui/
626 B
717 B
Image
General
Full URL
https://ssl.gstatic.com/accounts/ui/avatar_2x.png
Requested by
Host: 34.143.198.6
URL: http://34.143.198.6/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.233.170.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sg-in-f94.1e100.net
Software
sffe /
Resource Hash
cdcc6d6dcda827a694dce8bfa9a1ab41113b629ef1cc11f886866af9194c81d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
http://34.143.198.6/
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 10:47:58 GMT
x-content-type-options
nosniff
last-modified
Thu, 02 Nov 2023 22:48:00 GMT
server
sffe
age
77067
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
626
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 15 May 2025 10:47:58 GMT
logo_strip_2x.png
ssl.gstatic.com/accounts/ui/
10 KB
10 KB
Image
General
Full URL
https://ssl.gstatic.com/accounts/ui/logo_strip_2x.png
Requested by
Host: 34.143.198.6
URL: http://34.143.198.6/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.233.170.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sg-in-f94.1e100.net
Software
sffe /
Resource Hash
b2d3305551055e5d28aea38f218ee6ff6006afb8c80cc4f206a206bcb758df7c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
http://34.143.198.6/
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 09:32:44 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Jun 2023 18:58:00 GMT
server
sffe
age
81581
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10297
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 15 May 2025 09:32:44 GMT
universal_language_settings-21.png
ssl.gstatic.com/images/icons/ui/common/
199 B
639 B
Image
General
Full URL
https://ssl.gstatic.com/images/icons/ui/common/universal_language_settings-21.png
Requested by
Host: 34.143.198.6
URL: http://34.143.198.6/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.233.170.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sg-in-f94.1e100.net
Software
sffe /
Resource Hash
59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
http://34.143.198.6/
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 06:58:17 GMT
x-content-type-options
nosniff
last-modified
Thu, 02 Nov 2023 22:48:00 GMT
server
sffe
age
90848
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
199
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 15 May 2025 06:58:17 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/
47 KB
48 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400&lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.175.94 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
sh-in-f94.1e100.net
Software
sffe /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://fonts.googleapis.com/
Origin
http://34.143.198.6
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 10:10:34 GMT
x-content-type-options
nosniff
age
79311
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48236
x-xss-protection
0
last-modified
Thu, 14 Dec 2023 02:08:40 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 15 May 2025 10:10:34 GMT
CheckConnection
accounts.youtube.com/accounts/ Frame 0320
0
0
Document
General
Full URL
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-190951695&timestamp=1715847145069
Requested by
Host: 34.143.198.6
URL: http://34.143.198.6/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.68.113 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sc-in-f113.1e100.net
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://accounts.google.com script-src 'report-sample' 'nonce-IxvOxTQkyMA6zC3dwCJaBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://accounts.google.com
X-Xss-Protection 0

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Referer
http://34.143.198.6/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
frame-ancestors https://accounts.google.com script-src 'report-sample' 'nonce-IxvOxTQkyMA6zC3dwCJaBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport
content-type
text/html; charset=utf-8
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Thu, 16 May 2024 08:12:25 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma
no-cache
reporting-endpoints
default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzj0tDikmLw1pBikPj6kkkDiJ3SZ7AGAXHSv_OsRUDc_vkC63QgFuLhePl_2iY2gRmXJ7YxAQA1gBbA"
server
ESF
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM https://accounts.google.com
x-xss-protection
0
favicon.ico
34.143.198.6/
0
99 B
Other
General
Full URL
http://34.143.198.6/favicon.ico
Protocol
HTTP/1.0
Server
34.143.198.6 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
6.198.143.34.bc.googleusercontent.com
Software
BaseHTTP/0.6 Python/3.8.10 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Referer
http://34.143.198.6/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Date
Thu, 16 May 2024 08:12:25 GMT
Server
BaseHTTP/0.6 Python/3.8.10

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| jstiming function| gaia_attachEvent object| G function| Gb function| Ga object| Gc function| Gd function| Ge function| Gf function| Gg function| Gh function| Gj function| Gi object| Gk object| Gl function| Gm function| Gn object| Go string| Gp object| Gq object| Gr object| Gs function| Gt function| Gu function| Gv function| Gw function| G_checkConnectionMain function| G_setPostMessageSupportFlag object| __CHECK_CONNECTION_CONFIG object| botguard function| gaia_parseFragment function| gaia_prefillEmail object| hashParams function| gaia_setFocus

0 Cookies

4 Console Messages

Source Level URL
Text
intervention info URL: http://34.143.198.6/(Line 1322)
Message:
Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
recommendation verbose URL: http://34.143.198.6/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
security error
Message:
Refused to frame 'https://accounts.youtube.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://accounts.google.com".
network error URL: http://34.143.198.6/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)