accessibility-sri-wide-convenient.trycloudflare.com

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 2606:4700::6810:e684, located in United States and belongs to CLOUDFLARENET, US. The main domain is accessibility-sri-wide-convenient.trycloudflare.com.
TLS certificate: Issued by E1 on March 28th 2024. Valid for: 3 months.

This is the only time accessibility-sri-wide-convenient.trycloudflare.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 4	2606:4700::68... 2606:4700::6810:e684	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
4	4

4 2606:4700::6810:e684 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

accessibility-sri-wide-convenient.trycloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	trycloudflare.com 2 redirects accessibility-sri-wide-convenient.trycloudflare.com	482 KB
1	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
1	youtube.com accounts.youtube.com — Cisco Umbrella Rank: 325
4	3

	Domain	Requested by
4	accessibility-sri-wide-convenient.trycloudflare.com	2 redirects
1	www.google.com
1	accounts.youtube.com	accessibility-sri-wide-convenient.trycloudflare.com
4	3

This site contains links to these domains. Also see Links.

Domain
support.google.com
accounts.google.com

Subject Issuer	Validity	Valid
trycloudflare.com E1	`2024-03-28` - `2024-06-26`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-04-08` - `2024-07-01`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://accessibility-sri-wide-convenient.trycloudflare.com/login.html
Frame ID: 82DF174162A469BAF301405A9C38F69D
Requests: 4 HTTP requests in this frame

Frame: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1838497349&timestamp=1494410966271
Frame ID: F174D35F6E985337D2118554FAAA0215
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Gmail

Page URL History Show full URLs

http://accessibility-sri-wide-convenient.trycloudflare.com/ HTTP 307
https://accessibility-sri-wide-convenient.trycloudflare.com/ HTTP 302
https://accessibility-sri-wide-convenient.trycloudflare.com/login.html Page URL

Page Statistics

4
Requests

75 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

483 kB
Transfer

1467 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://support.google.com/accounts?hl=en
Title: Help

Search URL Search Domain Scan URL

URL: https://accounts.google.com/TOS?loc=MY&hl=en&privacy=true
Title: Privacy

Search URL Search Domain Scan URL

URL: https://accounts.google.com/TOS?loc=MY&hl=en
Title: Terms

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://accessibility-sri-wide-convenient.trycloudflare.com/ HTTP 307
https://accessibility-sri-wide-convenient.trycloudflare.com/ HTTP 302
https://accessibility-sri-wide-convenient.trycloudflare.com/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://accessibility-sri-wide-convenient.trycloudflare.com/jserror HTTP 302
https://accessibility-sri-wide-convenient.trycloudflare.com/login.html

4 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login.html Show response
accessibility-sri-wide-convenient.trycloudflare.com/
Redirect Chain

http://accessibility-sri-wide-convenient.trycloudflare.com/
https://accessibility-sri-wide-convenient.trycloudflare.com/
https://accessibility-sri-wide-convenient.trycloudflare.com/login.html

731 KB
241 KB

970ms
970ms

Document
text/html

2606:4700::6810:e684
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://accessibility-sri-wide-convenient.trycloudflare.com/login.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:e684 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8fb66565031caf3ea542ad3b49f388960d5a053742c2d0507c80189857f457e

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

cf-cache-status: DYNAMIC
cf-ray: 87bd587f4ef44d5e-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 29 Apr 2024 06:48:20 GMT
host: accessibility-sri-wide-convenient.trycloudflare.com
server: cloudflare
vary: Accept-Encoding

Redirect headers

cf-cache-status: DYNAMIC
cf-ray: 87bd587e4dd14d5e-FRA
content-type: text/html; charset=UTF-8
date: Mon, 29 Apr 2024 06:48:19 GMT
host: accessibility-sri-wide-convenient.trycloudflare.com
location: login.html
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/8.2.12

GET
H2

200

login.html Show response
accessibility-sri-wide-convenient.trycloudflare.com/
Redirect Chain

https://accessibility-sri-wide-convenient.trycloudflare.com/jserror
https://accessibility-sri-wide-convenient.trycloudflare.com/login.html

731 KB
241 KB

900ms
900ms

XHR
text/html

2606:4700::6810:e684
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://accessibility-sri-wide-convenient.trycloudflare.com/login.html
Protocol: H2
Server: 2606:4700::6810:e684 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8fb66565031caf3ea542ad3b49f388960d5a053742c2d0507c80189857f457e

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://accessibility-sri-wide-convenient.trycloudflare.com/login.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Mon, 29 Apr 2024 06:48:21 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
host: accessibility-sri-wide-convenient.trycloudflare.com
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cf-ray: 87bd5886dea64d5e-FRA

Redirect headers

date: Mon, 29 Apr 2024 06:48:20 GMT
cf-cache-status: DYNAMIC
server: cloudflare
host: accessibility-sri-wide-convenient.trycloudflare.com
x-powered-by: PHP/8.2.12
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
location: login.html
cf-ray: 87bd5885ed994d5e-FRA

GET
H2 200 CheckConnection
accounts.youtube.com/accounts/ Frame F174 0
0 97ms
52ms Document
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1838497349&timestamp=1494410966271

Requested by

Host: accessibility-sri-wide-convenient.trycloudflare.com
URL: https://accessibility-sri-wide-convenient.trycloudflare.com/login.html

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://accounts.google.com require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport script-src 'report-sample' 'nonce-Vfrc_bnFTXhAtXm5a1aBlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://accounts.google.com
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://accessibility-sri-wide-convenient.trycloudflare.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: frame-ancestors https://accounts.google.com require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport script-src 'report-sample' 'nonce-Vfrc_bnFTXhAtXm5a1aBlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Mon, 29 Apr 2024 06:48:20 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjUtDikmLw05BikPj6kkkDiJ3SZ7AGAXHSv_OsRUAsxM2xpXXvRjaBBQ-XZQIAZEYRjw"
server: ESF
x-content-type-options: nosniff
x-frame-options: ALLOW-FROM https://accounts.google.com
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 267 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H3 200 favicon.ico
www.google.com/ 5 KB
1 KB 22ms
7ms Other
image/x-icon 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/favicon.ico

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://accessibility-sri-wide-convenient.trycloudflare.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 29 Apr 2024 04:53:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6878
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1494
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:30:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/x-icon
cache-control: public, max-age=691200
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 07 May 2024 04:53:42 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	Message: Refused to frame 'https://accounts.youtube.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://accounts.google.com".

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accessibility-sri-wide-convenient.trycloudflare.com
accounts.youtube.com
www.google.com
2606:4700::6810:e684
2a00:1450:4001:811::200e
2a00:1450:4001:813::2004
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
b8fb66565031caf3ea542ad3b49f388960d5a053742c2d0507c80189857f457e

accessibility-sri-wide-convenient.trycloudflare.com Open in urlscan Pro 2606:4700::6810:e684 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

75 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

483 kBTransfer

1467 kBSize

0 Cookies

3 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

accessibility-sri-wide-convenient.trycloudflare.com Open in urlscan Pro
2606:4700::6810:e684 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

483 kB
Transfer

1467 kB
Size

0
Cookies

4 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!