firebasestorage.googleapis.com

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 2607:f8b0:4004:c1f::5f, located in Washington, United States and belongs to GOOGLE, US. The main domain is firebasestorage.googleapis.com. The Cisco Umbrella rank of the primary domain is 7146. 9yr old
TLS certificate: Issued by WR2 on June 23rd 2025. Valid for: 3mo.

This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: CapitalOne (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	172.66.0.227 172.66.0.227	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c1f::5f	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
1		() ()
4	5

1 172.66.0.227 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

t.co 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2607:f8b0:4004:c1f::5f (Washington, United States)

ASN15169 (GOOGLE, US)

firebasestorage.googleapis.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 (None, )

ASN- ()

firebasestorage.googleapis.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
2	googleapis.com firebasestorage.googleapis.com — Cisco Umbrella Rank: 7146 9yr old	159 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 809 13yr old	31 KB
1	t.co t.co — Cisco Umbrella Rank: 942 13yr old	1 KB
4	3

	Domain	Requested by
2	firebasestorage.googleapis.com	t.co firebasestorage.googleapis.com
1	code.jquery.com	firebasestorage.googleapis.com
1	t.co
4	3

This site contains no links.

Subject Issuer	Validity	Valid
t.co E6	`2025-05-22` - `2025-08-20`	3mo	crt.sh
upload.video.google.com WR2	`2025-06-23` - `2025-09-15`	3mo	crt.sh
*.jquery.com Sectigo Public Server Authentication CA DV E36	`2025-06-12` - `2026-06-26`	1yr	crt.sh

This page contains 1 frames:

Primary Page: https://firebasestorage.googleapis.com/v0/b/nmu4-1197d.appspot.com/o/blobif3%2Fblobif.html?alt=media&token=eeb448d4-0699-45b1-babf-2af4db2658e4
Frame ID: C9B9974FFC9A6CBEE8977E2BA663F299
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Page URL History Show full URLs

https://t.co/DOD2ArgrON Page URL
https://firebasestorage.googleapis.com/v0/b/nmu4-1197d.appspot.com/o/blobif3%2Fblobif.html?alt=media&token=eeb448d4... Page URL

Detected technologies

jQuery (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

5
IPs

2
Countries

191 kB
Transfer

406 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/DOD2ArgrON Page URL
https://firebasestorage.googleapis.com/v0/b/nmu4-1197d.appspot.com/o/blobif3%2Fblobif.html?alt=media&token=eeb448d4-0699-45b1-babf-2af4db2658e4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 DOD2ArgrON Show response
t.co/ 596 B
1 KB 851ms
132ms Document
text/html 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://t.co/DOD2ArgrON

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_p /

Resource Hash

5427cabb1faeaba087b66ec99a17e03565f1b4c71671b52e363c73f66a645321

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519; includeSubdomains
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=300
cf-cache-status: DYNAMIC
cf-ray: 95f30b9f1ce6db5e-LAX
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 14 Jul 2025 18:22:25 GMT
expires: Mon, 14 Jul 2025 18:27:25 GMT
perf: 7402827104
server: cloudflare tsa_p
strict-transport-security: max-age=631138519; includeSubdomains
vary: Origin accept-encoding
x-connection-hash: cda44d94efe0580ddd4bfcdccf4a1c824a75f207ddd42080190cedd45a0cdd98
x-response-time: 11
x-transaction-id: 73532082ccf7b5ba
x-xss-protection: 0

GET
H2 200 Primary Request blobif3%2Fblobif.html Show response
firebasestorage.googleapis.com/v0/b/nmu4-1197d.appspot.com/o/ 159 KB
159 KB 1124ms
440ms Document
text/html 2607:f8b0:4004:c1f::5f
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://firebasestorage.googleapis.com/v0/b/nmu4-1197d.appspot.com/o/blobif3%2Fblobif.html?alt=media&token=eeb448d4-0699-45b1-babf-2af4db2658e4
Requested by: Host: t.co
URL: https://t.co/DOD2ArgrON
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1f::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: b52a5c4f17f4cde3e9012bdc6c9c6da9be45486e09900abc4761c23351dc2130

Request headers

Referer: https://t.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-disposition: inline; filename*=utf-8''blobif.html
content-length: 162391
content-type: text/html
date: Mon, 14 Jul 2025 18:22:26 GMT
etag: "0b7ff5f2e293e6b910afef1eaf9ba590"
expires: Mon, 14 Jul 2025 18:22:26 GMT
last-modified: Sun, 13 Jul 2025 16:40:41 GMT
server: UploadServer
x-goog-generation: 1752424841730106
x-goog-hash: crc32c=Xs2SJw== md5=C3/18uKT5rkQr+8er5ulkA==
x-goog-meta-firebasestoragedownloadtokens: eeb448d4-0699-45b1-babf-2af4db2658e4
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 162391
x-guploader-uploadid: ABgVH884km2TnQYaNRvyxd83n0KS19wJ2PIpWFqu3Wuf0NV-rRv7rg9phBExrApn0s3v9SWuP0JuCYA

GET
H2 200 jquery-3.6.0.min.js
code.jquery.com/ 87 KB
31 KB 707ms
214ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/nmu4-1197d.appspot.com/o/blobif3%2Fblobif.html?alt=media&token=eeb448d4-0699-45b1-babf-2af4db2658e4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://firebasestorage.googleapis.com/

Response headers

content-encoding: gzip
etag: W/"28feccc0-15d9d"
age: 4246347
x-cache: HIT, HIT
date: Mon, 14 Jul 2025 18:22:27 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 267113, 535867
x-served-by: cache-lga21931-LGA, cache-toj-leto2350043-TOJ
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1752517347.081556,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30875
server: nginx

GET
BLOB 200
OK 2c3caa4a-a20c-446f-ae1d-1c62e9c3846a Show response
https://firebasestorage.googleapis.com/ 118 KB
0 Document
text/html

General

Check archive.org

Download Go to

Full URL: blob:https://firebasestorage.googleapis.com/2c3caa4a-a20c-446f-ae1d-1c62e9c3846a
Requested by: Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/nmu4-1197d.appspot.com/o/blobif3%2Fblobif.html?alt=media&token=eeb448d4-0699-45b1-babf-2af4db2658e4
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8bb5d5bf8b1be46bee031409ff4d617468c596200330e91fd66de570c222dd2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

Content-Length: 121170
Content-Type: text/html

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0cb50e0480356ebb0158dfe5f8efa9707f556d704a54a4a3ebae3ed0fdb50e29

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b17a79ce3b9255e983b5cc79c0e6a8c2a3aac69c72c7401de1af65835adfbd35

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 38 KB
0 Image
image/gif

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e3d5246b17e19e65385092db07554d8e1c5c4a226a6d7f97824b8e1e8571e34

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: CapitalOne (Financial)

0 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.t.co/	1970-01-21 16:24:37	Name: muc Value: 18b274de-b316-4423-a754-657382c6812c
.t.co/	1970-01-21 16:24:37	Name: muc_ads Value: 18b274de-b316-4423-a754-657382c6812c
.t.co/	1970-01-21 06:48:39	Name: __cf_bm Value: Ft5rbeFKxivTvlRQhK1QRhZC_f5SDEtTXW12sbZ1ljA-1752517345-1.0.1.1-FsusYTNrMt6iU3pK8juimb8CDlQCOTyrgY7e7wKNsr3Vp2R5FWE8r2hWAfYYf_w4KGVizeyTH2m8xwPQ9I4FIZ4T.hA8v10Sr7K.8PYvscQ

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=631138519; includeSubdomains
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
firebasestorage.googleapis.com
t.co

172.66.0.227
2607:f8b0:4004:c1f::5f
2a04:4e42::649
0cb50e0480356ebb0158dfe5f8efa9707f556d704a54a4a3ebae3ed0fdb50e29
5427cabb1faeaba087b66ec99a17e03565f1b4c71671b52e363c73f66a645321
5e3d5246b17e19e65385092db07554d8e1c5c4a226a6d7f97824b8e1e8571e34
b17a79ce3b9255e983b5cc79c0e6a8c2a3aac69c72c7401de1af65835adfbd35
b52a5c4f17f4cde3e9012bdc6c9c6da9be45486e09900abc4761c23351dc2130
c8bb5d5bf8b1be46bee031409ff4d617468c596200330e91fd66de570c222dd2

firebasestorage.googleapis.com 2607:f8b0:4004:c1f::5f Malicious Activity! Public Scan Open in urlscan Pro

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

5 IPs

2 Countries

191 kBTransfer

406 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Window variables

3 Cookies

Security Headers

Indicators

firebasestorage.googleapis.com
2607:f8b0:4004:c1f::5f Malicious Activity! Public Scan Open in urlscan Pro

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

5
IPs

2
Countries

191 kB
Transfer

406 kB
Size

3
Cookies

4 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!