firebasestorage.googleapis.com
Open in
urlscan Pro
2a00:1450:4001:802::200a
Malicious Activity!
Public Scan
Effective URL: https://firebasestorage.googleapis.com/v0/b/sharepoint-bb4bd.appspot.com/o/redirect%2Findex.html?alt=media&token=a93ef00e-6e0f-4e73-8c1...
Submission: On April 12 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1C3 on March 21st 2022. Valid for: 3 months.
This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online) Sharepoint (Online) Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 52.72.49.79 52.72.49.79 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 47.254.94.70 47.254.94.70 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
1 | 51.124.12.35 51.124.12.35 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 2a00:1450:400... 2a00:1450:4001:811::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:802::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:809::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:400c:c0c::9a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:82b::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 109.169.71.112 109.169.71.112 | 20860 (IOMART-AS) (IOMART-AS) | |
1 | 52.105.210.53 52.105.210.53 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 54.91.59.199 54.91.59.199 | 14618 (AMAZON-AES) (AMAZON-AES) | |
15 | 11 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-49-79.compute-1.amazonaws.com
dormkaba.com | |
englandconsultoffice.org |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
vzmnukppcjmzckpfzalotq.on.drv.tw |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
firebasestorage.googleapis.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
sherwoodestate.sharepoint.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-91-59-199.compute-1.amazonaws.com
api.ipify.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 37 |
20 KB |
3 |
googleapis.com
firebasestorage.googleapis.com — Cisco Umbrella Rank: 6033 ajax.googleapis.com — Cisco Umbrella Rank: 282 |
55 KB |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 71 |
104 KB |
2 |
drv.tw
vzmnukppcjmzckpfzalotq.on.drv.tw www.drv.tw |
2 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 3390 |
269 B |
1 |
sharepoint.com
sherwoodestate.sharepoint.com |
4 KB |
1 |
smtpjs.com
smtpjs.com — Cisco Umbrella Rank: 113106 |
1 KB |
1 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 95 |
453 B |
1 |
englandconsultoffice.org
1 redirects
englandconsultoffice.org |
385 B |
1 |
dormkaba.com
1 redirects
dormkaba.com |
286 B |
15 | 10 |
Domain | Requested by | |
---|---|---|
3 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | firebasestorage.googleapis.com |
firebasestorage.googleapis.com
|
2 | www.googletagmanager.com |
www.drv.tw
www.googletagmanager.com |
1 | api.ipify.org |
ajax.googleapis.com
|
1 | sherwoodestate.sharepoint.com |
firebasestorage.googleapis.com
|
1 | smtpjs.com |
firebasestorage.googleapis.com
|
1 | ajax.googleapis.com |
firebasestorage.googleapis.com
|
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | englandconsultoffice.org | 1 redirects |
1 | www.drv.tw |
vzmnukppcjmzckpfzalotq.on.drv.tw
|
1 | vzmnukppcjmzckpfzalotq.on.drv.tw | |
1 | dormkaba.com | 1 redirects |
15 | 12 |
This site contains links to these domains. Also see Links.
Domain |
---|
go.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
drv.tw R3 |
2022-03-25 - 2022-06-23 |
3 months | crt.sh |
www.drv.tw GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1 |
2022-01-23 - 2022-07-23 |
6 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-03-21 - 2022-06-13 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-03-21 - 2022-06-13 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2022-03-21 - 2022-06-13 |
3 months | crt.sh |
smtpjs.com R3 |
2022-03-20 - 2022-06-18 |
3 months | crt.sh |
*.sharepoint.com DigiCert Cloud Services CA-1 |
2021-10-07 - 2022-10-06 |
a year | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2022-02-07 - 2023-03-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://firebasestorage.googleapis.com/v0/b/sharepoint-bb4bd.appspot.com/o/redirect%2Findex.html?alt=media&token=a93ef00e-6e0f-4e73-8c19-68553afc4967
Frame ID: 3A2DC4C814F7A189A44AF504E9671C51
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Sharing Link ValidationPage URL History Show full URLs
-
https://dormkaba.com/onedrive
HTTP 301
https://vzmnukppcjmzckpfzalotq.on.drv.tw/docs.html Page URL
-
https://englandconsultoffice.org/remittance
HTTP 301
https://firebasestorage.googleapis.com/v0/b/sharepoint-bb4bd.appspot.com/o/redirect%2Findex.html?alt=media&token=a9... Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://dormkaba.com/onedrive
HTTP 301
https://vzmnukppcjmzckpfzalotq.on.drv.tw/docs.html Page URL
-
https://englandconsultoffice.org/remittance
HTTP 301
https://firebasestorage.googleapis.com/v0/b/sharepoint-bb4bd.appspot.com/o/redirect%2Findex.html?alt=media&token=a93ef00e-6e0f-4e73-8c19-68553afc4967 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://dormkaba.com/onedrive HTTP 301
- https://vzmnukppcjmzckpfzalotq.on.drv.tw/docs.html
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
docs.html
vzmnukppcjmzckpfzalotq.on.drv.tw/ Redirect Chain
|
2 KB 968 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wd.js
www.drv.tw/inc/ |
690 B 737 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
100 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
177 KB 65 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
redirect%2Findex.html
firebasestorage.googleapis.com/v0/b/sharepoint-bb4bd.appspot.com/o/ Redirect Chain
|
22 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 176 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
www.google-analytics.com/j/ |
2 B 22 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 453 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
collect
www.google-analytics.com/g/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
smtp.js
smtpjs.com/v3/ |
871 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft-logo.png
sherwoodestate.sharepoint.com/_layouts/15/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pdf.png
firebasestorage.googleapis.com/v0/b/linktopage-c7fd6.appspot.com/o/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
22 B 269 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 2 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.google-analytics.com
- URL
- https://www.google-analytics.com/g/collect?v=2&tid=G-NBGQJBJMEG>m=2oe460&_p=614463063&sr=1600x1200&_z=ccd.ABB&ul=en-us&cid=609529425.1649786544&dl=https%3A%2F%2Fvzmnukppcjmzckpfzalotq.on.drv.tw%2Fdocs.html&dt=&sid=1649786543&sct=1&seg=0&_s=2
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online) Sharepoint (Online) Microsoft (Consumer)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails function| $ function| jQuery object| Email number| count number| inputCount number| flag undefined| email undefined| password string| ip function| validateEmail function| stopProgress function| errorMsg function| onFormSubmit number| g_duration number| g_iisLatency number| g_cpuDuration number| g_queryCount number| g_queryDuration number| g_requireJSDone5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
vzmnukppcjmzckpfzalotq.on.drv.tw/ | Name: uid Value: rBEPrmJVvq5PwAopMfQPAg== |
|
.drv.tw/ | Name: _ga Value: GA1.2.609529425.1649786544 |
|
.drv.tw/ | Name: _gid Value: GA1.2.1738850240.1649786544 |
|
.drv.tw/ | Name: _gat_gtag_UA_85417367_1 Value: 1 |
|
.drv.tw/ | Name: _ga_NBGQJBJMEG Value: GS1.1.1649786543.1.0.1649786545.0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipify.org
dormkaba.com
englandconsultoffice.org
firebasestorage.googleapis.com
sherwoodestate.sharepoint.com
smtpjs.com
stats.g.doubleclick.net
vzmnukppcjmzckpfzalotq.on.drv.tw
www.drv.tw
www.google-analytics.com
www.googletagmanager.com
www.google-analytics.com
109.169.71.112
2a00:1450:4001:802::200a
2a00:1450:4001:809::200e
2a00:1450:4001:811::2008
2a00:1450:4001:82b::200a
2a00:1450:400c:c0c::9a
47.254.94.70
51.124.12.35
52.105.210.53
52.72.49.79
54.91.59.199
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
4849dbacd82a3cd21aa508c920bf569c98b0bb52726e7d1ce3cd5185e68eb060
4f33b00ff60ba75c03cfd1a1a5d0be37fb7bba6718ef54bf9898a53e1c72f87f
80f492ad2255b87485e0573b81ab162a4da61bc88d920831bbb998f911f9ed9a
825de044d5ac6442a094ff95099f9f67e9249a8110a2fbd57128285776632adb
87088728aa5265bdae51196d599bf7085cd02ba9b21cb9f8539aa8cd17445190
a10c17d161ecec1d83304e8b6541dd9acaf374c7fb2c99f75262d4f5b84fe25d
eda87975c9b7598af6b384b12ebd6fd46d5f2bce3b18247b17b06e84e56fd39b