firebasestorage.googleapis.com

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 6 HTTP transactions. The main IP is 2a00:1450:4001:80f::200a, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is firebasestorage.googleapis.com.
TLS certificate: Issued by GTS CA 1C3 on April 13th 2021. Valid for: 3 months.

This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Blockchain (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
1	198.20.110.107 198.20.110.107	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:3::621 2a04:4e42:3::621	54113 (FASTLY) (FASTLY)
1	78.129.237.3 78.129.237.3	20860 (IOMART-AS) (IOMART-AS)
2	104.18.93.71 104.18.93.71	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	5

1 198.20.110.107 (Netherlands)

ASN32475 (SINGLEHOP-LLC, US)
PTR: eu07.tmd.cloud

al-naturale.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

firebasestorage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::621 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 78.129.237.3 (United Kingdom)

ASN20860 (IOMART-AS, GB)

smtpjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.93.71 (United States)

ASN13335 (CLOUDFLARENET, US)

login.blockchain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	blockchain.com login.blockchain.com	30 KB
1	smtpjs.com smtpjs.com	782 B
1	jsdelivr.net cdn.jsdelivr.net	24 KB
1	googleapis.com firebasestorage.googleapis.com	40 KB
1	al-naturale.com al-naturale.com	336 B
6	5

	Domain	Requested by
2	login.blockchain.com	firebasestorage.googleapis.com
1	smtpjs.com	firebasestorage.googleapis.com
1	cdn.jsdelivr.net	firebasestorage.googleapis.com
1	firebasestorage.googleapis.com	al-naturale.com
1	al-naturale.com
6	5

This site contains no links.

Subject Issuer	Validity	Valid
al-naturale.com R3	`2021-03-04` - `2021-06-02`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2021-04-26` - `2022-03-26`	a year	crt.sh
smtpjs.com R3	`2021-04-10` - `2021-07-09`	3 months	crt.sh
www.blockchain.com DigiCert SHA2 Extended Validation Server CA	`2020-12-09` - `2022-01-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://firebasestorage.googleapis.com/v0/b/gafefe-5dfc3.appspot.com/o/blast.html?alt=media&token=8e701dfc-5643-4888-bd78-75df613665a4
Frame ID: 9D3388A246A69F5E264ECFC40FF8F8B4
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://al-naturale.com/1ndex.php Page URL
https://firebasestorage.googleapis.com/v0/b/gafefe-5dfc3.appspot.com/o/blast.html?alt=media&token=8e701dfc-5643-488... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

6
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

94 kB
Transfer

329 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://al-naturale.com/1ndex.php Page URL
https://firebasestorage.googleapis.com/v0/b/gafefe-5dfc3.appspot.com/o/blast.html?alt=media&token=8e701dfc-5643-4888-bd78-75df613665a4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 1ndex.php Show response
al-naturale.com/ 196 B
336 B 810ms
20ms Document
text/html 198.20.110.107
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://al-naturale.com/1ndex.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.20.110.107 , Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: eu07.tmd.cloud
Software: LiteSpeed / PHP/7.4.16
Resource Hash: 7c1b12937c3c58fb8869e9a8a6fcc2b0841bfaf407794c6bc71c27b667add1a3

Request headers

:method: GET
:authority: al-naturale.com
:scheme: https
:path: /1ndex.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-powered-by: PHP/7.4.16
content-type: text/html; charset=UTF-8
content-length: 146
content-encoding: br
vary: Accept-Encoding,User-Agent
date: Thu, 29 Apr 2021 12:10:36 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000

GET
H2 200 Primary Request blast.html Show response
firebasestorage.googleapis.com/v0/b/gafefe-5dfc3.appspot.com/o/ 39 KB
40 KB 2556ms
2556ms Document
text/html 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://firebasestorage.googleapis.com/v0/b/gafefe-5dfc3.appspot.com/o/blast.html?alt=media&token=8e701dfc-5643-4888-bd78-75df613665a4
Requested by: Host: al-naturale.com
URL: https://al-naturale.com/1ndex.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 8996bcd4ac9819a166df898a3ab3ca0354ef04de7626f2edc9312b6a3622418b

Request headers

:method: GET
:authority: firebasestorage.googleapis.com
:scheme: https
:path: /v0/b/gafefe-5dfc3.appspot.com/o/blast.html?alt=media&token=8e701dfc-5643-4888-bd78-75df613665a4
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://al-naturale.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://al-naturale.com/

Response headers

x-guploader-uploadid: ABg5-UzR5pi3e1YMBLUhLF8BR_u0ln6mWS8o6kI52K4fpu6Mxm5WQMKyt9iXyQ2Sn17wtmf1Rczo6nivpb57HmunjS8fY9ejuA
expires: Thu, 29 Apr 2021 12:10:38 GMT
date: Thu, 29 Apr 2021 12:10:38 GMT
cache-control: private, max-age=0
last-modified: Thu, 29 Apr 2021 09:22:25 GMT
etag: "5e8d66bcda730b6712a7cb9ca1cf6286"
x-goog-generation: 1619688145180578
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 40281
x-goog-meta-firebasestoragedownloadtokens: 8e701dfc-5643-4888-bd78-75df613665a4
content-type: text/html
content-disposition: inline; filename*=utf-8''blast.html
x-goog-hash: crc32c=GgRAxg== md5=Xo1mvNpzC2cSp8ucoc9ihg==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 40281
server: UploadServer
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
24 KB 26ms
6ms Stylesheet
text/css 2a04:4e42:3::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/gafefe-5dfc3.appspot.com/o/blast.html?alt=media&token=8e701dfc-5643-4888-bd78-75df613665a4

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::621 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://firebasestorage.googleapis.com
Referer: https://firebasestorage.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 6786684
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 23906
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
x-served-by: cache-fra19160-FRA
date: Thu, 29 Apr 2021 12:10:39 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 smtp.js Show response
smtpjs.com/v3/ 871 B
782 B 78ms
22ms Script
application/javascript 78.129.237.3
IOMART-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://smtpjs.com/v3/smtp.js
Requested by: Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/gafefe-5dfc3.appspot.com/o/blast.html?alt=media&token=8e701dfc-5643-4888-bd78-75df613665a4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 78.129.237.3 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

Referer: https://firebasestorage.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 29 Apr 2021 12:10:39 GMT
content-encoding: gzip
last-modified: Tue, 10 Nov 2020 17:17:51 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "162f436b85b7d61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 603

GET
H2 200 bc-logo.svg
login.blockchain.com/img/ 6 KB
5 KB 133ms
57ms Image
image/svg+xml 104.18.93.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.blockchain.com/img/bc-logo.svg

Requested by

Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/gafefe-5dfc3.appspot.com/o/blast.html?alt=media&token=8e701dfc-5643-4888-bd78-75df613665a4

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

104.18.93.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6fdd6df66992c94ee619a7d602b16fcd06ae091df353643df482b89883062fb

Security Headers

Name	Value
Content-Security-Policy	img-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://blockchain.info .googleusercontent.com .zendesk.com *.yapily.com data: blob: android-webview-video-poster:; script-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info 'nonce-62YiUO7Ilh7rva0TpTbZunVdOI5vOJSn'; style-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info 'nonce-62YiUO7Ilh7rva0TpTbZunVdOI5vOJSn'; child-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://verify.isignthis.com https://wallet-helper.blockchain.com blob:; frame-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://verify.isignthis.com https://blockchain.info https://wallet-helper.blockchain.com https://magic.veriff.me/ https://pay.coinify.com; connect-src data: https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://blockchain.info https://api.blockchain.info wss://ws.blockchain.info/nabu-gateway/markets/quotes wss://ws.blockchain.info/coins wss://ws.blockchain.info/inv wss://ws.blockchain.info/eth/inv wss://ws.blockchain.info/bch/inv https://wallet-helper.blockchain.com https://verify.isignthis.com https://shapeshift.io https://app-api.coinify.com https://pay.coinify.com https://api.sfox.com https://quotes.sfox.com https://sfox-kyc.s3.amazonaws.com https://manager.api.live.ledger.com wss://api.ledgerwallet.com https://horizon.stellar.org https://friendbot.stellar.org https://bitpay.com https://pay.every-pay.eu https://static.zdassets.com https://ekr.zdassets.com https://blockchain.zendesk.com; object-src 'none'; media-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://storage.googleapis.com/bc_public_assets/ data: mediastream: blob:; font-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://firebasestorage.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Apr 2021 12:10:39 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: MISS
x-original-host: login.blockchain.com
x-cache-status: MISS bed50b99c9a226755f8bd3f02445a0fa
cf-request-id: 09bf22dfcd000000b29c8ba000000001
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
x-xss-protection: 1; mode=block
x-request-id: 6aa08ae9940a4e37403635d42b559a26
server: cloudflare
x-blockchain-cp-b: wallet-frontend
x-blockchain-server: BlockchainFE/1.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
x-blockchain-cp-f: 5m4c 0.002 - 6aa08ae9940a4e37403635d42b559a26
cache-control: no-cache
content-security-policy: img-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://blockchain.info *.googleusercontent.com *.zendesk.com *.yapily.com data: blob: android-webview-video-poster:; script-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info 'nonce-62YiUO7Ilh7rva0TpTbZunVdOI5vOJSn'; style-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info 'nonce-62YiUO7Ilh7rva0TpTbZunVdOI5vOJSn'; child-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://verify.isignthis.com https://wallet-helper.blockchain.com blob:; frame-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://verify.isignthis.com https://blockchain.info https://wallet-helper.blockchain.com https://magic.veriff.me/ https://pay.coinify.com; connect-src data: https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://blockchain.info https://api.blockchain.info wss://ws.blockchain.info/nabu-gateway/markets/quotes wss://ws.blockchain.info/coins wss://ws.blockchain.info/inv wss://ws.blockchain.info/eth/inv wss://ws.blockchain.info/bch/inv https://wallet-helper.blockchain.com https://verify.isignthis.com https://shapeshift.io https://app-api.coinify.com https://pay.coinify.com https://api.sfox.com https://quotes.sfox.com https://sfox-kyc.s3.amazonaws.com https://manager.api.live.ledger.com wss://api.ledgerwallet.com https://horizon.stellar.org https://friendbot.stellar.org https://bitpay.com https://pay.every-pay.eu https://static.zdassets.com https://ekr.zdassets.com https://blockchain.zendesk.com; object-src 'none'; media-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://storage.googleapis.com/bc_public_assets/ data: mediastream: blob:; font-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info;
x-blockchain-language: en
x-blockchain-language-id: 0:0:1 (en:en:en)
cf-ray: 64786dac78c600b2-AMS

GET
H2 200 bg-pattern.svg
login.blockchain.com/img/ 125 KB
25 KB 99ms
57ms Image
image/svg+xml 104.18.93.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.blockchain.com/img/bg-pattern.svg

Requested by

Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/gafefe-5dfc3.appspot.com/o/blast.html?alt=media&token=8e701dfc-5643-4888-bd78-75df613665a4

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

104.18.93.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5cb6b6de41e6999a4033374049e31c8a2dbbb9b34f71ad259f7e98e778a65d25

Security Headers

Name	Value
Content-Security-Policy	img-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://blockchain.info .googleusercontent.com .zendesk.com *.yapily.com data: blob: android-webview-video-poster:; script-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info 'nonce-qJZJ8L4EvEqNsMNnAeaIn4gc1dYL2FCR'; style-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info 'nonce-qJZJ8L4EvEqNsMNnAeaIn4gc1dYL2FCR'; child-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://verify.isignthis.com https://wallet-helper.blockchain.com blob:; frame-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://verify.isignthis.com https://blockchain.info https://wallet-helper.blockchain.com https://magic.veriff.me/ https://pay.coinify.com; connect-src data: https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://blockchain.info https://api.blockchain.info wss://ws.blockchain.info/nabu-gateway/markets/quotes wss://ws.blockchain.info/coins wss://ws.blockchain.info/inv wss://ws.blockchain.info/eth/inv wss://ws.blockchain.info/bch/inv https://wallet-helper.blockchain.com https://verify.isignthis.com https://shapeshift.io https://app-api.coinify.com https://pay.coinify.com https://api.sfox.com https://quotes.sfox.com https://sfox-kyc.s3.amazonaws.com https://manager.api.live.ledger.com wss://api.ledgerwallet.com https://horizon.stellar.org https://friendbot.stellar.org https://bitpay.com https://pay.every-pay.eu https://static.zdassets.com https://ekr.zdassets.com https://blockchain.zendesk.com; object-src 'none'; media-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://storage.googleapis.com/bc_public_assets/ data: mediastream: blob:; font-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://firebasestorage.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Apr 2021 12:10:39 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: MISS
x-original-host: login.blockchain.com
x-cache-status: MISS a2e77b4e5487722d75c87298bdd2862f
cf-request-id: 09bf22dfcd000000b25b35d000000001
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
x-xss-protection: 1; mode=block
x-request-id: b0fc46df9c345378e7b7511be690ec39
server: cloudflare
x-blockchain-cp-b: wallet-frontend
x-blockchain-server: BlockchainFE/1.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
x-blockchain-cp-f: 1mn8 0.002 - b0fc46df9c345378e7b7511be690ec39
cache-control: no-cache
content-security-policy: img-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://blockchain.info *.googleusercontent.com *.zendesk.com *.yapily.com data: blob: android-webview-video-poster:; script-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info 'nonce-qJZJ8L4EvEqNsMNnAeaIn4gc1dYL2FCR'; style-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info 'nonce-qJZJ8L4EvEqNsMNnAeaIn4gc1dYL2FCR'; child-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://verify.isignthis.com https://wallet-helper.blockchain.com blob:; frame-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://verify.isignthis.com https://blockchain.info https://wallet-helper.blockchain.com https://magic.veriff.me/ https://pay.coinify.com; connect-src data: https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://blockchain.info https://api.blockchain.info wss://ws.blockchain.info/nabu-gateway/markets/quotes wss://ws.blockchain.info/coins wss://ws.blockchain.info/inv wss://ws.blockchain.info/eth/inv wss://ws.blockchain.info/bch/inv https://wallet-helper.blockchain.com https://verify.isignthis.com https://shapeshift.io https://app-api.coinify.com https://pay.coinify.com https://api.sfox.com https://quotes.sfox.com https://sfox-kyc.s3.amazonaws.com https://manager.api.live.ledger.com wss://api.ledgerwallet.com https://horizon.stellar.org https://friendbot.stellar.org https://bitpay.com https://pay.every-pay.eu https://static.zdassets.com https://ekr.zdassets.com https://blockchain.zendesk.com; object-src 'none'; media-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info https://storage.googleapis.com/bc_public_assets/ data: mediastream: blob:; font-src https://login.blockchain.com https://wallet-frontend.prod.blockchain.info https://wallet-frontend-pre-release.prod.blockchain.info;
x-blockchain-language: en
x-blockchain-language-id: 0:0:1 (en:en:en)
cf-ray: 64786dac78c700b2-AMS

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Blockchain (Crypto Exchange)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

al-naturale.com
cdn.jsdelivr.net
firebasestorage.googleapis.com
login.blockchain.com
smtpjs.com
104.18.93.71
198.20.110.107
2a00:1450:4001:80f::200a
2a04:4e42:3::621
78.129.237.3
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
5cb6b6de41e6999a4033374049e31c8a2dbbb9b34f71ad259f7e98e778a65d25
7c1b12937c3c58fb8869e9a8a6fcc2b0841bfaf407794c6bc71c27b667add1a3
8996bcd4ac9819a166df898a3ab3ca0354ef04de7626f2edc9312b6a3622418b
a6fdd6df66992c94ee619a7d602b16fcd06ae091df353643df482b89883062fb
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

firebasestorage.googleapis.com Open in urlscan Pro 2a00:1450:4001:80f::200a Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

5 IPs

4 Countries

94 kBTransfer

329 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

0 Cookies

Indicators

firebasestorage.googleapis.com Open in urlscan Pro
2a00:1450:4001:80f::200a Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

94 kB
Transfer

329 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!