urlscan.io logo urlscan.io
SecurityTrails logo

firebasestorage.googleapis.com Open in urlscan Pro
2a00:1450:4001:80e::200a  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://kfolg.csb.app/?email=tbrassard%40calumetelectronics.com
Effective URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b...
Submission Tags: falconsandbox
Submission: On April 26 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 4 countries across 9 domains to perform 17 HTTP transactions. The main IP is 2a00:1450:4001:80e::200a, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is firebasestorage.googleapis.com.
TLS certificate: Issued by GTS CA 1O1 on March 23rd 2021. Valid for: 3 months.
This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700::68... 13335 (CLOUDFLAR...)
4 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 3.226.126.255 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 146.59.152.166 16276 (OVH)
2 2a02:26f0:710... 20940 (AKAMAI-ASN1)
17 9
1    2606:4700::6812:1a72 (United States)

ASN13335 (CLOUDFLARENET, US)
kfolg.csb.app
4    2606:4700::6812:16cf (United States)

ASN13335 (CLOUDFLARENET, US)
codesandbox.io
1    3.226.126.255 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-226-126-255.compute-1.amazonaws.com
owa-exchange-web.herokuapp.com
1    2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
firebasestorage.googleapis.com
2    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
2    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
2    2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)
code.jquery.com
1    2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    146.59.152.166 (France)

ASN16276 (OVH, FR)
PTR: i.ibb.co
i.ibb.co
2    2a02:26f0:7100:494::356e (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
c.s-microsoft.com
Domain Requested by
4 codesandbox.io kfolg.csb.app
codesandbox.io
2 c.s-microsoft.com firebasestorage.googleapis.com
2 i.ibb.co firebasestorage.googleapis.com
2 code.jquery.com firebasestorage.googleapis.com
2 stackpath.bootstrapcdn.com firebasestorage.googleapis.com
2 maxcdn.bootstrapcdn.com firebasestorage.googleapis.com
1 cdnjs.cloudflare.com firebasestorage.googleapis.com
1 firebasestorage.googleapis.com kfolg.csb.app
1 owa-exchange-web.herokuapp.com 1 redirects
1 kfolg.csb.app
17 10

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-06-14 -
2021-06-14		 a year crt.sh
codesandbox.io
Cloudflare Inc ECC CA-3		 2020-06-19 -
2021-06-19		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2021-03-23 -
2021-06-15		 3 months crt.sh
jquery.org
Sectigo RSA Domain Validation Secure Server CA		 2020-10-06 -
2021-10-16		 a year crt.sh
ibb.co
R3		 2021-04-04 -
2021-07-03		 3 months crt.sh
www.microsoft.com
Microsoft RSA TLS CA 01		 2020-08-28 -
2021-08-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Frame ID: 24D5FDA7D0B01E4F6BCAF252DCDEE158
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://kfolg.csb.app/?email=tbrassard%40calumetelectronics.com Page URL
  2. https://owa-exchange-web.herokuapp.com/?email=tbrassard@calumetelectronics.com HTTP 302
    https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • headers via /^1\.1 google$/i

Page Statistics

17
Requests

100 %
HTTPS

80 %
IPv6

9
Domains

10
Subdomains

9
IPs

4
Countries

255 kB
Transfer

683 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://kfolg.csb.app/?email=tbrassard%40calumetelectronics.com Page URL
  2. https://owa-exchange-web.herokuapp.com/?email=tbrassard@calumetelectronics.com HTTP 302
    https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
kfolg.csb.app/ 		838 B
895 B 		Document
General
Check archive.org
Download Go to
Full URL
https://kfolg.csb.app/?email=tbrassard%40calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1a72 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e60735d99c61027461786c04e59c85e33784cb37f06b0b183f9c2e29209f840

Request headers

:method
GET
:authority
kfolg.csb.app
:scheme
https
:path
/?email=tbrassard%40calumetelectronics.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:50 GMT
content-type
text/html
set-cookie
__cfduid=d3bfd04126ad6b403548adc4eecc3fee71619444210; expires=Wed, 26-May-21 13:36:50 GMT; path=/; domain=.csb.app; HttpOnly; SameSite=Lax signedIn=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; max-age=0; HttpOnly
vary
Accept-Encoding
cache-control
private, max-age=0, no-cache, no-store
x-request-id
Fnlr7d-SYkdyDqVDce3j
via
1.1 google
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-request-id
09affeb17400001f41a615a000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
646033c8bfaa1f41-FRA
content-encoding
br
sse-hooks.f648b14c15c640a14a557113a991cb8d.js
codesandbox.io/public/sse-hooks/ 		172 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codesandbox.io/public/sse-hooks/sse-hooks.f648b14c15c640a14a557113a991cb8d.js
Requested by
Host: kfolg.csb.app
URL: https://kfolg.csb.app/?email=tbrassard%40calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d653312bf01341a4dcd9635548e8adc173e98c6d0864017152ebd4bc71fd4028

Request headers

Referer
https://kfolg.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:50 GMT
via
1.1 google
cf-cache-status
HIT
age
288174
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
09affeb37600004de8a0108000000001
last-modified
Thu, 22 Apr 2021 14:00:04 GMT
server
cloudflare
etag
W/"60818164-2aeac"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
cf-ray
646033cbfde94de8-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
banner.2c95dbd7d.js
codesandbox.io/static/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codesandbox.io/static/js/banner.2c95dbd7d.js
Requested by
Host: kfolg.csb.app
URL: https://kfolg.csb.app/?email=tbrassard%40calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fed972ca3dda3bc33f881dfb9a416e7b0b928059c9ec2c52b6a195091064b9a

Request headers

Referer
https://kfolg.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:50 GMT
via
1.1 google
cf-cache-status
HIT
age
125
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
09affeb37600004de8b18d3000000001
last-modified
Mon, 26 Apr 2021 13:26:48 GMT
server
cloudflare
etag
W/"6086bf98-f26"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
cf-ray
646033cbfdec4de8-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
watermark-button.be960f43b.js
codesandbox.io/static/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codesandbox.io/static/js/watermark-button.be960f43b.js
Requested by
Host: kfolg.csb.app
URL: https://kfolg.csb.app/?email=tbrassard%40calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c54e3596ca5bc23af15d182227beffe1fd11ae7b1f114a224a1aebc229df88eb

Request headers

Origin
https://kfolg.csb.app
Referer
https://kfolg.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:50 GMT
via
1.1 google
cf-cache-status
MISS
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
09affeb37700002bd690a43000000001
last-modified
Mon, 26 Apr 2021 13:26:48 GMT
server
cloudflare
etag
W/"6086bf98-ae8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
cf-ray
646033cbfb972bd6-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
phishing
codesandbox.io/api/v1/sandboxes/kfolg/ 		17 B
599 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://codesandbox.io/api/v1/sandboxes/kfolg/phishing
Requested by
Host: codesandbox.io
URL: https://codesandbox.io/static/js/banner.2c95dbd7d.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://kfolg.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:50 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://kfolg.csb.app
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
cf-ray
646033cc7b4716e6-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
17
cf-request-id
09affeb3c9000016e619b49000000001
x-request-id
Fnlr7e1WNeklzUoIiksJ
Primary Request index%20copy%202.html
firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/
Redirect Chain
  • https://owa-exchange-web.herokuapp.com/?email=tbrassard@calumetelectronics.com
  • https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
27 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Requested by
Host: kfolg.csb.app
URL: https://kfolg.csb.app/?email=tbrassard%40calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
1012a25530f6129dff1280a1ef619a6ada6a4ab6a96bab8f8dcd6cc63d8e9a11

Request headers

:method
GET
:authority
firebasestorage.googleapis.com
:scheme
https
:path
/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://kfolg.csb.app/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://kfolg.csb.app/?email=tbrassard%40calumetelectronics.com

Response headers

x-guploader-uploadid
ABg5-UxIbE1gRt960zDOuFim7Y31JwfjGiLxuiXipEuY9I-8grbo4hkcML2NspFDt-GA8yOrx7WcP8yvh83TPqQxktg
expires
Mon, 26 Apr 2021 13:36:58 GMT
date
Mon, 26 Apr 2021 13:36:58 GMT
cache-control
private, max-age=0
last-modified
Sun, 25 Apr 2021 22:02:03 GMT
etag
"51badc849ac971fe74b004ac386a86dc"
x-goog-generation
1619388123247548
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
27345
x-goog-meta-firebasestoragedownloadtokens
502a13c8-f641-4d5b-aa92-d9b72c197dd6
content-type
text/html
content-disposition
inline; filename*=utf-8''index%20copy%202.html
x-goog-hash
crc32c=eUSOig== md5=UbrchJrJcf50sASsOGqG3A==
x-goog-storage-class
STANDARD
accept-ranges
bytes
content-length
27345
server
UploadServer
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

Server
Cowboy
Connection
keep-alive
X-Powered-By
Express
Location
https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Vary
Accept
Content-Type
text/html; charset=utf-8
Content-Length
426
Date
Mon, 26 Apr 2021 13:36:57 GMT
Via
1.1 vegur
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		118 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://firebasestorage.googleapis.com
Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
632, 617, 617
age
288888
cdn-cachedat
2021-04-23 06:29:02
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
09affed1de00004a74671a8000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
e8b116c60ab5ea1084c389530a8577f5
cf-ray
646033fc9b5a4a74-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://firebasestorage.googleapis.com
Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
723, 617, 617, 617, 617, 617, 617, 617, 617, 617
age
258559
cdn-cachedat
2021-04-23 15:40:10
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
09affed1d300004e31c301e000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
f00bffd7406d6d3ad29d27e5d95c2a4d
cf-ray
646033fc8be84e31-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
jquery-3.3.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.min.js
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
content-encoding
gzip
last-modified
Sat, 20 Jan 2018 17:26:44 GMT
server
nginx
etag
W/"5a637bd4-1538f"
vary
Accept-Encoding
x-hw
1619444218.dop229.fr8.t,1619444218.cds240.fr8.hn,1619444218.cds002.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30288
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://firebasestorage.googleapis.com/
Origin
https://firebasestorage.googleapis.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2991136
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6458
cf-request-id
09affed2080000177ab70b3000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:15:37 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fa9-500f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=8cn%2BJfQEm%2FXyNeikel3EvYogwTJ2e1ZitkcpTJD83LpSVHWYEzzJ%2FNGRJC1L02sKpVYEg3CcJyRUkIGOavLBlUfWbLqfCB9iagpSvTAN%2BVtG%2F9rlEynAqBboOuEu3oRyxw%3D%3D"}]}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
646033fcdc5d177a-FRA
expires
Sat, 16 Apr 2022 13:36:58 GMT
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/ 		49 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://firebasestorage.googleapis.com/
Origin
https://firebasestorage.googleapis.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
565, 718, 718
age
279339
cdn-cachedat
2021-04-23 09:47:05
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
09affed20b000005d06db0e000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:05 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
27db4b7104c549488cdaa072ea048e7a
cf-ray
646033fcda4f05d0-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
jquery-3.3.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

Referer
https://firebasestorage.googleapis.com/
Origin
https://firebasestorage.googleapis.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
content-encoding
gzip
last-modified
Sat, 20 Jan 2018 17:26:44 GMT
server
nginx
etag
W/"5a637bd4-1111d"
vary
Accept-Encoding
x-hw
1619444218.dop120.fr8.t,1619444218.cds238.fr8.hn,1619444218.cds274.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
24038
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://firebasestorage.googleapis.com/
Origin
https://firebasestorage.googleapis.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
722, 617, 617
age
288888
cdn-cachedat
2021-04-23 06:58:04
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
09affed20b00002b7db9827000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:00 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
89555edc065c9ad0a2cf51d1ac048976
cf-ray
646033fcda952b7d-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
outlook-Logoleft.png
i.ibb.co/PGqXrNh/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/PGqXrNh/outlook-Logoleft.png
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
146.59.152.166 , France, ASN16276 (OVH, FR),
Reverse DNS
i.ibb.co
Software
nginx /
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
last-modified
Fri, 03 Apr 2020 12:16:26 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
2503
expires
Thu, 31 Dec 2037 23:55:55 GMT
download.png
i.ibb.co/QKZk6m6/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/QKZk6m6/download.png
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
146.59.152.166 , France, ASN16276 (OVH, FR),
Reverse DNS
i.ibb.co
Software
nginx /
Resource Hash
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
last-modified
Fri, 03 Apr 2020 12:19:50 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
5856
expires
Thu, 31 Dec 2037 23:55:55 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ 		33 KB
34 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100:494::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

Request headers

Origin
https://firebasestorage.googleapis.com
Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
last-modified
Fri, 10 Jan 2020 19:09:43 GMT
etag
"588d483e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=257866
accept-ranges
bytes
content-length
34052
expires
Thu, 29 Apr 2021 13:14:44 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/semibold/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/semibold/latest.woff2
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/owa-0-fbfe6.appspot.com/o/index%20copy%202.html?alt=media&token=502a13c8-f641-4d5b-aa92-d9b72c197dd6&email=tbrassard@calumetelectronics.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100:494::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f

Request headers

Origin
https://firebasestorage.googleapis.com
Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 13:36:58 GMT
last-modified
Fri, 10 Jan 2020 19:09:43 GMT
etag
"5b68d583e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=339988
accept-ranges
bytes
content-length
29388
expires
Fri, 30 Apr 2021 12:03:26 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.s-microsoft.com
cdnjs.cloudflare.com
code.jquery.com
codesandbox.io
firebasestorage.googleapis.com
i.ibb.co
kfolg.csb.app
maxcdn.bootstrapcdn.com
owa-exchange-web.herokuapp.com
stackpath.bootstrapcdn.com
146.59.152.166
2001:4de0:ac18::1:a:1b
2606:4700::6810:125e
2606:4700::6812:16cf
2606:4700::6812:1a72
2606:4700::6812:acf
2606:4700::6812:bcf
2a00:1450:4001:80e::200a
2a02:26f0:7100:494::356e
3.226.126.255
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
1012a25530f6129dff1280a1ef619a6ada6a4ab6a96bab8f8dcd6cc63d8e9a11
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
5fed972ca3dda3bc33f881dfb9a416e7b0b928059c9ec2c52b6a195091064b9a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7e60735d99c61027461786c04e59c85e33784cb37f06b0b183f9c2e29209f840
c54e3596ca5bc23af15d182227beffe1fd11ae7b1f114a224a1aebc229df88eb
d653312bf01341a4dcd9635548e8adc173e98c6d0864017152ebd4bc71fd4028
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c