firebasestorage.googleapis.com
Open in
urlscan Pro
2a00:1450:4001:828::200a
Malicious Activity!
Public Scan
Effective URL: https://firebasestorage.googleapis.com/v0/b/utlooks-request.appspot.com/o/0utlook%20Rectifier!.html?alt=media&token=61d42503-792a-4f51-...
Submission Tags: phishing
Submission: On April 08 via api from AU
Summary
TLS certificate: Issued by GTS CA 1O1 on March 16th 2021. Valid for: 3 months.
This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 66.115.166.234 66.115.166.234 | 46562 (PERFORMIVE) (PERFORMIVE) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
18 | 152.199.23.37 152.199.23.37 | 15133 (EDGECAST) (EDGECAST) | |
1 | 2620:1ec:4::156 2620:1ec:4::156 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 1 | 2603:1026:c0d... 2603:1026:c0d:803::2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2603:1026:c0b... 2603:1026:c0b:22::2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2603:1026:240... 2603:1026:2404:1::1 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2a02:26f0:710... 2a02:26f0:7100:48c::4b36 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
24 | 7 |
ASN46562 (PERFORMIVE, US)
PTR: serv-17258.my-tss.com
tiny.ee |
ASN15169 (GOOGLE, US)
firebasestorage.googleapis.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
outlook.office365.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
outlook.office.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
webshell.suite.office.com |
ASN20940 (AKAMAI-ASN1, NL)
shell.cdn.office.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
msftauth.net
aadcdn.msftauth.net |
594 KB |
3 |
office.com
www.office.com outlook.office.com webshell.suite.office.com |
4 KB |
1 |
office.net
shell.cdn.office.net |
36 KB |
1 |
office365.com
1 redirects
outlook.office365.com |
2 KB |
1 |
googleapis.com
firebasestorage.googleapis.com |
33 KB |
1 |
tiny.ee
tiny.ee |
882 B |
24 | 6 |
Domain | Requested by | |
---|---|---|
18 | aadcdn.msftauth.net |
firebasestorage.googleapis.com
|
1 | shell.cdn.office.net |
webshell.suite.office.com
|
1 | webshell.suite.office.com |
firebasestorage.googleapis.com
|
1 | outlook.office.com |
firebasestorage.googleapis.com
|
1 | outlook.office365.com | 1 redirects |
1 | www.office.com |
firebasestorage.googleapis.com
|
1 | firebasestorage.googleapis.com |
tiny.ee
|
1 | tiny.ee | |
24 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.tiny.ee R3 |
2021-03-04 - 2021-06-02 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-03-16 - 2021-06-08 |
3 months | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2020-07-09 - 2021-07-09 |
a year | crt.sh |
portal.office.com DigiCert Cloud Services CA-1 |
2021-03-24 - 2022-03-23 |
a year | crt.sh |
outlook.com DigiCert Cloud Services CA-1 |
2020-02-25 - 2022-02-25 |
2 years | crt.sh |
webshell.suite.office.com DigiCert Cloud Services CA-1 |
2020-07-21 - 2022-07-21 |
2 years | crt.sh |
*.cdn.office.net Microsoft RSA TLS CA 01 |
2021-01-26 - 2022-01-26 |
a year | crt.sh |
This page contains 4 frames:
Primary Page:
https://firebasestorage.googleapis.com/v0/b/utlooks-request.appspot.com/o/0utlook%20Rectifier!.html?alt=media&token=61d42503-792a-4f51-85ad-81a1db7b6e5b
Frame ID: 096C485961261E8EE427778A181B1864
Requests: 20 HTTP requests in this frame
Frame:
https://www.office.com/logout?sid=494fe386-9fa1-4fbf-885f-5038fa243363
Frame ID: 6FDB68A71C5AA4129926CF267C366A20
Requests: 1 HTTP requests in this frame
Frame:
https://outlook.office.com/owa/auth/logoff.aspx?cmd=logoff&exlive=1&lgtype=1&sid=494fe386-9fa1-4fbf-885f-5038fa243363&pngSites=none
Frame ID: BA2BFAF691B24E8A3728C6FCB10FFD2F
Requests: 1 HTTP requests in this frame
Frame:
https://webshell.suite.office.com/iframe/TokenFactoryIframe/Logout?sid=494fe386-9fa1-4fbf-885f-5038fa243363
Frame ID: B3B2606552DF966FF55B04ABEFC7F3E7
Requests: 2 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://tiny.ee/Hkxg Page URL
- https://firebasestorage.googleapis.com/v0/b/utlooks-request.appspot.com/o/0utlook%20Rectifier!.html?alt=media&token... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://tiny.ee/Hkxg Page URL
- https://firebasestorage.googleapis.com/v0/b/utlooks-request.appspot.com/o/0utlook%20Rectifier!.html?alt=media&token=61d42503-792a-4f51-85ad-81a1db7b6e5b Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://outlook.office365.com/owa/auth/logoff.aspx?cmd=logoff&exlive=1&lgtype=1&sid=494fe386-9fa1-4fbf-885f-5038fa243363 HTTP 302
- https://outlook.office.com/owa/auth/logoff.aspx?cmd=logoff&exlive=1&lgtype=1&sid=494fe386-9fa1-4fbf-885f-5038fa243363&pngSites=none
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Hkxg
tiny.ee/ |
600 B 882 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
0utlook%20Rectifier!.html
firebasestorage.googleapis.com/v0/b/utlooks-request.appspot.com/o/ |
33 KB 33 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_59_uuouser7hrkmvbaz1jw2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
106 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.1.11.min__yok_chwseypwbmuffnnaa2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
109 KB 38 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aad.login.min_ynywyfekfmsp3ljup2epra2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
176 KB 44 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_7zyesnzhfxur7eprws2m2q2.png
aadcdn.msftauth.net/ests/2.1/content/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logout
www.office.com/ Frame 6FDB |
893 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logoff.aspx
outlook.office.com/owa/auth/ Frame BA2B Redirect Chain
|
263 B 2 KB |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logout
webshell.suite.office.com/iframe/TokenFactoryIframe/ Frame B3B2 |
435 B 963 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0-small_e4vo5it6bo-bdehiean-dq2.jpg
aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0_pdvuot_2pyxh5ith335y8a2.jpg
aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/ |
277 KB 277 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
suiteux.shell.tokenfactoryiframe.a1e498224a42da9a83e9.js
shell.cdn.office.net/shellux/o365/versionless/ Frame B3B2 |
148 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_7zyesnzhfxur7eprws2m2q2.png
aadcdn.msftauth.net/ests/2.1/content/images/ |
0 1 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
work_account_gwpgszjrdzmg9t-etotdlg2.png
aadcdn.msftauth.net/ests/2.1/content/images/ |
0 2 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
personal_account_d3k1lqya8k5_mmblgg85rq2.png
aadcdn.msftauth.net/ests/2.1/content/images/ |
0 1 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_59_uuouser7hrkmvbaz1jw2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
0 20 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.1.11.min__yok_chwseypwbmuffnnaa2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
0 38 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aad.login.min_ynywyfekfmsp3ljup2epra2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
0 43 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_7zyesnzhfxur7eprws2m2q2.png
aadcdn.msftauth.net/ests/2.1/content/images/ |
1 KB 1 KB |
Fetch
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
work_account_gwpgszjrdzmg9t-etotdlg2.png
aadcdn.msftauth.net/ests/2.1/content/images/ |
1 KB 2 KB |
Fetch
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
personal_account_d3k1lqya8k5_mmblgg85rq2.png
aadcdn.msftauth.net/ests/2.1/content/images/ |
1 KB 1 KB |
Fetch
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_59_uuouser7hrkmvbaz1jw2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
106 KB 19 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.1.11.min__yok_chwseypwbmuffnnaa2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
109 KB 38 KB |
Fetch
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aad.login.min_ynywyfekfmsp3ljup2epra2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
176 KB 43 KB |
Fetch
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)65 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B function| $ function| jQuery object| jQuery111206988387664663536 object| MSLogin object| proxy object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info object| MSLogout object| ThirdPartyCookieStates object| PostType object| LoginOption object| TenantBranding object| users object| Tiles object| $Api object| EmailDiscovery object| Support object| Post object| StrongAuthCheck object| Util object| WindowsBrowserSso function| SetImageStatus function| ImageTimeout function| IframeTimeout function| MsaTimeout function| TryCompleteSignout function| CompleteSignout function| CompleteSignoutRender function| RenderSignoutSuccess function| RenderSignoutFailure function| WriteSignoutFailedCookie function| InitiatorRedirect object| imageStatusArray boolean| imageStatusTimeout object| updatedUsers number| msaSignoutStatus object| msaSignoutTimerId boolean| iframeStatusTimeout2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.office.com/ | Name: OH.DCAffinity Value: OH-suk |
|
www.office.com/ | Name: OH.SID Value: 764ad891-fea5-4df5-866c-23a23f2f915e |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
firebasestorage.googleapis.com
outlook.office.com
outlook.office365.com
shell.cdn.office.net
tiny.ee
webshell.suite.office.com
www.office.com
152.199.23.37
2603:1026:2404:1::1
2603:1026:c0b:22::2
2603:1026:c0d:803::2
2620:1ec:4::156
2a00:1450:4001:828::200a
2a02:26f0:7100:48c::4b36
66.115.166.234
0b874f4ccfac9ff5264f1f7c29c4c016fde7e4e032512bac1bb43d145a44ea40
1e3dceb93e7c252036cfcded7e108e7e2473dae923a2401a84dd7925f5a9f0ad
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
35cceb3348d8d50cb9d46478114cc11727f9b3e78b08fc7f07101aea4bad7d1c
4a3c3d489ffcf962a1279ebe7e1ba3582e4debffdde6ef9a0ff2b4bd839a53b9
760a468144b22ebe39784f178352c0c86d5b26bf70b9d69e244753e47e407ac0
7ad1ad65fa56e4154d943099b98bcf6d8dd59df30f637f1088b2c228bb5a5c79
9a94a4714845d2f3bc143cf66aa8905fbf08d80dfc2ca9781f34a89b6fe01280
9fc929be7892b2f4498627d22bc1b3990dc380efcfe40fe6c3cac2dea7565c8e
b34b4d9017e90753a2604ebcc8843f859e720d851c144e0381020b4d5fbd02c6
e0dc890ea64529e586668c31957821d8b9d1639c30fbb02df697ed8112fa2d7a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea