cloudshare-account-auth.firebaseapp.com Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cloudshare-account-auth.firebaseapp.com/login-srf&wa-wsignin-0&rpsnv13&ct=1573432251&rve-=7.1.6819.0&wp-%20MBI_SSL_S...
Submission: On November 25 via automatic, source phishtank (November 25th 2021, 4:24:29 pm UTC) — Scanned from DE

Summary HTTP 14 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 14 HTTP transactions. The main IP is 2620:0:890::100, located in United States and belongs to FASTLY, US. The main domain is cloudshare-account-auth.firebaseapp.com.
TLS certificate: Issued by GTS CA 1D4 on September 20th 2021. Valid for: 3 months.

This is the only time cloudshare-account-auth.firebaseapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
7	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
2	2606:4700::68... 2606:4700::6810:5814	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
14	6

7 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

cloudshare-account-auth.firebaseapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5814 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	firebaseapp.com cloudshare-account-auth.firebaseapp.com	718 KB
2	gstatic.com fonts.gstatic.com	32 KB
2	googleapis.com ajax.googleapis.com fonts.googleapis.com	87 KB
2	jsdelivr.net cdn.jsdelivr.net	54 KB
1	cloudflare.com cdnjs.cloudflare.com	60 KB
14	5

	Domain	Requested by
7	cloudshare-account-auth.firebaseapp.com	cloudshare-account-auth.firebaseapp.com
2	fonts.gstatic.com	fonts.googleapis.com
2	cdn.jsdelivr.net	cloudshare-account-auth.firebaseapp.com
1	fonts.googleapis.com	cloudshare-account-auth.firebaseapp.com
1	ajax.googleapis.com	cloudshare-account-auth.firebaseapp.com
1	cdnjs.cloudflare.com	cloudshare-account-auth.firebaseapp.com
14	6

This site contains links to these domains. Also see Links.

Domain
signup.live.com
account.live.com

Subject Issuer	Validity	Valid
firebaseapp.com GTS CA 1D4	`2021-09-20` - `2021-12-19`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cloudshare-account-auth.firebaseapp.com/login-srf&wa-wsignin-0&rpsnv13&ct=1573432251&rve-=7.1.6819.0&wp-%20MBI_SSL_SHARED&wreply-https-/onedrive-live-com
Frame ID: 775F6E32E32FAD6ED272F6261A38B6D7
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Access Document - Onedrive

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

950 kB
Transfer

2777 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://signup.live.com/?lic=1
Title: Create one!

Search URL Search Domain Scan URL

URL: https://account.live.com/password/reset
Title: Can't access your account?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request onedrive-live-com Show response
cloudshare-account-auth.firebaseapp.com/login-srf&wa-wsignin-0&rpsnv13&ct=1573432251&rve-=7.1.6819.0&wp-%20MBI_SSL_SHARED&wreply-https-/ 1 KB
888 B 39ms
7ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudshare-account-auth.firebaseapp.com/login-srf&wa-wsignin-0&rpsnv13&ct=1573432251&rve-=7.1.6819.0&wp-%20MBI_SSL_SHARED&wreply-https-/onedrive-live-com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4d9b0bf19ed7ecc924f9525069cf91c269238bd540acd52cf671a165ef3ec8da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

cache-control: max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
etag: "cfd0527190827b4722e525c13abf15e02530301e42d37f3c90953a1671a95135"
last-modified: Sun, 19 Jan 2020 21:14:58 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
accept-ranges: bytes
date: Thu, 25 Nov 2021 16:24:23 GMT
x-served-by: cache-fra19141-FRA
x-cache: HIT
x-cache-hits: 1
x-timer: S1637857463.366840,VS0,VE1
vary: x-fh-requested-host, accept-encoding
content-length: 584

GET
H2 200 vue-resource@1.5.1 Show response
cdn.jsdelivr.net/npm/ 15 KB
6 KB 48ms
27ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue-resource@1.5.1

Requested by

Host: cloudshare-account-auth.firebaseapp.com
URL: https://cloudshare-account-auth.firebaseapp.com/login-srf&wa-wsignin-0&rpsnv13&ct=1573432251&rve-=7.1.6819.0&wp-%20MBI_SSL_SHARED&wreply-https-/onedrive-live-com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7bd5b12d1e0338fe5728c4f899f957568bd94b89957623240054831c5fbaabcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Thu, 25 Nov 2021 16:24:23 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2662644
x-jsd-version: 1.5.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19174-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"3ae4-svZzUvrIIqHYkQF19nQYgIzxw2U"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6b3c3a1a5c1b431b-FRA

GET
H2 200 vue.js Show response
cdnjs.cloudflare.com/ajax/libs/vue/2.4.0/ 258 KB
60 KB 67ms
27ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/vue/2.4.0/vue.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1e1fb016801f0ef326b11d187f212808547c0b95e1594916bfb3ea191862e40

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Thu, 25 Nov 2021 16:24:23 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2459675
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 60608
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402c-407a4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ARIzOGJygYz00kyvTTBi%2BwQhx7XwuNXDN7QZLv2ud4xypYkJuEIVIePc%2FYHBSX14CY%2FkfamzAoFzwmR3ybSX0uyk2ikMs0X9np6HvNp1LvRpFjcTlL3%2FuPnK316Y%2FSBCt4ROMDS%2FvG3dCkGDALm4o2WV"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6b3c3a1a7a9a177e-FRA
expires: Tue, 15 Nov 2022 16:24:23 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.1.1/ 85 KB
85 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 19:19:06 GMT
x-content-type-options: nosniff
age: 75917
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 86709
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 24 Nov 2022 19:19:06 GMT

GET
H2 200 css
fonts.googleapis.com/ 12 KB
1 KB 38ms
15ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700,900

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ba5c75008a133ef73a0eb980a0c37c168b6bd5db7279a90105697670440eeedf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 25 Nov 2021 16:14:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 25 Nov 2021 16:24:23 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 25 Nov 2021 16:24:23 GMT

GET
H2 200 materialdesignicons.min.css
cdn.jsdelivr.net/npm/@mdi/font@latest/css/ 298 KB
48 KB 54ms
34ms Stylesheet
text/css 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50271f9d1fb53bfd2074827218441de193a0f5bdb94f6a20b3e76d1fa91b41b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Thu, 25 Nov 2021 16:24:23 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 31595
x-jsd-version: 6.5.95
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19128-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"4a77e-zA2GoL0mTEDvUuLc3XyUhUKPyv0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6b3c3a1a5c19431b-FRA

GET
H2 200 app.d0105ee5.css
cloudshare-account-auth.firebaseapp.com/css/ 1 KB
557 B 13ms
11ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudshare-account-auth.firebaseapp.com/css/app.d0105ee5.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a6471782dc08e7e425a013a62392312d10e45f693273cd319ef70a247b0eea18

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/login-srf&wa-wsignin-0&rpsnv13&ct=1573432251&rve-=7.1.6819.0&wp-%20MBI_SSL_SHARED&wreply-https-/onedrive-live-com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
last-modified: Sun, 19 Jan 2020 21:14:58 GMT
x-timer: S1637857463.396212,VS0,VE1
etag: "c12d2565cf0efdc31c0e3e778db7a7b13a8e30c37098ee77e3a6578c050132b0"
x-served-by: cache-fra19141-FRA
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
date: Thu, 25 Nov 2021 16:24:23 GMT
accept-ranges: bytes
content-length: 449
x-cache-hits: 1

GET
H2 200 chunk-vendors.8cf6accd.css
cloudshare-account-auth.firebaseapp.com/css/ 304 KB
34 KB 12ms
11ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudshare-account-auth.firebaseapp.com/css/chunk-vendors.8cf6accd.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ed44e06c8f687d09edd93dc075e948fc9dd2847a3d58401e49ca7ad02fde45cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/login-srf&wa-wsignin-0&rpsnv13&ct=1573432251&rve-=7.1.6819.0&wp-%20MBI_SSL_SHARED&wreply-https-/onedrive-live-com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
last-modified: Sun, 19 Jan 2020 21:14:58 GMT
x-timer: S1637857463.396327,VS0,VE1
etag: "85b5fa82a18bc5d985f823936d9c705949eb95ccfbb70ce5a22460c39fdfa845"
x-served-by: cache-fra19141-FRA
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
date: Thu, 25 Nov 2021 16:24:23 GMT
accept-ranges: bytes
content-length: 34418
x-cache-hits: 1

GET
H2 200 app.9681738b.js Show response
cloudshare-account-auth.firebaseapp.com/js/ 15 KB
5 KB 17ms
16ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudshare-account-auth.firebaseapp.com/js/app.9681738b.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d85b2b02ff2611cdee604e7069ab0f55f9caad6c55f8171f781a9d8834e2f7e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/login-srf&wa-wsignin-0&rpsnv13&ct=1573432251&rve-=7.1.6819.0&wp-%20MBI_SSL_SHARED&wreply-https-/onedrive-live-com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
last-modified: Sun, 19 Jan 2020 21:14:58 GMT
x-timer: S1637857463.400316,VS0,VE1
etag: "a87d0323b719d39bf405f3eacce023e8d671373a5095ee71cf67de2472df01a7"
x-served-by: cache-fra19141-FRA
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Thu, 25 Nov 2021 16:24:23 GMT
accept-ranges: bytes
content-length: 5163
x-cache-hits: 1

GET
H2 200 chunk-vendors.31a2c1c9.js Show response
cloudshare-account-auth.firebaseapp.com/js/ 1 MB
405 KB 17ms
16ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudshare-account-auth.firebaseapp.com/js/chunk-vendors.31a2c1c9.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

7f45f54299facbb2d69dff02b6c598216d53d0b8f7dd40f8c1bc1981e917ca8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/login-srf&wa-wsignin-0&rpsnv13&ct=1573432251&rve-=7.1.6819.0&wp-%20MBI_SSL_SHARED&wreply-https-/onedrive-live-com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
last-modified: Sun, 19 Jan 2020 21:14:58 GMT
x-timer: S1637857463.400440,VS0,VE1
etag: "a1112d4c28abd9d70080b73882a1e7fc129504d2ea7e7a24f12107a98cfc1e23"
x-served-by: cache-fra19141-FRA
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Thu, 25 Nov 2021 16:24:23 GMT
accept-ranges: bytes
content-length: 414477
x-cache-hits: 1

GET
H2 200 ml.8307ca44.svg
cloudshare-account-auth.firebaseapp.com/img/ 3 KB
1 KB 7ms
7ms Image
image/svg+xml 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloudshare-account-auth.firebaseapp.com/img/ml.8307ca44.svg

Requested by

Host: cloudshare-account-auth.firebaseapp.com
URL: https://cloudshare-account-auth.firebaseapp.com/onedrive-live-com&about&en-us&signin-https-3A-2F-2Fwww-microsoft-com&rpsnv

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0aefa080bd911d312e48ed2cc66b05c9a609e462ef5c9e497d9e7e2c3c334e3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/onedrive-live-com&about&en-us&signin-https-3A-2F-2Fwww-microsoft-com&rpsnv
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Sun, 19 Jan 2020 21:14:58 GMT
x-timer: S1637857464.607228,VS0,VE1
etag: "7ed85c0640c68cbe754cc9bdaffd40b2f0fc9ba60e59c61ccb78b39eedf822c8-br"
x-served-by: cache-fra19141-FRA
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=3600
date: Thu, 25 Nov 2021 16:24:23 GMT
accept-ranges: bytes
content-length: 1180
x-cache-hits: 1

GET
H2 200 bg2.bcc8c3ad.jpg
cloudshare-account-auth.firebaseapp.com/img/ 273 KB
271 KB 57ms
56ms Image
image/jpeg 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloudshare-account-auth.firebaseapp.com/img/bg2.bcc8c3ad.jpg

Requested by

Host: cloudshare-account-auth.firebaseapp.com
URL: https://cloudshare-account-auth.firebaseapp.com/css/app.d0105ee5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cloudshare-account-auth.firebaseapp.com/css/app.d0105ee5.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
last-modified: Sun, 19 Jan 2020 21:14:58 GMT
x-timer: S1637857464.608438,VS0,VE49
etag: "cb019b1af241e25e90cb0a766b81e4080fce2536c125d1cef7537b83582f981d"
x-served-by: cache-fra19141-FRA
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/jpeg
cache-control: max-age=3600
date: Thu, 25 Nov 2021 16:24:23 GMT
accept-ranges: bytes
content-length: 277411
x-cache-hits: 1

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 30ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cloudshare-account-auth.firebaseapp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 17:56:19 GMT
x-content-type-options: nosniff
age: 80884
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 24 Nov 2022 17:56:19 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 34ms
11ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cloudshare-account-auth.firebaseapp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 19 Nov 2021 13:39:48 GMT
x-content-type-options: nosniff
age: 528275
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 19 Nov 2022 13:39:48 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
cloudshare-account-auth.firebaseapp.com
fonts.googleapis.com
fonts.gstatic.com
2606:4700::6810:125e
2606:4700::6810:5814
2620:0:890::100
2a00:1450:4001:809::200a
2a00:1450:4001:810::200a
2a00:1450:4001:827::2003
0aefa080bd911d312e48ed2cc66b05c9a609e462ef5c9e497d9e7e2c3c334e3f
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
4d9b0bf19ed7ecc924f9525069cf91c269238bd540acd52cf671a165ef3ec8da
50271f9d1fb53bfd2074827218441de193a0f5bdb94f6a20b3e76d1fa91b41b7
6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f
7bd5b12d1e0338fe5728c4f899f957568bd94b89957623240054831c5fbaabcd
7f45f54299facbb2d69dff02b6c598216d53d0b8f7dd40f8c1bc1981e917ca8e
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
a6471782dc08e7e425a013a62392312d10e45f693273cd319ef70a247b0eea18
ba5c75008a133ef73a0eb980a0c37c168b6bd5db7279a90105697670440eeedf
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d85b2b02ff2611cdee604e7069ab0f55f9caad6c55f8171f781a9d8834e2f7e3
e1e1fb016801f0ef326b11d187f212808547c0b95e1594916bfb3ea191862e40
ed44e06c8f687d09edd93dc075e948fc9dd2847a3d58401e49ca7ad02fde45cf

cloudshare-account-auth.firebaseapp.com Open in urlscan Pro 2620:0:890::100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

14 Requests

100 %HTTPS

100 %IPv6

5 Domains

6 Subdomains

6 IPs

2 Countries

950 kBTransfer

2777 kBSize

0 Cookies

2 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

cloudshare-account-auth.firebaseapp.com Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

950 kB
Transfer

2777 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!