firebasestorage.googleapis.com
Open in
urlscan Pro
2a00:1450:4001:814::200a
Malicious Activity!
Public Scan
Submitted URL: https://u17546893.ct.sendgrid.net/ls/click?upn=6M7YJMl7STy5DvdkgKhwy6ktuYwxIDfB0hMUhI1a9yL9xCgsdNN2qQI0GFN47Btb5imwWzHYHBCifU72sXV...
Effective URL: https://firebasestorage.googleapis.com/v0/b/cloudflares-15e08.appspot.com/o/index.html?alt=media&token=568ef911-f894-4dda-8598-b4e7c752...
Submission: On July 22 via manual from IN
Effective URL: https://firebasestorage.googleapis.com/v0/b/cloudflares-15e08.appspot.com/o/index.html?alt=media&token=568ef911-f894-4dda-8598-b4e7c752...
Submission: On July 22 via manual from IN
Summary
This website contacted 4 IPs
in 3 countries
across 4 domains to perform 11 HTTP transactions.
The main IP is 2a00:1450:4001:814::200a, located in
Frankfurt am Main, Germany and
belongs to GOOGLE, US.
The main domain is firebasestorage.googleapis.com.
TLS certificate: Issued by GTS CA 1O1 on June 30th 2020. Valid for: 3 months.
This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!
TLS certificate: Issued by GTS CA 1O1 on June 30th 2020. Valid for: 3 months.
This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WeTransfer (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 167.89.123.16 167.89.123.16 | 11377 (SENDGRID) (SENDGRID) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:814::200a | 15169 (GOOGLE) (GOOGLE) | |
| 5 | 51.254.148.117 51.254.148.117 | 16276 (OVH) (OVH) | |
| 1 | 2606:4700:20:... 2606:4700:20::681a:82c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 11 | 4 |
1
2a00:1450:4001:814::200a
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE, US)
ASN15169 (GOOGLE, US)
| firebasestorage.googleapis.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
oie.int
www.oie.int Failed |
73 KB |
| 1 |
ipapi.co
ipapi.co |
750 B |
| 1 |
googleapis.com
firebasestorage.googleapis.com |
30 KB |
| 1 |
sendgrid.net
1 redirects
u17546893.ct.sendgrid.net |
370 B |
| 11 | 4 |
| Domain | Requested by | |
|---|---|---|
| 5 | www.oie.int |
firebasestorage.googleapis.com
|
| 1 | ipapi.co |
firebasestorage.googleapis.com
|
| 1 | firebasestorage.googleapis.com | |
| 1 | u17546893.ct.sendgrid.net | 1 redirects |
| 11 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| wetransfer.com |
| wetransfer.pr.co |
| wetransfer.homerun.co |
| twitter.com |
| www.facebook.com |
| www.instagram.com |
| www.youtube.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| upload.video.google.com GTS CA 1O1 |
2020-06-30 - 2020-09-22 |
3 months | crt.sh |
| *.oie.int GlobalSign RSA OV SSL CA 2018 |
2020-02-27 - 2021-05-24 |
a year | crt.sh |
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-07-17 - 2021-07-17 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://firebasestorage.googleapis.com/v0/b/cloudflares-15e08.appspot.com/o/index.html?alt=media&token=568ef911-f894-4dda-8598-b4e7c75241c8&id=connie.wimer@mattel.com
Frame ID: 81889AF4BA9D70DCE48D3E1ACBC96C80
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://u17546893.ct.sendgrid.net/ls/click?upn=6M7YJMl7STy5DvdkgKhwy6ktuYwxIDfB0hMUhI1a9yL9xCgsdNN2qQI0GFN47Bt...
HTTP 302
https://firebasestorage.googleapis.com/v0/b/cloudflares-15e08.appspot.com/o/index.html?alt=media&token=568ef911-f89... Page URL
Page Statistics
16 Outgoing links
These are links going to different origins than the main page.
URL: https://wetransfer.com/forgot-password
Title: Forgot password?
Title: Forgot password?
Search URL Search Domain Scan URL
URL: https://wetransfer.com/sign-up?trk=WT201610_HalfPanel_GotPlusClick_tierFree&tier=free
Title: Sign up for free
Title: Sign up for free
Search URL Search Domain Scan URL
URL: https://wetransfer.com/sign-up?trk=WT201610_HalfPanel_GotPlusClick_tierPlus&tier=plus
Title: Get WeTransfer Pro
Title: Get WeTransfer Pro
Search URL Search Domain Scan URL
URL: https://wetransfer.com/legal/terms
Title: Terms
Title: Terms
Search URL Search Domain Scan URL
URL: https://wetransfer.pr.co/
Title: Press
Title: Press
Search URL Search Domain Scan URL
URL: https://wetransfer.homerun.co/
Title: Jobs
Title: Jobs
Search URL Search Domain Scan URL
URL: https://twitter.com/WeTransfer
Search URL Search Domain Scan URL
URL: https://www.facebook.com/wetransfer
Search URL Search Domain Scan URL
URL: https://www.instagram.com/WeTransfer/
Search URL Search Domain Scan URL
URL: https://www.youtube.com/WeTransfer
Search URL Search Domain Scan URL
URL: https://wetransfer.com/help
Title: Help
Title: Help
Search URL Search Domain Scan URL
URL: https://wetransfer.com/about
Title: About
Title: About
Search URL Search Domain Scan URL
URL: https://wetransfer.com/products
Title: Products
Title: Products
Search URL Search Domain Scan URL
URL: https://wetransfer.com/advertise
Title: Advertise
Title: Advertise
Search URL Search Domain Scan URL
URL: https://wetransfer.com/pro?trk=WT201908_Upgrade
Title: Sign up
Title: Sign up
Search URL Search Domain Scan URL
URL: https://wetransfer.com/log-in
Title: Log in
Title: Log in
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u17546893.ct.sendgrid.net/ls/click?upn=6M7YJMl7STy5DvdkgKhwy6ktuYwxIDfB0hMUhI1a9yL9xCgsdNN2qQI0GFN47Btb5imwWzHYHBCifU72sXVm6s-2FR3Vrv3wQ1apr2vyYRHdCVPTvp1714ZT3zQxY-2FnUjr9NonQZsZlf4HARz-2B-2Fyf90sjwwX-2FlVGw139-2Fc7DUohDvvh1SXtbCMkxwrEoY31amzYNZ33b2WVnsiASUKmNCMmfJV57dKH-2FMsyV-2FNI0Uc88A-3DZR20_Q6ukVbzobUvGlvMWHQFcJ9Ranlyg7ilbcIhm8fC-2FA47OdmBauKniO4MmlL9D6RLfi8wOkgQ-2BiowkblcKKpsTZOEkMR1oNRWHw731f4KjDGM8xGn7dHJkXzEbcBfU61jRUXVqVElNPRFdizQk3-2FiXvyIJ5y8pNCKAVDMpANCo0dwJ7o8dkMzZ9ives1FbW4Mh4MiaHJ1qh6XAkrbOMsMHHoB-2FdYqqBINUTVJBy4PWoqE-3D
HTTP 302
https://firebasestorage.googleapis.com/v0/b/cloudflares-15e08.appspot.com/o/index.html?alt=media&token=568ef911-f894-4dda-8598-b4e7c75241c8&id=connie.wimer@mattel.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.html
firebasestorage.googleapis.com/v0/b/cloudflares-15e08.appspot.com/o/ Redirect Chain
|
29 KB 30 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
ActiefGrotesque_W_Rg-1f437876.woff
www.oie.int/wahis/WeTransfer/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
ActiefGrotesque_W_Md-293e86f0.woff
www.oie.int/wahis/WeTransfer/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
GT-Super-WT-Super-1b214df1.woff
www.oie.int/wahis/WeTransfer/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
application-79cfc2de.chunk.css
www.oie.int/wahis/WeTransfer/css/ |
350 KB 68 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
wallpaper-d015a096.chunk.css
www.oie.int/wahis/WeTransfer/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cross-dark-ec4d805a.svg
www.oie.int/wahis/WeTransfer/images/ |
710 B 961 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
check-ae560310.svg
www.oie.int/wahis/WeTransfer/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
globe-dd3d31e7.svg
www.oie.int/wahis/WeTransfer/images/ |
841 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
ActiefGrotesque_W_Bd-1bdd99f9.woff
www.oie.int/wahis/WeTransfer/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
ipapi.co/json/ |
696 B 750 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.oie.int
- URL
- https://www.oie.int/wahis/WeTransfer/fonts/ActiefGrotesque_W_Rg-1f437876.woff
- Domain
- www.oie.int
- URL
- https://www.oie.int/wahis/WeTransfer/fonts/ActiefGrotesque_W_Md-293e86f0.woff
- Domain
- www.oie.int
- URL
- https://www.oie.int/wahis/WeTransfer/fonts/GT-Super-WT-Super-1b214df1.woff
- Domain
- www.oie.int
- URL
- https://www.oie.int/wahis/WeTransfer/fonts/ActiefGrotesque_W_Bd-1bdd99f9.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WeTransfer (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| createCORSRequest function| senddataPOST function| ValidateEmail function| postdata function| verifemail function| verifpassword function| verifdata boolean| isMobile string| url_string object| url string| communid object| nowdate object| imputs number| lastIndex string| OSName object| objs0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
firebasestorage.googleapis.com
ipapi.co
u17546893.ct.sendgrid.net
www.oie.int
www.oie.int
167.89.123.16
2606:4700:20::681a:82c
2a00:1450:4001:814::200a
51.254.148.117
06388945b6c4acd1b5a0e23058654e8035c13ab4fb26d9e98e0d3be441cda1a5
303a7787240d51aed9fcf9ec0790cad39cffe99a8eb69a5f2260438698c1ccec
38209c8fb7d72a610b8354aebf269c82a0bcb7a03eeee94a4f64193e671db2b1
4b0de95ef08061a4fc75da0d1617ea8c0749ca42374766d281e0b84eef25496e
6137a1b17801e62f7eb45af085364abd96bf00c2c781df10ed7a7b216dcdfab1
803dbab8e8e59f03736773f17746afcb0f8f4773aa5c9473fe4ba001a7ae8d52
bf170345e058d8bcc3ec09e9064394dc4cb71c2c6037165e5637a0a926cba144