firebasestorage.googleapis.com
Open in
urlscan Pro
2a00:1450:4001:81d::200a
Malicious Activity!
Public Scan
Submitted URL: http://adnanshafiq.com/wp-content/upgrade/oracle.php
Effective URL: https://firebasestorage.googleapis.com/v0/b/guvs7w0d9yyeedg8e76te6e.appspot.com/o/536475869%3D%3Dr-f8tiu%2Fbase.html?alt=media&token=6f...
Submission: On October 07 via manual from US
Effective URL: https://firebasestorage.googleapis.com/v0/b/guvs7w0d9yyeedg8e76te6e.appspot.com/o/536475869%3D%3Dr-f8tiu%2Fbase.html?alt=media&token=6f...
Submission: On October 07 via manual from US
Summary
This website contacted 4 IPs
in 2 countries
across 3 domains to perform 5 HTTP transactions.
The main IP is 2a00:1450:4001:81d::200a, located in
Frankfurt am Main, Germany and
belongs to GOOGLE, US.
The main domain is firebasestorage.googleapis.com.
TLS certificate: Issued by GTS CA 1O1 on September 3rd 2020. Valid for: 3 months.
This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!
TLS certificate: Issued by GTS CA 1O1 on September 3rd 2020. Valid for: 3 months.
This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 66.96.147.115 66.96.147.115 | 29873 (BIZLAND-SD) (BIZLAND-SD) | |
| 3 | 2a00:1450:400... 2a00:1450:4001:81d::200a | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 152.199.23.37 152.199.23.37 | 15133 (EDGECAST) (EDGECAST) | |
| 5 | 4 |
1
66.96.147.115
(Burlington, United States)
ASN29873 (BIZLAND-SD, US)
PTR: 115.147.96.66.static.eigbox.net
ASN29873 (BIZLAND-SD, US)
PTR: 115.147.96.66.static.eigbox.net
| adnanshafiq.com |
3
2a00:1450:4001:81d::200a
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE, US)
ASN15169 (GOOGLE, US)
| firebasestorage.googleapis.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
googleapis.com
firebasestorage.googleapis.com |
206 KB |
| 1 |
msftauth.net
aadcdn.msftauth.net |
2 KB |
| 1 |
adnanshafiq.com
adnanshafiq.com |
2 KB |
| 5 | 3 |
| Domain | Requested by | |
|---|---|---|
| 3 | firebasestorage.googleapis.com |
adnanshafiq.com
firebasestorage.googleapis.com |
| 1 | aadcdn.msftauth.net |
firebasestorage.googleapis.com
|
| 1 | adnanshafiq.com | |
| 5 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.cuny.edu |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| upload.video.google.com GTS CA 1O1 |
2020-09-03 - 2020-11-26 |
3 months | crt.sh |
| aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2020-07-09 - 2021-07-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://firebasestorage.googleapis.com/v0/b/guvs7w0d9yyeedg8e76te6e.appspot.com/o/536475869%3D%3Dr-f8tiu%2Fbase.html?alt=media&token=6fa413c7-5858-43ad-9111-17c0f62463a3
Frame ID: 9BE8EF6EF6A84C3E001FAB31D6ED0245
Requests: 6 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://adnanshafiq.com/wp-content/upgrade/oracle.php Page URL
- https://firebasestorage.googleapis.com/v0/b/guvs7w0d9yyeedg8e76te6e.appspot.com/o/536475869%3D%3Dr-f8tiu%2Fbase.htm... Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://www.cuny.edu/
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://adnanshafiq.com/wp-content/upgrade/oracle.php Page URL
- https://firebasestorage.googleapis.com/v0/b/guvs7w0d9yyeedg8e76te6e.appspot.com/o/536475869%3D%3Dr-f8tiu%2Fbase.html?alt=media&token=6fa413c7-5858-43ad-9111-17c0f62463a3 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
oracle.php
adnanshafiq.com/wp-content/upgrade/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
536475869%3D%3Dr-f8tiu%2Fbase.html
firebasestorage.googleapis.com/v0/b/guvs7w0d9yyeedg8e76te6e.appspot.com/o/ |
205 KB 206 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3-Q050 |
jquery-3.2.1.min.js
firebasestorage.googleapis.com/v0/b/guvs7w0d9yyeedg8e76te6e.appspot.com/o/jquery/ |
0 0 |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3-Q050 |
jquery.cookie.js
firebasestorage.googleapis.com/v0/b/guvs7w0d9yyeedg8e76te6e.appspot.com/o/jquery/ |
0 0 |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
141 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| submitCheck function| omitDomain function| firstchar function| onLoadFun0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
adnanshafiq.com
firebasestorage.googleapis.com
152.199.23.37
2a00:1450:4001:81d::200a
66.96.147.115
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
2423f5c87592a2d179ed32b8187bd39adac1e50c3768a27772399c5a735b77ee
291bb9375afaf6c96e2eb2b61f2ea9aa3559d05bb8e15cab49e68276d3082dff
838e4507b19cf8de508ff993c0fae6e2312a636fec7b43f916099eca11d5d5dc