urlscan.io logo urlscan.io
SecurityTrails logo

firebasestorage.googleapis.com Open in urlscan Pro
216.58.212.170  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&e...
Submission: On October 17 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 216.58.212.170, located in Mountain View, United States and belongs to GOOGLE, US. The main domain is firebasestorage.googleapis.com.
TLS certificate: Issued by GTS CA 1C3 on September 13th 2021. Valid for: 2 months.
This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
4 216.58.212.170 15169 (GOOGLE)
6 2
Apex Domain
Subdomains		 Transfer
4 googleapis.com
firebasestorage.googleapis.com
ajax.googleapis.com Failed
34 KB
0 cloudflare.com Failed
cdnjs.cloudflare.com Failed
6 2
Domain Requested by
4 firebasestorage.googleapis.com firebasestorage.googleapis.com
0 ajax.googleapis.com Failed firebasestorage.googleapis.com
0 cdnjs.cloudflare.com Failed firebasestorage.googleapis.com
6 3

This site contains no links.

Subject Issuer Validity Valid
upload.video.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh

This page contains 1 frames:

Primary Page: https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
Frame ID: 81B7CB88F1CB86B226C4459A42A663AE
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Email

Page Statistics

6
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

1
Countries

34 kB
Transfer

32 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request zinc.html
firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/ 		27 KB
28 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.170 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f170.1e100.net
Software
UploadServer /
Resource Hash
26a6793b2949232a005f74245f7920c95f3c45c7f5ad5133feeb16c4f82ff110

Request headers

:method
GET
:authority
firebasestorage.googleapis.com
:scheme
https
:path
/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

x-guploader-uploadid
ADPycdtPtiyi4ojy4_Fu1YKpEBSj1DOMXo2yJ1LqUiO7pxCz8HKMO06N4ufapxdqG9PP-smJqsArIfYusKKhKOqTvkgetc6oTQ
expires
Sun, 17 Oct 2021 02:11:43 GMT
date
Sun, 17 Oct 2021 02:11:43 GMT
cache-control
private, max-age=0
last-modified
Mon, 11 Oct 2021 18:54:36 GMT
etag
"243a864530fe7c35ab8a233868e3be66"
x-goog-generation
1633978475981443
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
27616
x-goog-meta-firebasestoragedownloadtokens
6a89123d-9d90-40b1-9672-f8f6f7b4489d
content-type
text/html
content-disposition
inline; filename*=utf-8''zinc.html
x-goog-hash
crc32c=vCgkiQ== md5=JDqGRTD+fDWriiM4aOO+Zg==
x-goog-storage-class
STANDARD
accept-ranges
bytes
content-length
27616
server
UploadServer
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
default.css
firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/ 		5 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/default.css?alt=media&token=3d37f8c2-ee04-497d-b3b5-b115a7a7ec18
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.170 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f170.1e100.net
Software
UploadServer /
Resource Hash
6813b94c54b35cf87723ee6977925d5d4e06b4ed19ef1394128ea8cc0de45bf5

Request headers

:path
/v0/b/testalb-cdd27.appspot.com/o/default.css?alt=media&token=3d37f8c2-ee04-497d-b3b5-b115a7a7ec18
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
firebasestorage.googleapis.com
referer
https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 17 Oct 2021 02:11:44 GMT
x-guploader-uploadid
ADPycduimpaF9bnh6mJgkJT51nwg1E6vw7CsFv5N4ekj0hXXtfAwjPUKxpCBCDnxx4PicJP25xBlCzO9NMxA2eJZMJ9aTiWKYQ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''default.css
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4999
last-modified
Wed, 17 Jun 2020 21:38:35 GMT
server
UploadServer
etag
"025d6fb92359fac6079bdd315c74e869"
x-goog-hash
crc32c=4AM/FA== md5=Al1vuSNZ+sYHm90xXHToaQ==
x-goog-generation
1592429915791586
cache-control
private, max-age=0
x-goog-stored-content-length
4999
x-goog-meta-firebasestoragedownloadtokens
3d37f8c2-ee04-497d-b3b5-b115a7a7ec18
accept-ranges
bytes
content-type
text/css
expires
Sun, 17 Oct 2021 02:11:44 GMT
dummy.gif
firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/ 		43 B
392 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/dummy.gif?alt=media&token=0172bc57-8b43-45af-ae46-b7d4a3af8ed4
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.170 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f170.1e100.net
Software
UploadServer /
Resource Hash
42cb846e07917f6731406e500f24aeb2e88c42cda124eaa59e08c5331cad8bcb

Request headers

:path
/v0/b/testalb-cdd27.appspot.com/o/dummy.gif?alt=media&token=0172bc57-8b43-45af-ae46-b7d4a3af8ed4
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
firebasestorage.googleapis.com
referer
https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 17 Oct 2021 02:11:44 GMT
x-guploader-uploadid
ADPycdthSxLtzYB_zBY6BldIcr7uZWG_VxNybmJoGexwvDyKMVQicIZbeRDBGuZUQ-80U05TiNBR752oEPkl-sDVW-ogE-UaTg
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''dummy.gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
last-modified
Wed, 17 Jun 2020 21:34:22 GMT
server
UploadServer
etag
"ba036c43037cfe89320d1ef7b64cd43f"
x-goog-hash
crc32c=o+U7Rg== md5=ugNsQwN8/okyDR73tkzUPw==
x-goog-generation
1592429662664513
cache-control
private, max-age=0
x-goog-stored-content-length
43
x-goog-meta-firebasestoragedownloadtokens
0172bc57-8b43-45af-ae46-b7d4a3af8ed4
accept-ranges
bytes
content-type
image/gif
expires
Sun, 17 Oct 2021 02:11:44 GMT
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ 		0
0
jquery-ui.min.js
ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/ 		0
0
logo.png
firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/ 		530 B
558 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/logo.png?alt=media&token=b7db4473-01db-4af6-a019-c75e365df33a
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/default.css?alt=media&token=3d37f8c2-ee04-497d-b3b5-b115a7a7ec18
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.170 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f170.1e100.net
Software
UploadServer /
Resource Hash
f26b36cd855ffd001fdd3ee4e9cee7f5f0691f110c4f3928c520723b72e07c82

Request headers

:path
/v0/b/testalb-cdd27.appspot.com/o/logo.png?alt=media&token=b7db4473-01db-4af6-a019-c75e365df33a
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
firebasestorage.googleapis.com
referer
https://firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/default.css?alt=media&token=3d37f8c2-ee04-497d-b3b5-b115a7a7ec18
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/default.css?alt=media&token=3d37f8c2-ee04-497d-b3b5-b115a7a7ec18
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 17 Oct 2021 02:11:45 GMT
x-guploader-uploadid
ADPycdsnH8jslJW-VRMBedwpPskvbnRP43cCP6PuhHaBy39ZLrNsTx-qTQw5e9lwiVgoIwx2LxLU1OiRUN7mRnEdr2baSrzrlg
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''logo.png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
530
last-modified
Wed, 17 Jun 2020 21:34:22 GMT
server
UploadServer
etag
"5a90ec658fd051866c9c51791875c659"
x-goog-hash
crc32c=bHtIPQ== md5=WpDsZY/QUYZsnFF5GHXGWQ==
x-goog-generation
1592429662646326
cache-control
private, max-age=0
x-goog-stored-content-length
530
x-goog-meta-firebasestoragedownloadtokens
b7db4473-01db-4af6-a019-c75e365df33a
accept-ranges
bytes
content-type
image/png
expires
Sun, 17 Oct 2021 02:11:45 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cdnjs.cloudflare.com
URL
http://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
Domain
ajax.googleapis.com
URL
http://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster string| email string| input object| fields string| a object| d

0 Cookies

2 Console Messages

Source Level URL
Text
security error URL: https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
Message:
Mixed Content: The page at 'https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com' was loaded over HTTPS, but requested an insecure script 'http://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com
Message:
Mixed Content: The page at 'https://firebasestorage.googleapis.com/v0/b/portal-18d4e.appspot.com/o/zinc.html?alt=media&token=6a89123d-9d90-40b1-9672-f8f6f7b4489d&email=jacken@soupro.com' was loaded over HTTPS, but requested an insecure script 'http://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js'. This request has been blocked; the content must be served over HTTPS.