firebasestorage.googleapis.com Open in urlscan Pro
2a00:1450:4001:817::200a  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request owa%2Findex2isq.html Show response firebasestorage.googleapis.com/v0/b/isqs-88b9c.appspot.com/o/	9 KB 10 KB	1093ms 1072ms	Document text/html	2a00:1450:4001:817::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://firebasestorage.googleapis.com/v0/b/isqs-88b9c.appspot.com/o/owa%2Findex2isq.html?alt=media&token=ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash 2b2e68bad6c524c7ace2945cd5569c0c5ca6c0f86402c7c1ccccfc6a97689b0f Request headers :method GET :authority firebasestorage.googleapis.com :scheme https :path /v0/b/isqs-88b9c.appspot.com/o/owa%2Findex2isq.html?alt=media&token=ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-guploader-uploadid ABg5-UwEwTvYigOEJqLa-sToyS9TKHMPYWhzcFfk1Dm1-T3nQo97oYXdg0dBOsD3sUAMwVfnU_fvj6k2sRFeKkuwl70 expires Wed, 02 Dec 2020 01:18:43 GMT date Wed, 02 Dec 2020 01:18:43 GMT cache-control private, max-age=0 last-modified Tue, 17 Nov 2020 10:16:18 GMT etag "31f1d3893431db0c5a8c4be15862d555" x-goog-generation 1605608178687295 x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-stored-content-length 9347 x-goog-meta-firebasestoragedownloadtokens ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 content-type text/html content-disposition inline; filename*=utf-8''index2isq.html x-goog-hash crc32c=b4KzRQ== md5=MfHTiTQx2wxajEvhWGLVVQ== x-goog-storage-class STANDARD accept-ranges bytes content-length 9347 server UploadServer alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	jquery.min.js Show response ajax.googleapis.luchifab.com/ajax.googleapis/ajax/libs/jquery/2.2.4/	87 KB 30 KB	1098ms 303ms	Script application/javascript	198.54.120.22 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.luchifab.com/ajax.googleapis/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: firebasestorage.googleapis.com URL: https://firebasestorage.googleapis.com/v0/b/isqs-88b9c.appspot.com/o/owa%2Findex2isq.html?alt=media&token=ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.120.22 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS host17.registrar-servers.com Software Apache / Resource Hash 646dcbdc20504bf2a5adb20697295592a73aaec2419836d036d62db09c026af9 Request headers Referer https://firebasestorage.googleapis.com/v0/b/isqs-88b9c.appspot.com/o/owa%2Findex2isq.html?alt=media&token=ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Dec 2020 01:18:44 GMT content-encoding gzip last-modified Thu, 12 Nov 2020 18:06:39 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 30912
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 14 KB	10ms 8ms	Script text/javascript	2001:4de0:ac19::1:b:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: firebasestorage.googleapis.com URL: https://firebasestorage.googleapis.com/v0/b/isqs-88b9c.appspot.com/o/owa%2Findex2isq.html?alt=media&token=ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://firebasestorage.googleapis.com/v0/b/isqs-88b9c.appspot.com/o/owa%2Findex2isq.html?alt=media&token=ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Dec 2020 01:18:43 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 12 Dec 2018 18:33:54 GMT etag "1544639634" vary Accept-Encoding x-cache HIT content-type text/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 14090
GET H2	200	outlook.jpg eurodisposabies.com/fireb/owa/files/	34 KB 35 KB	535ms 137ms	Image image/jpeg	174.136.57.7 AS-TIERP-36024
General Check archive.org Show headers Download Go to Show image Full URL https://eurodisposabies.com/fireb/owa/files/outlook.jpg Requested by Host: firebasestorage.googleapis.com URL: https://firebasestorage.googleapis.com/v0/b/isqs-88b9c.appspot.com/o/owa%2Findex2isq.html?alt=media&token=ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 174.136.57.7 , United States, ASN36024 (AS-TIERP-36024, US), Reverse DNS dragon.vivawebhost.com Software Apache mod_bwlimited/1.4 / Resource Hash a4c05900971341e294cdb44a28d41a939aa41b1f50368479d3d342814dcc4c42 Request headers Referer https://firebasestorage.googleapis.com/v0/b/isqs-88b9c.appspot.com/o/owa%2Findex2isq.html?alt=media&token=ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Dec 2020 01:18:44 GMT last-modified Mon, 07 Sep 2020 09:35:00 GMT server Apache mod_bwlimited/1.4 accept-ranges bytes etag "13a0b49-8908-5aeb5eeb47a00" content-length 35080 content-type image/jpeg
GET H2	200	signin.png eurodisposabies.com/fireb/owa/files/	1 KB 2 KB	530ms 137ms	Image image/png	174.136.57.7 AS-TIERP-36024
General Check archive.org Show headers Download Go to Show image Full URL https://eurodisposabies.com/fireb/owa/files/signin.png Requested by Host: firebasestorage.googleapis.com URL: https://firebasestorage.googleapis.com/v0/b/isqs-88b9c.appspot.com/o/owa%2Findex2isq.html?alt=media&token=ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 174.136.57.7 , United States, ASN36024 (AS-TIERP-36024, US), Reverse DNS dragon.vivawebhost.com Software Apache mod_bwlimited/1.4 / Resource Hash caf265b56613981b0c21dec4389877b9eb0dd8d12d876d9d1a99e3af56aa5963 Request headers Referer https://firebasestorage.googleapis.com/v0/b/isqs-88b9c.appspot.com/o/owa%2Findex2isq.html?alt=media&token=ebd4d89f-482a-4ce0-8d7b-980b8516a8d9 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Dec 2020 01:18:44 GMT last-modified Mon, 07 Sep 2020 09:35:00 GMT server Apache mod_bwlimited/1.4 accept-ranges bytes etag "13a0b4a-5d1-5aeb5eeb4d3d8" content-length 1489 content-type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| validate string| p2 object| _0x4f93 function| _0x21cf function| _0x476c66 function| $ function| jQuery object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.luchifab.com
eurodisposabies.com
firebasestorage.googleapis.com
stackpath.bootstrapcdn.com
174.136.57.7
198.54.120.22
2001:4de0:ac19::1:b:3b
2a00:1450:4001:817::200a
2b2e68bad6c524c7ace2945cd5569c0c5ca6c0f86402c7c1ccccfc6a97689b0f
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
646dcbdc20504bf2a5adb20697295592a73aaec2419836d036d62db09c026af9
a4c05900971341e294cdb44a28d41a939aa41b1f50368479d3d342814dcc4c42
caf265b56613981b0c21dec4389877b9eb0dd8d12d876d9d1a99e3af56aa5963