urlscan.io logo urlscan.io
SecurityTrails logo

firebasestorage.googleapis.com Open in urlscan Pro
2a00:1450:4001:81c::200a  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://mullerworkcreations.com/guardindustry.hu//redirect.php
Effective URL: https://firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61-a9a6-950281f6931e&e...
Submission: On July 02 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 2a00:1450:4001:81c::200a, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is firebasestorage.googleapis.com.
TLS certificate: Issued by GTS CA 1O1 on June 17th 2020. Valid for: 3 months.
This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 193.39.12.223 62214 (RACKFORES...)
4 2a00:1450:400... 15169 (GOOGLE)
7 3
Domain Requested by
4 firebasestorage.googleapis.com firebasestorage.googleapis.com
1 mullerworkcreations.com
0 ajax.googleapis.com Failed firebasestorage.googleapis.com
0 cdnjs.cloudflare.com Failed firebasestorage.googleapis.com
7 4

This site contains no links.

Subject Issuer Validity Valid
mullerworkcreations.com
cPanel, Inc. Certification Authority		 2020-05-12 -
2020-08-10		 3 months crt.sh
upload.video.google.com
GTS CA 1O1		 2020-06-17 -
2020-09-09		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61-a9a6-950281f6931e&email=&domain=&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Frame ID: 71B0C84B42232C7DF35A792190C52AEB
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://mullerworkcreations.com/guardindustry.hu//redirect.php Page URL
  2. https://firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
  • script /([\d.]+)\/jquery-ui(?:\.min)?\.js/i
  • script /jquery-ui.*\.js/i
Overall confidence: 100%
Detected patterns
  • script /([\d.]+)\/jquery-ui(?:\.min)?\.js/i
  • script /jquery-ui.*\.js/i

Page Statistics

7
Requests

71 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

34 kB
Transfer

33 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://mullerworkcreations.com/guardindustry.hu//redirect.php Page URL
  2. https://firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61-a9a6-950281f6931e&email=&domain=&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
redirect.php
mullerworkcreations.com/guardindustry.hu// 		254 B
413 B 		Document
General
Check archive.org
Download Go to
Full URL
https://mullerworkcreations.com/guardindustry.hu//redirect.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.39.12.223 , Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS
cp.webtag.hu
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
mullerworkcreations.com
:scheme
https
:path
/guardindustry.hu//redirect.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
nginx
date
Thu, 02 Jul 2020 19:22:10 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-nginx-cache-status
EXPIRED
x-server-powered-by
Engintron
content-encoding
gzip
Primary Request web.html
firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/ 		27 KB
28 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61-a9a6-950281f6931e&email=&domain=&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
c6c024a5f11a810c544e2554d3e1c8d540118cdd9e75d33b84c4c0668bc90aad

Request headers

:method
GET
:authority
firebasestorage.googleapis.com
:scheme
https
:path
/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61-a9a6-950281f6931e&email=&domain=&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://mullerworkcreations.com/guardindustry.hu//redirect.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://mullerworkcreations.com/guardindustry.hu//redirect.php

Response headers

status
200
x-guploader-uploadid
AAANsUnMvOqOZtM-zOD6vE7jJDaUTmWiU3QR9s3TzHGBENJp-LGaO5-N1iaoTUGhNXI-tLqxFCwlBWTmecOsnmtTrlo
expires
Thu, 02 Jul 2020 19:22:11 GMT
date
Thu, 02 Jul 2020 19:22:11 GMT
cache-control
private, max-age=0
last-modified
Tue, 30 Jun 2020 09:30:00 GMT
etag
"0726ac191219397b7268f782213b66dc"
x-goog-generation
1593509400099433
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
27516
x-goog-meta-firebasestoragedownloadtokens
bafabe93-81b2-4e61-a9a6-950281f6931e
content-type
text/html
content-disposition
inline; filename*=utf-8''web.html
x-goog-hash
crc32c=v1NwGg== md5=ByasGRIZOXtyaPeCITtm3A==
x-goog-storage-class
STANDARD
accept-ranges
bytes
content-length
27516
server
UploadServer
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
default.css
firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/ 		5 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/default.css?alt=media&token=3d37f8c2-ee04-497d-b3b5-b115a7a7ec18
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61-a9a6-950281f6931e&email=&domain=&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
6813b94c54b35cf87723ee6977925d5d4e06b4ed19ef1394128ea8cc0de45bf5

Request headers

Referer
https://firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61-a9a6-950281f6931e&email=&domain=&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 02 Jul 2020 19:22:11 GMT
x-guploader-uploadid
AAANsUnDI7R8aIcxX_HVX4AOvNnNoTgRzcwBV9Gh32jDUo-7twHgp9HAVk-c32v8Z1tZbcauh6jvGWLNvAFYWIhB8OY
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''default.css
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4999
last-modified
Wed, 17 Jun 2020 21:38:35 GMT
server
UploadServer
etag
"025d6fb92359fac6079bdd315c74e869"
x-goog-hash
crc32c=4AM/FA==, md5=Al1vuSNZ+sYHm90xXHToaQ==
x-goog-generation
1592429915791586
cache-control
private, max-age=0
x-goog-stored-content-length
4999
x-goog-meta-firebasestoragedownloadtokens
3d37f8c2-ee04-497d-b3b5-b115a7a7ec18
accept-ranges
bytes
content-type
text/css
expires
Thu, 02 Jul 2020 19:22:11 GMT
dummy.gif
firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/ 		43 B
363 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/dummy.gif?alt=media&token=0172bc57-8b43-45af-ae46-b7d4a3af8ed4
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61-a9a6-950281f6931e&email=&domain=&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
42cb846e07917f6731406e500f24aeb2e88c42cda124eaa59e08c5331cad8bcb

Request headers

Referer
https://firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61-a9a6-950281f6931e&email=&domain=&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 02 Jul 2020 19:22:11 GMT
x-guploader-uploadid
AAANsUmlL93wSe3iPxBp3xTPf28onpzUAbuchKPGW3y3_76dGUaX0C-jwkRRg9swqfWGRby1MTP2l5MMwWKotxFQgJI
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''dummy.gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
last-modified
Wed, 17 Jun 2020 21:34:22 GMT
server
UploadServer
etag
"ba036c43037cfe89320d1ef7b64cd43f"
x-goog-hash
crc32c=o+U7Rg==, md5=ugNsQwN8/okyDR73tkzUPw==
x-goog-generation
1592429662664513
cache-control
private, max-age=0
x-goog-stored-content-length
43
x-goog-meta-firebasestoragedownloadtokens
0172bc57-8b43-45af-ae46-b7d4a3af8ed4
accept-ranges
bytes
content-type
image/gif
expires
Thu, 02 Jul 2020 19:22:11 GMT
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ 		0
0
jquery-ui.min.js
ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/ 		0
0
logo.png
firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/ 		530 B
853 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/logo.png?alt=media&token=b7db4473-01db-4af6-a019-c75e365df33a
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/datainc-b46b5.appspot.com/o/web.html?alt=media&token=bafabe93-81b2-4e61-a9a6-950281f6931e&email=&domain=&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
f26b36cd855ffd001fdd3ee4e9cee7f5f0691f110c4f3928c520723b72e07c82

Request headers

Referer
https://firebasestorage.googleapis.com/v0/b/testalb-cdd27.appspot.com/o/default.css?alt=media&token=3d37f8c2-ee04-497d-b3b5-b115a7a7ec18
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 02 Jul 2020 19:22:12 GMT
x-guploader-uploadid
AAANsUmPXIQoLZAqXTJzG3NVYGwPMdG2obGZ7l8-mKnMH_34CwhnJOaWpkCXagxZgRjAMY-x_0-m-lNYBtf976l9CjI
x-goog-storage-class
STANDARD
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''logo.png
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
530
last-modified
Wed, 17 Jun 2020 21:34:22 GMT
server
UploadServer
etag
"5a90ec658fd051866c9c51791875c659"
x-goog-hash
crc32c=bHtIPQ==, md5=WpDsZY/QUYZsnFF5GHXGWQ==
x-goog-generation
1592429662646326
cache-control
private, max-age=0
x-goog-stored-content-length
530
x-goog-meta-firebasestoragedownloadtokens
b7db4473-01db-4af6-a019-c75e365df33a
accept-ranges
bytes
content-type
image/png
expires
Thu, 02 Jul 2020 19:22:12 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cdnjs.cloudflare.com
URL
http://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
Domain
ajax.googleapis.com
URL
http://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| email string| input object| fields string| a object| d

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block