urlscan.io logo urlscan.io
SecurityTrails logo

firebasestorage.googleapis.com Open in urlscan Pro
2607:f8b0:4004:c07::5f  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://storage.googleapis.com/357f8099ab9d6b0250ac09accb6a18611d9641915fb33973813895433852/fa5678f4f77ecf26b8e4dcf2be2843
Effective URL: https://firebasestorage.googleapis.com/v0/b/ot-352.appspot.com/o/922big.html?alt=media&token=b4af9795-ad25-4e3e-a8c1-f67dfbb3f901
Submission: On April 15 via manual from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 2607:f8b0:4004:c07::5f, located in Washington, United States and belongs to GOOGLE, US. The main domain is firebasestorage.googleapis.com. The Cisco Umbrella rank of the primary domain is 6225.
TLS certificate: Issued by GTS CA 1C3 on March 28th 2023. Valid for: 3 months.
This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
1 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
4 2a04:4e42:79:... 54113 (FASTLY)
6 3
Apex Domain
Subdomains		 Transfer
4 twimg.com
pbs.twimg.com — Cisco Umbrella Rank: 822
358 KB
2 googleapis.com
storage.googleapis.com — Cisco Umbrella Rank: 411
firebasestorage.googleapis.com — Cisco Umbrella Rank: 6225
9 KB
6 2
Domain Requested by
4 pbs.twimg.com firebasestorage.googleapis.com
1 firebasestorage.googleapis.com storage.googleapis.com
1 storage.googleapis.com
6 3

This site contains links to these domains. Also see Links.

Domain
hoooolllllliknkioisboiko.page.link
Subject Issuer Validity Valid
storage.googleapis.com
GTS CA 1C3		 2023-03-28 -
2023-06-20		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-03-28 -
2023-06-20		 3 months crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-21 -
2023-08-21		 a year crt.sh

This page contains 1 frames:

Primary Page: https://firebasestorage.googleapis.com/v0/b/ot-352.appspot.com/o/922big.html?alt=media&token=b4af9795-ad25-4e3e-a8c1-f67dfbb3f901
Frame ID: 5FFDD6F4A051F948FE617D0715E000F3
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

<a moz-do-not-send="true" href="https://hoooolllllliknkioisboiko.page.link/2eWh">Ring Video Doorbell</a>

Page URL History Show full URLs

  1. https://storage.googleapis.com/357f8099ab9d6b0250ac09accb6a18611d9641915fb33973813895433852/fa5678f4f77ecf2... Page URL
  2. https://firebasestorage.googleapis.com/v0/b/ot-352.appspot.com/o/922big.html?alt=media&token=b4af9795-ad25-4e3e-a8c... Page URL

Page Statistics

6
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

367 kB
Transfer

365 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://storage.googleapis.com/357f8099ab9d6b0250ac09accb6a18611d9641915fb33973813895433852/fa5678f4f77ecf26b8e4dcf2be2843 Page URL
  2. https://firebasestorage.googleapis.com/v0/b/ot-352.appspot.com/o/922big.html?alt=media&token=b4af9795-ad25-4e3e-a8c1-f67dfbb3f901 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
fa5678f4f77ecf26b8e4dcf2be2843
storage.googleapis.com/357f8099ab9d6b0250ac09accb6a18611d9641915fb33973813895433852/ 		210 B
697 B 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/357f8099ab9d6b0250ac09accb6a18611d9641915fb33973813895433852/fa5678f4f77ecf26b8e4dcf2be2843
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:808::2010 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3600
content-length
210
content-type
text/html
date
Sat, 15 Apr 2023 14:28:53 GMT
etag
"c2b97da628872b37fa4ca9603e8f9a46"
expires
Sat, 15 Apr 2023 15:28:53 GMT
last-modified
Sat, 15 Apr 2023 10:31:16 GMT
server
UploadServer
x-goog-generation
1681554675978793
x-goog-hash
crc32c=NRKqTA== md5=wrl9piiHKzf6TKlgPo+aRg==
x-goog-metageneration
2
x-goog-storage-class
STANDARD
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
210
x-guploader-uploadid
ADPycdtoLOe7pWEnUNof_F6MCSW2cDSNQIt-_eqZbgj5Jf0t9UHSOQ2T5tomrUAvUFSGx1o95YnRNhteorPzhAQ0wnpKPz6ExzB0
Primary Request 922big.html
firebasestorage.googleapis.com/v0/b/ot-352.appspot.com/o/ 		8 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://firebasestorage.googleapis.com/v0/b/ot-352.appspot.com/o/922big.html?alt=media&token=b4af9795-ad25-4e3e-a8c1-f67dfbb3f901
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/357f8099ab9d6b0250ac09accb6a18611d9641915fb33973813895433852/fa5678f4f77ecf26b8e4dcf2be2843
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c07::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
744a9c7ae4255b0335c81a30cfac4e9984183387e0239c73c9202b44ac7fd585

Request headers

Referer
https://storage.googleapis.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-disposition
inline; filename*=utf-8''922big.html
content-length
8054
content-type
text/html
date
Sat, 15 Apr 2023 14:28:54 GMT
etag
"0a5c73f48a2947c5dd91cd8abef9e52a"
expires
Sat, 15 Apr 2023 14:28:54 GMT
last-modified
Fri, 14 Apr 2023 15:29:06 GMT
server
UploadServer
x-goog-generation
1681486146792109
x-goog-hash
crc32c=g5tsgg== md5=Clxz9IopR8Xdkc2KvvnlKg==
x-goog-meta-firebasestoragedownloadtokens
b4af9795-ad25-4e3e-a8c1-f67dfbb3f901
x-goog-metageneration
1
x-goog-storage-class
STANDARD
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
8054
x-guploader-uploadid
ADPycdtNe2YfBRPlYOfv7M5o0Gw_m1wPQ_Wm-yx898atn4oGH1WECs8zyJmUmbCv0iACWOoNYQKVWe2x7RC7kBp5i69fQQ
FtlrA8iXsAAtRTF
pbs.twimg.com/media/ 		102 KB
102 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FtlrA8iXsAAtRTF?format=png&name=360x360
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/ot-352.appspot.com/o/922big.html?alt=media&token=b4af9795-ad25-4e3e-a8c1-f67dfbb3f901
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:79::159 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
dc139ca37e5d036b622b919b2c3866ccd7b4c90ba468458ae6d313877e55c870
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
date
Sat, 15 Apr 2023 14:28:54 GMT
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
content-length
104609
x-served-by
cache-fty21344-FTY, cache-iad-kcgs7200069-IAD, cache-tw-ZZZ1
last-modified
Thu, 13 Apr 2023 10:44:13 GMT
x-tw-cdn
FT
content-type
image/png
access-control-allow-origin
*
x-transaction-id
9333332ab761aeed
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
FtlrF_4XsAAygTr
pbs.twimg.com/media/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FtlrF_4XsAAygTr?format=png&name=small
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/ot-352.appspot.com/o/922big.html?alt=media&token=b4af9795-ad25-4e3e-a8c1-f67dfbb3f901
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:79::159 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3f9737facf2f00a5a3284f7acd92d5131e6294d7e51e528f60d785b30cee07ef
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
date
Sat, 15 Apr 2023 14:28:54 GMT
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
content-length
10377
x-served-by
cache-fty21377-FTY, cache-iad-kcgs7200069-IAD, cache-tw-ZZZ1
last-modified
Thu, 13 Apr 2023 10:44:34 GMT
x-tw-cdn
FT
content-type
image/png
access-control-allow-origin
*
x-transaction-id
0eb1722e0f3f7f01
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
FtlrMf-XsAIJfG5
pbs.twimg.com/media/ 		109 KB
109 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FtlrMf-XsAIJfG5?format=png&name=900x900
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/ot-352.appspot.com/o/922big.html?alt=media&token=b4af9795-ad25-4e3e-a8c1-f67dfbb3f901
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:79::159 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fbcc40efcdf571723fbbe35a63bc681ad6eb0a1c61586cdbeac06db56bc633bb
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
date
Sat, 15 Apr 2023 14:28:54 GMT
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
content-length
111344
x-served-by
cache-fty21338-FTY, cache-iad-kcgs7200069-IAD, cache-tw-ZZZ1
last-modified
Thu, 13 Apr 2023 10:45:00 GMT
x-tw-cdn
FT
content-type
image/png
access-control-allow-origin
*
x-transaction-id
ea3f3ef7f1856ff7
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
Ftlq7CAWwAU9Gj8
pbs.twimg.com/media/ 		136 KB
136 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/Ftlq7CAWwAU9Gj8?format=png&name=900x900
Requested by
Host: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/ot-352.appspot.com/o/922big.html?alt=media&token=b4af9795-ad25-4e3e-a8c1-f67dfbb3f901
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:79::159 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1860c3fd94839525af730836df29ef2a290578901bcd054a59f3673b7826676d
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://firebasestorage.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
date
Sat, 15 Apr 2023 14:28:54 GMT
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
content-length
139505
x-served-by
cache-fty21359-FTY, cache-iad-kcgs7200069-IAD, cache-tw-ZZZ1
last-modified
Thu, 13 Apr 2023 10:43:49 GMT
x-tw-cdn
FT
content-type
image/png
access-control-allow-origin
*
x-transaction-id
e724f3e82e2cb290
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com

Verdicts & Comments Add Verdict or Comment

Malicious page.url
Submitted on April 15th 2023, 2:32:07 pm UTC — From United States

Threats: Scam Brand Impersonation
Brands: Customer Survey Spam US
Comment: Phishing email received that leads to customer survey spam website.

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies