![](/screenshots/f71f759b-f68d-425b-8893-37af45c70892.png)
trust-update.firebaseapp.com
Open in
urlscan Pro
2620:0:890::100
Malicious Activity!
Public Scan
Submission: On February 17 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1D4 on January 17th 2024. Valid for: 3 months.
This is the only time trust-update.firebaseapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Trustwallet (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 2620:0:890::100 2620:0:890::100 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:830::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700::68... 2606:4700::6810:5614 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 3.76.180.210 3.76.180.210 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2001:67c:4e8:... 2001:67c:4e8:f004::9 | 62041 (TELEGRAM) (TELEGRAM) | |
19 | 6 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-76-180-210.eu-central-1.compute.amazonaws.com
api.ipdata.co |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
firebaseapp.com
trust-update.firebaseapp.com |
211 KB |
2 |
ipdata.co
api.ipdata.co — Cisco Umbrella Rank: 48661 |
2 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 353 |
26 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 48 ajax.googleapis.com — Cisco Umbrella Rank: 434 |
31 KB |
1 |
telegram.org
api.telegram.org — Cisco Umbrella Rank: 35900 |
1000 B |
19 | 5 |
Domain | Requested by | |
---|---|---|
12 | trust-update.firebaseapp.com |
trust-update.firebaseapp.com
|
2 | api.ipdata.co |
trust-update.firebaseapp.com
|
2 | cdn.jsdelivr.net |
trust-update.firebaseapp.com
|
1 | api.telegram.org |
trust-update.firebaseapp.com
|
1 | ajax.googleapis.com |
trust-update.firebaseapp.com
|
1 | fonts.googleapis.com |
trust-update.firebaseapp.com
|
19 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
firebaseapp.com GTS CA 1D4 |
2024-01-17 - 2024-04-16 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-01-29 - 2024-04-22 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
api.ipdata.co Amazon RSA 2048 M03 |
2023-09-22 - 2024-10-21 |
a year | crt.sh |
api.telegram.org Go Daddy Secure Certificate Authority - G2 |
2023-03-26 - 2024-04-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://trust-update.firebaseapp.com/
Frame ID: 7B7828B3C3E0BB8830CDBA7AC760AF84
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/f71f759b-f68d-425b-8893-37af45c70892.png)
Page Title
Unlock WalletDetected technologies
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
![](/vendor/wappa/icons/SweetAlert2.png)
Detected patterns
- /npm/sweetalert2@([\d.]+)
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
trust-update.firebaseapp.com/ |
64 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
28 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.1/ |
82 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
trust-update.firebaseapp.com/cs/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2@11
cdn.jsdelivr.net/npm/ |
75 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2.min.css
cdn.jsdelivr.net/npm/sweetalert2@11/dist/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
white.png
trust-update.firebaseapp.com/cs/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
menu.png
trust-update.firebaseapp.com/cs/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
trust-update.firebaseapp.com/cs/ |
4 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
download.png
trust-update.firebaseapp.com/cs/ |
88 KB 87 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blue.png
trust-update.firebaseapp.com/cs/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
media.png
trust-update.firebaseapp.com/cs/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xx.js
trust-update.firebaseapp.com/ |
145 KB 44 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bl.js
trust-update.firebaseapp.com/ |
67 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vu.js
trust-update.firebaseapp.com/ |
98 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipdata.co/ |
1 KB 975 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipdata.co/ |
1 KB 967 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bl.txt
trust-update.firebaseapp.com/ |
39 B 380 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
sendMessage
api.telegram.org/bot6962816831:AAFdHqA-T76vxt70vcVhjg9iLAIQCLxCr60/ |
753 B 1000 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Trustwallet (Crypto)37 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal function| _0xc2135e function| _0xe08d13 function| _0x21278e function| _0x50b8 function| sendToTelegram function| _0x1ba412 function| x1 function| _0x4143 function| sendToTelegram1 function| x2 function| _0x5985a7 function| _0x4395e0 function| _0x2a3c68 function| _0x333676 function| _0x265342 function| _0x4b7951 function| _0x575101 function| _0x510e22 function| _0x224110 function| _0x1c5e95 function| _0x54a2d4 function| _0x19cb function| _0x5301cf function| _0x3f7e function| _0x441950 function| _0x1444 function| sendTelegramMessage function| getVisitorInfo function| _0x147c function| _0x4431430 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipdata.co
api.telegram.org
cdn.jsdelivr.net
fonts.googleapis.com
trust-update.firebaseapp.com
2001:67c:4e8:f004::9
2606:4700::6810:5614
2620:0:890::100
2a00:1450:4001:81c::200a
2a00:1450:4001:830::200a
3.76.180.210
2812e9af40f1d35b46555ce7ec166f4329b0b4aa40fcab9cd86ae88a303a3e64
29d02689632a37fb7c63c45ed73b02b138640f75803a71be4709ba6e3fe5cc4c
2a7344e607a878f0acac7f5c9c3a65fc8a4423f00e21d3fb7a814cae051631d9
3ea87e3042b6eae1835b81200818ad42c35f3de73937f3254e9fe7aa5277eef0
622ea2a1aadc5013855dc2be296f4a9ba19f1814387b5088ad1174203a95d6b7
65e18c1b4a1ec5be2904445c50341250f7900789307b1f9b2e51c974a55583eb
7e5830490fed0bc3321b286f03f6861b595b7d193865cdb0c4c11dc1c6e13e35
7e7fd9f1e6fd2387dc2a5bb83cb72a1c44206347ad8ffde69bcab829cf88b1ff
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
8761a49fe1f7de59ca9504cd9ed4322d7316abbffd5c8dab94f0ac2ec55c501b
9e22a088e0e411a08e2e2b74910c43d476e941d7764209516eb8bfb389fd03c0
a41ce69fe9c5ac2933fd200010461b54e14045c77d1f78670dc42776aea0e915
abdc3d2794d84c57d704fe3984e41328117fc119912d82182ee606f9683814fd
ad036debc8d2f79bfa70de42bc34487a8d9f97eabeea3da65f8fa6056c7a164d
cdb0648aeb568ec593746429e003db5c603c3406cb8f3c9030f5e47ce4299364
d02f31fc0797c98f875e43139eab25d0f981f768d5e7cddda7cf1cc30258a13c
e59ef776c137f0ba48fd24ba17cbb33ffdd9d0e56430d54cbe1afa9a11990725
fb441ff081cc256b98959da540306b175fb66a28084595c4752bde82d10ba362