firebasestorage.googleapis.com

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 2a00:1450:4001:821::200a, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is firebasestorage.googleapis.com.
TLS certificate: Issued by GTS CA 1O1 on May 26th 2020. Valid for: 3 months.

This is the only time firebasestorage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:400... 2a00:1450:4001:821::200a	15169 (GOOGLE) (GOOGLE)
1	23.111.137.178 23.111.137.178	29802 (HVC-AS) (HVC-AS)
1	2606:4700:303... 2606:4700:3036::6812:2b8e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.189.108.75 35.189.108.75	15169 (GOOGLE) (GOOGLE)
4	5

1 2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

firebasestorage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.137.178 (Tampa, United States)

ASN29802 (HVC-AS, US)
PTR: onitsha.syskay.com

moneyissues.ng	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::6812:2b8e (United States)

ASN13335 (CLOUDFLARENET, US)

static.businessworld.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.189.108.75 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 75.108.189.35.bc.googleusercontent.com

edelivery.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	edelivery.net edelivery.net	49 KB
1	businessworld.in static.businessworld.in	188 KB
1	moneyissues.ng moneyissues.ng	148 KB
1	googleapis.com firebasestorage.googleapis.com	16 KB
4	4

	Domain	Requested by
1	edelivery.net	firebasestorage.googleapis.com
1	static.businessworld.in	firebasestorage.googleapis.com
1	moneyissues.ng	firebasestorage.googleapis.com
1	firebasestorage.googleapis.com
4	4

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
moneyissues.ng cPanel, Inc. Certification Authority	`2020-05-19` - `2020-08-17`	3 months	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-03-03` - `2020-10-09`	7 months	crt.sh
edelivery.net Let's Encrypt Authority X3	`2020-06-09` - `2020-09-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://firebasestorage.googleapis.com/v0/b/dhl-f-f7200.appspot.com/o/dhltrack.html?alt=media&token=da00e5b3-2023-46f9-95af-e9d6fea5f933
Frame ID: EF4558D382170ED94CB660ADCC17CA1A
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

401 kB
Transfer

406 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request dhltrack.html Show response firebasestorage.googleapis.com/v0/b/dhl-f-f7200.appspot.com/o/	16 KB 16 KB	556ms 536ms	Document text/html	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://firebasestorage.googleapis.com/v0/b/dhl-f-f7200.appspot.com/o/dhltrack.html?alt=media&token=da00e5b3-2023-46f9-95af-e9d6fea5f933 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash `1455a2b9cd25d5e9a31e18e11bddfc928b07a87b52e8d223d8ddf645584a342f` Request headers :method GET :authority firebasestorage.googleapis.com :scheme https :path /v0/b/dhl-f-f7200.appspot.com/o/dhltrack.html?alt=media&token=da00e5b3-2023-46f9-95af-e9d6fea5f933 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 x-guploader-uploadid AAANsUmDzYgz7IOxmCs5HBOcSsCrv-mN52-5I4cNXyD21tiG51Bb0Dm0qTzIWpYInbwkeT0Yc2mjL2ceGzS5oSUbpg expires Tue, 16 Jun 2020 07:42:34 GMT date Tue, 16 Jun 2020 07:42:34 GMT cache-control private, max-age=0 last-modified Mon, 15 Jun 2020 09:24:03 GMT etag "e17caea6e35d7812c342ef12cb50137d" x-goog-generation 1592213043779655 x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-stored-content-length 16039 x-goog-meta-firebasestoragedownloadtokens da00e5b3-2023-46f9-95af-e9d6fea5f933 content-type text/html content-disposition inline; filename=utf-8''dhltrack.html x-goog-hash* crc32c=jn7UHA== md5=4XyupuNdeBLDQu8Sy1ATfQ== x-goog-storage-class STANDARD accept-ranges bytes content-length 16039 server UploadServer alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H/1.1	200 OK	DHL-LOGO.jpg moneyissues.ng/wp-content/uploads/2017/10/	147 KB 148 KB	510ms 130ms	Image image/jpeg	23.111.137.178 HVC-AS
General Check archive.org Show headers Download Go to Show image Full URL https://moneyissues.ng/wp-content/uploads/2017/10/DHL-LOGO.jpg Requested by Host: firebasestorage.googleapis.com URL: https://firebasestorage.googleapis.com/v0/b/dhl-f-f7200.appspot.com/o/dhltrack.html?alt=media&token=da00e5b3-2023-46f9-95af-e9d6fea5f933 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.111.137.178 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS onitsha.syskay.com Software Apache / Resource Hash `d330843eabc3d779c21870769f43515137ffef8e0465862e31e1f43d0843aead` Request headers Referer https://firebasestorage.googleapis.com/v0/b/dhl-f-f7200.appspot.com/o/dhltrack.html?alt=media&token=da00e5b3-2023-46f9-95af-e9d6fea5f933 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 16 Jun 2020 07:42:35 GMT Last-Modified Mon, 09 Oct 2017 13:36:32 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 151005
GET H2	200	1493047371_qSXqU0_dhl.jpg static.businessworld.in/article/article_extra_large_image/	187 KB 188 KB	64ms 21ms	Image image/jpeg	2606:4700:3036::6812:2b8e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://static.businessworld.in/article/article_extra_large_image/1493047371_qSXqU0_dhl.jpg Requested by Host: firebasestorage.googleapis.com URL: https://firebasestorage.googleapis.com/v0/b/dhl-f-f7200.appspot.com/o/dhltrack.html?alt=media&token=da00e5b3-2023-46f9-95af-e9d6fea5f933 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:3036::6812:2b8e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `610d2709b5c9837526af5693d5d84e742242f780e415332877c55e4bfb4f22aa` Request headers Referer https://firebasestorage.googleapis.com/v0/b/dhl-f-f7200.appspot.com/o/dhltrack.html?alt=media&token=da00e5b3-2023-46f9-95af-e9d6fea5f933 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 16 Jun 2020 07:42:34 GMT cf-cache-status HIT age 6409 cf-ray 5a42e5191b52c79d-AMS status 200 content-length 191332 x-amz-id-2 ztM4B0ukgqlww32h9FJR8NIgjBPiD1BqVc+O+sJfQ3zJ62ETqwcyxavJBTMmgDP+4jBX9nx8C9A= last-modified Fri, 01 Dec 2017 10:26:01 GMT server cloudflare etag "12ebe3bbe8505c6852e5dd834cadeaef" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-amz-request-id 52F273ABADA7F070 cache-control max-age=14400 cf-request-id 035dad83ae0000c79d84ab8200000001 accept-ranges bytes content-type image/jpeg
GET H2	200	4170017974.jpg edelivery.net/files/cache/2018/09/dhl-parcel-ch-1592x896_web__796_448/	49 KB 49 KB	92ms 25ms	Image image/jpeg	35.189.108.75 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://edelivery.net/files/cache/2018/09/dhl-parcel-ch-1592x896_web__796_448/4170017974.jpg Requested by Host: firebasestorage.googleapis.com URL: https://firebasestorage.googleapis.com/v0/b/dhl-f-f7200.appspot.com/o/dhltrack.html?alt=media&token=da00e5b3-2023-46f9-95af-e9d6fea5f933 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.189.108.75 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 75.108.189.35.bc.googleusercontent.com Software nginx / Resource Hash `2d607e1847502f60fb08c471012ccfb1e22d3c6a0535588b7ca49c257e693bfc` Request headers Referer https://firebasestorage.googleapis.com/v0/b/dhl-f-f7200.appspot.com/o/dhltrack.html?alt=media&token=da00e5b3-2023-46f9-95af-e9d6fea5f933 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 16 Jun 2020 07:42:34 GMT last-modified Mon, 03 Sep 2018 14:11:52 GMT server nginx status 200 etag "5b8d4128-c385" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 50053
GET DATA	200 OK	truncated /	7 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8d5bf31102d6c0c10b3c4211f6f7dede7d98df39d462df9eb93d8356a05c6476` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| modal

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

edelivery.net
firebasestorage.googleapis.com
moneyissues.ng
static.businessworld.in
23.111.137.178
2606:4700:3036::6812:2b8e
2a00:1450:4001:821::200a
35.189.108.75
1455a2b9cd25d5e9a31e18e11bddfc928b07a87b52e8d223d8ddf645584a342f
2d607e1847502f60fb08c471012ccfb1e22d3c6a0535588b7ca49c257e693bfc
610d2709b5c9837526af5693d5d84e742242f780e415332877c55e4bfb4f22aa
8d5bf31102d6c0c10b3c4211f6f7dede7d98df39d462df9eb93d8356a05c6476
d330843eabc3d779c21870769f43515137ffef8e0465862e31e1f43d0843aead

firebasestorage.googleapis.com Open in urlscan Pro 2a00:1450:4001:821::200a Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

4 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

401 kBTransfer

406 kBSize

0 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

firebasestorage.googleapis.com Open in urlscan Pro
2a00:1450:4001:821::200a Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

401 kB
Transfer

406 kB
Size

0
Cookies

4 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!