office-mailcloud4040.firebaseapp.com Open in urlscan Pro
151.101.65.195 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://office-mailcloud4040.firebaseapp.com/
Effective URL:
https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
Submission: On November 17 via manual (November 17th 2020, 2:36:10 pm UTC) from US

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 6 domains to perform 11 HTTP transactions. The main IP is 151.101.65.195, located in United States and belongs to FASTLY, US. The main domain is office-mailcloud4040.firebaseapp.com.
TLS certificate: Issued by GTS CA 1O1 on October 21st 2020. Valid for: a year.

This is the only time office-mailcloud4040.firebaseapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 6	151.101.65.195 151.101.65.195	54113 (FASTLY) (FASTLY)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
1	2606:4700:20:... 2606:4700:20::ac43:45e2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2606:2800:234... 2606:2800:234:660:118e:28f:1d8a:2522	15133 (EDGECAST) (EDGECAST)
2	2406:da00:ff0... 2406:da00:ff00::b849:d4a4	14618 (AMAZON-AES) (AMAZON-AES)
11	7

6 151.101.65.195 (United States) 1 redirects

ASN54113 (FASTLY, US)

office-mailcloud4040.firebaseapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:45e2 (United States)

ASN13335 (CLOUDFLARENET, US)

ipapi.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:234:660:118e:28f:1d8a:2522 (United States)

ASN15133 (EDGECAST, US)

fast.fonts.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2406:da00:ff00::b849:d4a4 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

static.telus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	firebaseapp.com 1 redirects office-mailcloud4040.firebaseapp.com	159 KB
2	telus.com static.telus.com	105 KB
1	fonts.net fast.fonts.net	159 B
1	jquery.com code.jquery.com	32 KB
1	ipapi.co ipapi.co	703 B
1	aspnetcdn.com ajax.aspnetcdn.com	39 KB
11	6

	Domain	Requested by
6	office-mailcloud4040.firebaseapp.com	1 redirects office-mailcloud4040.firebaseapp.com
2	static.telus.com	office-mailcloud4040.firebaseapp.com
1	fast.fonts.net	office-mailcloud4040.firebaseapp.com
1	code.jquery.com	office-mailcloud4040.firebaseapp.com
1	ipapi.co	ajax.aspnetcdn.com
1	ajax.aspnetcdn.com	office-mailcloud4040.firebaseapp.com
11	6

This site contains no links.

Subject Issuer	Validity	Valid
firebaseapp.com GTS CA 1O1	`2020-10-21` - `2021-10-20`	a year	crt.sh
*.vo.msecnd.net Microsoft IT TLS CA 2	`2020-03-18` - `2022-03-18`	2 years	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-17` - `2021-07-17`	a year	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
s9.wac.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2019-01-16` - `2021-02-03`	2 years	crt.sh
static.telus.com DigiCert Global CA G2	`2020-04-20` - `2021-04-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
Frame ID: FE57FC979BDC9CC7A738DBF1B18E3C31
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://office-mailcloud4040.firebaseapp.com/ HTTP 301
https://office-mailcloud4040.firebaseapp.com/ Page URL
https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83 Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

7
IPs

2
Countries

335 kB
Transfer

1053 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://office-mailcloud4040.firebaseapp.com/ HTTP 301
https://office-mailcloud4040.firebaseapp.com/ Page URL
https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://office-mailcloud4040.firebaseapp.com/ HTTP 301
https://office-mailcloud4040.firebaseapp.com/

11 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
office-mailcloud4040.firebaseapp.com/
Redirect Chain

http://office-mailcloud4040.firebaseapp.com/
https://office-mailcloud4040.firebaseapp.com/

111 KB
31 KB

1083ms
997ms

Document
text/html

151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://office-mailcloud4040.firebaseapp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2b4af2a4291f2abb38ca36966797c77f0731b7823c6b1deeb5e1bd5de11e3bbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: office-mailcloud4040.firebaseapp.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
cache-control: max-age=3600
content-encoding: br
content-type: text/html; charset=utf-8
etag: "4c2a8683d1b4784f1ae42622a2d6ab9e1561f76ae2a5a7e053788bccc1b2dfb9-br"
last-modified: Sun, 15 Nov 2020 15:27:32 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
accept-ranges: bytes
date: Tue, 17 Nov 2020 14:35:53 GMT
x-served-by: cache-hhn4081-HHN
x-cache: MISS
x-cache-hits: 0
x-timer: S1605623753.820122,VS0,VE954
vary: x-fh-requested-host, accept-encoding
content-length: 31457

Redirect headers

Server: Varnish
Retry-After: 0
Location: https://office-mailcloud4040.firebaseapp.com/
Content-Length: 0
Accept-Ranges: bytes
Date: Tue, 17 Nov 2020 14:35:52 GMT
Connection: close
X-Served-By: cache-hhn4047-HHN
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1605623753.691000,VS0,VE0

GET
H2 200 jquery-3.4.0.min.js Show response
ajax.aspnetcdn.com/ajax/jQuery/ 86 KB
39 KB 107ms
27ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.4.0.min.js

Requested by

Host: office-mailcloud4040.firebaseapp.com
URL: https://office-mailcloud4040.firebaseapp.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (waw/0523) /

Resource Hash

0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://office-mailcloud4040.firebaseapp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 14:35:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31317198
x-cache: HIT
status: 200
content-length: 39406
x-xss-protection: 1; mode=block
last-modified: Thu, 11 Apr 2019 17:22:26 GMT
server: ECAcc (waw/0523)
etag: "c1ebe9218bf0d41:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 /
ipapi.co/org/ 19 B
703 B 314ms
290ms XHR
text/plain 2606:4700:20::ac43:45e2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ipapi.co/org/

Requested by

Host: ajax.aspnetcdn.com
URL: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.4.0.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:20::ac43:45e2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Referer: https://office-mailcloud4040.firebaseapp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 17 Nov 2020 14:35:54 GMT
vary: Host, Origin
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
allow: OPTIONS, GET, POST, OPTIONS, HEAD
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9NGRt11ioWwA1ZwV8BjD2Y%2BstKY4QfX1heBaWSRZEV%2Bwm1CJUzUWxZyDdHbjDcwEqtLsHE0ZXsqV8uS3trA%2FDPqp9I6QrTGPT3SrJrM2NEABXHGQAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://office-mailcloud4040.firebaseapp.com
cf-ray: 5f3a2e4efdc1c286-FRA
content-length: 19
cf-request-id: 06783b455a0000c286149c3000000001

GET
H2 200 Primary Request i.html Show response
office-mailcloud4040.firebaseapp.com/ 538 KB
56 KB 44ms
43ms Document
text/html 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83

Requested by

Host: office-mailcloud4040.firebaseapp.com
URL: https://office-mailcloud4040.firebaseapp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

11f4b2d484a9eeedb3b7d43503c8c35abacba3c0caa7dc1104740fba1e6aa819

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: office-mailcloud4040.firebaseapp.com
:scheme: https
:path: /i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://office-mailcloud4040.firebaseapp.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://office-mailcloud4040.firebaseapp.com/

Response headers

status: 200
cache-control: max-age=3600
content-encoding: br
content-type: text/html; charset=utf-8
etag: "6a1352a64498a7ddc3ab0b49275575453db8d80cd08d72392fae52f279db1f2e-br"
last-modified: Sun, 15 Nov 2020 15:27:32 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
accept-ranges: bytes
date: Tue, 17 Nov 2020 14:35:54 GMT
x-served-by: cache-hhn4081-HHN
x-cache: HIT
x-cache-hits: 1
x-timer: S1605623754.391231,VS0,VE1
vary: x-fh-requested-host, accept-encoding
content-length: 57387

GET
H2 200 jquery-1.10.0.min.js Show response
code.jquery.com/ 91 KB
32 KB 25ms
9ms Script
application/javascript 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.10.0.min.js
Requested by: Host: office-mailcloud4040.firebaseapp.com
URL: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: dbe2f39d679680bec02757226881b9ac53fb18a7a6cf397e2bbe6d4724c1c8e1

Request headers

Referer: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 14:35:54 GMT
content-encoding: gzip
last-modified: Fri, 24 Oct 2014 00:16:07 GMT
server: nginx
status: 200
etag: W/"54499a47-16b62"
vary: Accept-Encoding
x-hw: 1605623754.dop212.fr8.t,1605623754.cds248.fr8.hc,1605623754.cds251.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 32810

GET
H2 200 1.css
fast.fonts.net/t/ 0
159 B 27ms
6ms Stylesheet
text/css 2606:2800:234:660:118e:28f:1d8a:2522
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://fast.fonts.net/t/1.css?apiType=css&projectid=20d74cc5-7f7c-49a7-80ae-fa2f389c550d
Requested by: Host: office-mailcloud4040.firebaseapp.com
URL: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41AE) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 14:35:54 GMT
last-modified: Wed, 21 Feb 2018 12:55:22 GMT
server: ECS (fcn/41AE)
age: 2792021
etag: "616070693"
status: 200
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 0
expires: Tue, 17 Nov 2020 14:35:53 GMT

GET
H2 200 firebase-app.js Show response
office-mailcloud4040.firebaseapp.com/__/firebase/7.21.1/ 20 KB
7 KB 44ms
43ms Script
text/javascript 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://office-mailcloud4040.firebaseapp.com/__/firebase/7.21.1/firebase-app.js

Requested by

Host: office-mailcloud4040.firebaseapp.com
URL: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

sffe /

Resource Hash

3b9df018a8675ae9a77a534130118ec4d56dcf31f83af2433af4075b62f27721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT
status: 200
cross-origin-resource-policy: cross-origin
x-cache-hits: 1
content-length: 6666
x-xss-protection: 0
x-served-by: cache-hhn4081-HHN
last-modified: Thu, 24 Sep 2020 21:06:37 GMT
server: sffe
x-timer: S1605623754.463619,VS0,VE1
date: Tue, 17 Nov 2020 14:35:54 GMT
vary: Accept-Encoding, x-fh-requested-host, accept-encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=31556926
accept-ranges: bytes
expires: Tue, 16 Nov 2021 16:39:36 GMT

GET
H2 200 init.js Show response
office-mailcloud4040.firebaseapp.com/__/firebase/ 515 B
466 B 511ms
511ms Script
text/javascript 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://office-mailcloud4040.firebaseapp.com/__/firebase/init.js

Requested by

Host: office-mailcloud4040.firebaseapp.com
URL: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4c25f9dd85e9ce0afc88a0f67d4e151b7f8aed4d3b8151d5db9709f71b3a52a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
last-modified: Sun, 15 Nov 2020 15:27:32 GMT
x-timer: S1605623754.463829,VS0,VE469
etag: "d6d51da480125f9868afa7fce284d1c615f3cc4a5290fda4ec907f531fda5ae5"
x-served-by: cache-hhn4081-HHN
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
status: 200
cache-control: max-age=3600
date: Tue, 17 Nov 2020 14:35:54 GMT
accept-ranges: bytes
content-length: 355
x-cache-hits: 0

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 283246420c8ddc585831699f9623caf0985097ce116a5d640f4d869becfcceca

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK 530dee22-e3c1-4e9f-bf62-c31d510d9656.woff
static.telus.com/common/fonts// 56 KB
57 KB 496ms
199ms Font
font/woff 2406:da00:ff00::b849:d4a4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://static.telus.com/common/fonts//530dee22-e3c1-4e9f-bf62-c31d510d9656.woff
Requested by: Host: office-mailcloud4040.firebaseapp.com
URL: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da00:ff00::b849:d4a4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.1.19 /
Resource Hash: 5a9ce4d93bc8fd30ad48503f5eefce9d741aec86f7edee7eb89a30137662f479

Request headers

Origin: https://office-mailcloud4040.firebaseapp.com
Referer: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 17 Nov 2020 14:39:11 GMT
Last-Modified: Thu, 23 Mar 2017 23:44:53 GMT
Server: nginx/1.1.19
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 57767
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 icheck-green.png
office-mailcloud4040.firebaseapp.com/my-account/assets/images/ 64 KB
64 KB 45ms
44ms Image
text/html 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://office-mailcloud4040.firebaseapp.com/my-account/assets/images/icheck-green.png

Requested by

Host: office-mailcloud4040.firebaseapp.com
URL: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Sun, 15 Nov 2020 15:27:32 GMT
x-timer: S1605623755.565372,VS0,VE1
etag: "4c2a8683d1b4784f1ae42622a2d6ab9e1561f76ae2a5a7e053788bccc1b2dfb9-br"
x-served-by: cache-hhn4081-HHN
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/html; charset=utf-8
status: 200
cache-control: max-age=3600
date: Tue, 17 Nov 2020 14:35:54 GMT
accept-ranges: bytes
content-length: 31457
x-cache-hits: 1

GET
H/1.1 200
OK bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff
static.telus.com/common/fonts// 48 KB
48 KB 543ms
215ms Font
font/woff 2406:da00:ff00::b849:d4a4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://static.telus.com/common/fonts//bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff
Requested by: Host: office-mailcloud4040.firebaseapp.com
URL: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da00:ff00::b849:d4a4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.1.19 /
Resource Hash: 382c30319f5c79a66c7aba94b69014498e57486602a3ebe040a6c0be8b19e5b6

Request headers

Origin: https://office-mailcloud4040.firebaseapp.com
Referer: https://office-mailcloud4040.firebaseapp.com/i.html?93984jjd8pksh048jdkkd9n488=&h8893jjsx=383pksh048jd83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 17 Nov 2020 14:39:11 GMT
Last-Modified: Thu, 23 Mar 2017 23:44:53 GMT
Server: nginx/1.1.19
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 48779
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 24 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8fb7f75ec47b5f70882f0c2ccfb6d204f332aae123b81440254c1fcd566f34fe

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3bda6ce32b1ee45b5012b705b1291f987e020f3ce2ebb85659617c6d60073bd2

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
code.jquery.com
fast.fonts.net
ipapi.co
office-mailcloud4040.firebaseapp.com
static.telus.com
151.101.65.195
152.199.19.160
2001:4de0:ac19::1:b:1b
2406:da00:ff00::b849:d4a4
2606:2800:234:660:118e:28f:1d8a:2522
2606:4700:20::ac43:45e2
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
11f4b2d484a9eeedb3b7d43503c8c35abacba3c0caa7dc1104740fba1e6aa819
283246420c8ddc585831699f9623caf0985097ce116a5d640f4d869becfcceca
2b4af2a4291f2abb38ca36966797c77f0731b7823c6b1deeb5e1bd5de11e3bbb
382c30319f5c79a66c7aba94b69014498e57486602a3ebe040a6c0be8b19e5b6
3b9df018a8675ae9a77a534130118ec4d56dcf31f83af2433af4075b62f27721
3bda6ce32b1ee45b5012b705b1291f987e020f3ce2ebb85659617c6d60073bd2
4c25f9dd85e9ce0afc88a0f67d4e151b7f8aed4d3b8151d5db9709f71b3a52a3
5a9ce4d93bc8fd30ad48503f5eefce9d741aec86f7edee7eb89a30137662f479
8fb7f75ec47b5f70882f0c2ccfb6d204f332aae123b81440254c1fcd566f34fe
dbe2f39d679680bec02757226881b9ac53fb18a7a6cf397e2bbe6d4724c1c8e1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

office-mailcloud4040.firebaseapp.com Open in urlscan Pro 151.101.65.195 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

67 %IPv6

6 Domains

6 Subdomains

7 IPs

2 Countries

335 kBTransfer

1053 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

36 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

office-mailcloud4040.firebaseapp.com Open in urlscan Pro
151.101.65.195 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

7
IPs

2
Countries

335 kB
Transfer

1053 kB
Size

0
Cookies

11 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!