Security Scan: https://www.google.com/search?q=covid&sei=C3L

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/05fc3ca9-a31a-46e1-bf4e-7027e68ae883 Domain and IP registration (RDAP)/api/v1/rdap/05fc3ca9-a31a-46e1-bf4e-7027e68ae883How often this domain was scanned/api/v1/domain/stats/jpmorganpurchase.firebaseapp.com Scan history for this domain/api/v1/domain/history/jpmorganpurchase.firebaseapp.com?limit=15

This website contacted 17 IPs in 2 countries across 5 domains to perform 18 HTTP transactions. The main domain is firebaseapp.com and was registered 14 years ago.

Submitted URL: https://jpmorganpurchase.firebaseapp.com/

Effective URL:

https://www.google.com/sorry/index?continue=https://www.google.com/sea...

Redirected

AI Security Verdict

High Risk

Confidence: 78%

Risk Score

Bank-branded Firebase subdomain pairing a Telegram bot exfiltration script with Telegram C2 traffic; the served page is a Google block interstitial, so no credential form was captured, but the host and script are phishing-infrastructure grade.

Risk Factors (4)

Bank-branded hostname on a free shared hosting subdomain, creation date unknown

Telegram bot-token exfiltration code embedded in the page's inline script

Telegram command-and-control/exfiltration traffic observed at the network layer

Off-domain redirect to a search-engine block page instead of the advertised destination

Domain age information unavailable

Details

Page Title

https://www.google.com/search?q=covid&sei=C3LcapW_HNqHxc8P46yr0QQ

Scan Type

public

Favicon Hash

MMH3: 708578229

MD5: f3418a443e7d841097c714d69ec4bcb8

Domain Name Analysis

The domain 'jpmorganpurchase.firebaseapp.com' uses the commercial generic top-level domain (.com), featuring subdomain 'jpmorganpurchase'. Its registrable label 'firebaseapp' stretches across 11 characters with five vowels and six consonants. Breaking it apart gives 3 words: fire, base, app. Median word length is four characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.56s

Total Load Time

1.2 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:40%

Script:Latin

Direction:ltr

Detection Details

Text Length:1,156 chars

Detector Agreement:50%

Website Classification

Primary Category

technology software77% confidence

Type: static

Method: ml+structural

All Detected Categories

technology software

77%

government public service

77%

documentation technical

73%

cryptocurrency blockchain

72%

healthcare medical

71%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	199.36.158.100Fastly · CDN	United States	AS54113Fastly, Inc.
1	149.154.166.110	Amsterdam, North Holland, Netherlands	AS62041Telegram Messenger Inc
1	142.251.155.119Google · CDN	United States	AS15169Google LLC
1	192.178.183.94Google · CDN	United States	AS15169Google LLC
1	142.251.14.157Google · CDN	United States	AS15169Google LLC
1	142.250.154.94Google · CDN	United States	AS15169Google LLC
1	142.251.14.97Google · CDN	United States	AS15169Google LLC
1	142.251.14.95Google · CDN	United States	AS15169Google LLC
1	142.251.153.7Google · CDN	United States	AS15169Google LLC
1	142.251.157.119Google · CDN	United States	AS15169Google LLC
18	17	-	-