Security Scan: https://moprf-3331cyura.firebaseapp.com/

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/12488d43-2717-41af-8757-a579e00d5143 Domain and IP registration (RDAP)/api/v1/rdap/12488d43-2717-41af-8757-a579e00d5143How often this domain was scanned/api/v1/domain/stats/moprf-3331cyura.firebaseapp.com Scan history for this domain/api/v1/domain/history/moprf-3331cyura.firebaseapp.com?limit=15

This website contacted 1 IP in 1 country across 2 domains to perform 3 HTTP transactions. The main domain is firebaseapp.com and was registered 14 years ago.

Submitted URL: https://moprf-3331cyura.firebaseapp.com/

Effective URL:

https://de.ihrkosten-gehaltskont-erhalten.shop/?pwd=sg

Redirected

AI Security Verdict

Moderate Risk

Confidence: 66%

Risk Score

Randomised Firebase redirector bouncing to a keyword-stuffed German salary-account .shop domain — a classic phishing-lure shape. Nothing malicious served or confirmed; treat as high-risk and do not follow.

Risk Factors (4)

Deceptive destination hostname built from hyphenated German salary-account/financial phrasing on a .shop domain with no official relationship

Throwaway Firebase subdomain with a randomised name used purely as a redirector

Redirect chain separates the submitter's host from the lure host, consistent with cloaking/evasion

Destination unreachable, so the ultimate page content cannot be verified as benign

Safety Factors (7)

No credential, payment or disguised password fields on the captured page (0 forms) — no harvesting was observed on the submitted host itself

No Indicators of Compromise matches against the scanned page or its resources

No hunting rule JavaScript malware patterns, no kit-roster match and no network IDS alerts

No obfuscated JavaScript, no cross-origin credential exfiltration detected

Cross-domain redirect alone is ordinary behaviour and was not weighted as a risk

No concrete malicious signal (no IoC / hunting rule / Safe-Browsing / IDS / credential form / brand impersonation) — elevated risk rested on domain age or reputation alone; clamped from 7 to 5

Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 5 to 5

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

You're looking at domain 'moprf-3331cyura.firebaseapp.com' on the commercial generic top-level domain (.com) with subdomain 'moprf-3331cyura'. Its registrable label 'firebaseapp' stretches across 11 characters split between five vowels and 6 consonants. It segments into 3 words: fire, base, app. Average segment length settles at 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Domain does not exist

There was no DNS record for de.ihrkosten-gehaltskont-erhalten.shop when we scanned it, so there is no screenshot.

Page Load Overview

0.38s

Total Load Time

1 KB

Total Size

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	199.36.158.100Fastly · CDN	United States	AS54113Fastly, Inc.
3	1	-	-

Detected Technologies4

Meta-Refresh-Redirect

100%

HTTP/3

40%

HSTS

40%

Firebase

40%

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Average Hash:N/A

Perceptual Hash:N/A

Difference Hash:N/A

Wavelet Hash:N/A

Color Hash:N/A

Other Hashes

Crop Resistant:N/A

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: moprf-3331cyura.firebaseapp.com