ScanMalware.com

Security Scan Report: sessionid089-dhlgateway.firebaseapp.com

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/274b0f1e-31af-4d4c-994a-00cfe38f94faDomain and IP registration (RDAP)/api/v1/rdap/274b0f1e-31af-4d4c-994a-00cfe38f94faHow often this domain was scanned/api/v1/domain/stats/sessionid089-dhlgateway.firebaseapp.comScan history for this domain/api/v1/domain/history/sessionid089-dhlgateway.firebaseapp.com?limit=15
This website contacted 7 IPs in 1 country across 7 domains to perform 9 HTTP transactions. The main domain is firebaseapp.com and was registered 14 years ago.

Submitted URL: https://sessionid089-dhlgateway.firebaseapp.com/

AI Security Verdict

High Risk

Confidence: 78%

7
Risk Score

DHL-branded shipment-tracking page on an unranked Firebase subdomain with no DHL affiliation and no forms; strong brand impersonation, though no credential capture was observed.

Risk Factors (4)
Impersonation of DHL brand on a non-DHL domain
Free/shared Firebase hosting subdomain with unknown actual creation date
Hostname uses a sessionid-style victim tracking token
Unranked domain with no legitimate DHL affiliation
Domain age information unavailable

Details

Page Title

Track Your Shipment

Scan Type

public

Domain Name Analysis

You're looking at domain 'sessionid089-dhlgateway.firebaseapp.com' on the commercial generic top-level domain (.com) and includes subdomain 'sessionid089-dhlgateway'. Its registrable label 'firebaseapp' stretches across 11 characters with five vowels and six consonants. Breaking it apart gives three words: fire, base, app. Median word length comes out to four characters. No strong language cues emerged from the frequency lists.

Screenshot

(OD scot @ ee Privacy Tes

Page Load Overview

0.35s
Total Load Time
1.2 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:19 chars
Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3199.36.158.100Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.19.230.21Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.13.205Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.19.229.21Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1172.67.83.132Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.12.205Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
97--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T12EC1D7F416721D146CBA66C2E46D77CD92335E07FE81346874E9521033CFEEA015BA66

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:nBRYPGRZJ40aTvj6VvBBs5vksLmC2ZRENUAkLBIEHXj/AQrd1vksLmC2ZRENUAkh:PooZ2BjgvBBpU2ZRENUAkLBIEFUU2ZRN

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:6042:BTBAhowSTBAAACgDIQDYNEBCIFAEMABJqAEggBEABAAOgjocAKhAmAAIRCKEIk0iESWBAAwAAFlwAAwREJNigAAQPuAJ8EHF

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:e7ffffffffffffff
Perceptual Hash:e666666666666626
Difference Hash:0c00000000000000
Wavelet Hash:273f3f3f00000000
Color Hash:0700b000080

Other Hashes

Crop Resistant:0c00000000000000

Scan History

Scan history not available

Unable to load historical scan data