ScanMalware.com

Security Scan Report: account-access-review.firebaseapp.com

Redirected to:
https://www.santander.co.uk/
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/3317efdd-3ba1-43df-aed2-16a4a1aac023Domain and IP registration (RDAP)/api/v1/rdap/3317efdd-3ba1-43df-aed2-16a4a1aac023How often this domain was scanned/api/v1/domain/stats/account-access-review.firebaseapp.comScan history for this domain/api/v1/domain/history/account-access-review.firebaseapp.com?limit=15
This website contacted 25 IPs in 4 countries across 17 domains to perform 83 HTTP transactions. The main domain is firebaseapp.com and was registered 14 years ago.

Submitted URL: https://account-access-review.firebaseapp.com/

Effective URL:
https://www.santander.co.uk/
Redirected

AI Security Verdict

Moderate Risk

Confidence: 70%

5
Risk Score

Entry Firebase host is reported as phishing and redirects to official Santander. Final page shows no credential/payment form or malware, but avoid the suspicious link and use Santander directly.

Risk Factors (3)
Single-source phishing threat-intel match on the entry host account-access-review.firebaseapp.com
Shared firebaseapp.com subdomain with unknown actual creation date
Redirect chain hides the final destination and uses a bank-account-themed hostname
Safety Factors (7)
Final URL is official Santander UK (www.santander.co.uk), established and highly ranked
No credential or payment fields in the final page
No JavaScript malware/YARA patterns, IDS alerts, or credential exfiltration
Final page meta description matches Santander UK and appears to be the real bank site
Scanner-vs-client mismatch is consistent with ordinary bot protection and not treated as malicious alone
No concrete malicious signal: the threat-feed matches name third-party or shared hosts, or rest on a single feed or a reputation label, so they were not counted; no YARA / Safe-Browsing / IDS / credential form / brand impersonation either. Elevated risk rested on domain age or reputation alone; clamped from 7 to 5
Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 5 to 5
Domain age information unavailable

Details

Page Title

Online

Scan Type

public

Domain Name Analysis

The domain 'account-access-review.firebaseapp.com' uses the commercial generic top-level domain (.com), featuring subdomain 'account-access-review'. Count 11 characters in 'firebaseapp' split between 5 vowels and 6 consonants. Breaking it apart gives 3 words: fire, base, app. Average segment length settles at 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://account-access-review.firebaseapp.com/

Page Load Overview

1.53s
Total Load Time
2.5 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:17 chars
Detector Agreement:0%

Website Classification

Primary Category

corporate business41% confidence
Type: dynamic
Method: ml+structural+ocr_tiebreaker

All Detected Categories

corporate business
41%
finance banking
41%
adult content
38%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
11199.36.158.100Fastly · CDNUnited States
AS54113Fastly, Inc.
32.22.31.186Akamai · CDNStockholm, Stockholm County, Sweden
AS20940Akamai International B.V.
323.52.181.12Akamai · CDNFrankfurt am Main, Hesse, Germany
AS16625Akamai Technologies, Inc.
3104.18.32.137Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
323.53.43.82Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
3146.75.121.55Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
344.195.158.232Aws · CLOUDAshburn, Virginia, United States
AS14618Amazon.com, Inc.
323.50.131.138Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
323.50.131.154Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
3172.64.155.119Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8325--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T14251B65E3C45C168E9376F0906C6B9444B4AFE23883C8CDD63971168C342FB46A1B51F

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:b1bco5jo5eIoNRoaYoGp6fl3MAV3pS2DGffF/Jc9eS4Vj:BP3Yp6fl3MA3pS2D0/Jy4Vj

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:2811:BsBAQAAhAAAAkQBBCSACEAACIAEABABBAAQCAAAEAKEAJCAAACQADwQABAAAAAAQAAEECAIAAAwBoIABgAACACIBABBABigA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffff000000ffffdb
Perceptual Hash:9b12edc65d16161e
Difference Hash:2429797979e93332
Wavelet Hash:979f000000ffffcb
Color Hash:#88931f

Other Hashes

Crop Resistant:2429797979e93332,38786e6ecac4e4cc,0b2414e4e414140b,3979797959787979,c289899d9d94b030,8586a666278d6fdb

Scan History

Scan history not available

Unable to load historical scan data