ScanMalware.com

Security Scan Report: ee-pending-payment.firebaseapp.com

Redirected to:
https://ee.co.uk/
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/ab1f77a8-601f-4047-a177-fc449d0ab520Domain and IP registration (RDAP)/api/v1/rdap/ab1f77a8-601f-4047-a177-fc449d0ab520How often this domain was scanned/api/v1/domain/stats/ee-pending-payment.firebaseapp.comScan history for this domain/api/v1/domain/history/ee-pending-payment.firebaseapp.com?limit=15
This website contacted 63 IPs in 3 countries across 51 domains to perform 278 HTTP transactions. The main domain is firebaseapp.com and was registered 14 years ago.

Submitted URL: https://ee-pending-payment.firebaseapp.com/

Effective URL:
https://ee.co.uk/
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 88%

9
Risk Score

Free-hosting hostname 'ee-pending-payment' matched an analyst-vetted UK mobile account-recovery phishing kit (CRITICAL hunting-rule hit) that cloaks its lure by country/device and bounces non-targets to the real EE site. Report it.

Risk Factors (5)
Deceptive hostname using a carrier brand plus an account/payment-lure phrase on an instant-publish free hosting namespace
Critical, roster-anchored hunting-rule match for an active UK mobile account-recovery phishing kit
Country/device-gated content cloaking, with a redirect to the genuine brand site used as a decoy for non-target visitors
Threat-intelligence phishing report on the entry domain
Kit's known purpose is harvesting logins, card data and number-porting codes to an operator backend (no form was visible in this cloaked capture, so the harvest page was not served to our client)
Domain age information unavailable

Details

Page Title

EE

Scan Type

public

Domain Name Analysis

The domain name 'ee-pending-payment.firebaseapp.com' uses the commercial generic top-level domain (.com); it also runs on subdomain 'ee-pending-payment'. Its registrable label 'firebaseapp' stretches across 11 characters containing 5 vowels alongside 6 consonants. Tokenizing the label suggests three words: fire, base, app. Median word length comes out to four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ee-pending-payment.firebaseapp.com/

Page Load Overview

0.38s
Total Load Time
6.6 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:13 chars
Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence
Type: dynamic
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
9145.60.72.23Incapsula · WAFUnited States
AS19551Incapsula Inc
3223.52.181.12Akamai · CDNFrankfurt am Main, Hesse, Germany
AS16625Akamai Technologies, Inc.
2734.110.200.92Google · CDNKansas City, Missouri, United States
AS396982Google LLC
13172.64.155.119Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1123.207.210.156Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
10199.36.158.100Fastly · CDNUnited States
AS54113Fastly, Inc.
945.60.65.23Incapsula · WAFUnited States
AS19551Incapsula Inc
918.64.211.79Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
675.2.44.86Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
5216.239.34.36Google · CDNUnited States
AS15169Google LLC
27863--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1575151AE3C44C168BC366F0A52D8F4184699FF27A93C8CEE73A71159C342FE5561A81F

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:bubcosoaoZvo4oGp6fl3MAV3pS2DGffF/JC9j:Sxpp6fl3MA3pS2D0/JC9j

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:2797:gY5AAAgEIAIAACAIAkAAEAQBCAEARASACQAQMACRHAEIAAAEAAAFEABWgBgAAAAEAAAAACABNwIMgQAQCMAFAABAEACAACAI

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:bd18189999991800
Perceptual Hash:8c99a69c73e63926
Difference Hash:73f033333333234d
Wavelet Hash:fd1899999999b981
Color Hash:0e0080c0040

Other Hashes

Crop Resistant:f0baaab0b0b0b0a5,73f033333333234d

Scan History

Scan history not available

Unable to load historical scan data