Security Scan: 502 Bad Gateway

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/ca71d3bd-3fa7-4c43-93ee-814d6ea92aeb Domain and IP registration (RDAP)/api/v1/rdap/ca71d3bd-3fa7-4c43-93ee-814d6ea92aebHow often this domain was scanned/api/v1/domain/stats/wetransconect-71216.firebaseapp.com Scan history for this domain/api/v1/domain/history/wetransconect-71216.firebaseapp.com?limit=15

This website contacted 1 IP in 1 country across 2 domains to perform 3 HTTP transactions. The main domain is firebaseapp.com and was registered 14 years ago.

Submitted URL: https://wetransconect-71216.firebaseapp.com/

Effective URL:

https://fram9hkkm3urfzeqa3f8070221ro047432.nl/file/wetransfer.html

Redirected

AI Security Verdict

Moderate Risk

Confidence: 55%

Risk Score

Free Firebase subdomain redirects to a random throwaway .nl domain serving a WeTransfer-named file lure; destination is dead (502) and no credential form was found, so deceptive staging is suspected but harvesting is unconfirmed.

Risk Factors (4)

Deceptive/random-looking destination hostname unrelated to the entry domain

Redirect chain from a free hosting-platform subdomain to an unrelated throwaway domain

URL path referencing a third-party brand (WeTransfer) file-download lure

Destination unreachable (502 Bad Gateway), consistent with a dead or staged phishing drop

Safety Factors (4)

No forms of any kind, including no credential, password or payment fields

No Indicators of Compromise, YARA malware matches, IDS alerts or Safe Browsing hits

No cross-origin credential exfiltration and no third-party script hosts

Entry domain age/ranking cannot be attributed to the destination page (apex-platform age only)

Domain age information unavailable

Details

Page Title

502 Bad Gateway

Scan Type

public

Domain Name Analysis

The domain name 'wetransconect-71216.firebaseapp.com' uses the commercial generic top-level domain (.com), featuring subdomain 'wetransconect-71216'. The second-level label 'firebaseapp' is 11 characters long holding five vowels versus 6 consonants. Breaking it apart gives three words: fire, base, app. Median word length comes out to four characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.24s

Total Load Time

1 KB

Total Size

Language Analysis

Primary Language

🇫🇷French

Code: fr

Confidence:58%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:71 chars

Detector Agreement:100%

Language mismatch: Declared as en-US but detected as fr

Website Classification

Primary Category

unknown0% confidence

Type: static

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	199.36.158.100Fastly · CDN	United States	AS54113Fastly, Inc.
3	1	-	-

Detected Technologies4

Meta-Refresh-Redirect

100%

HTTP/3

40%

HSTS

40%

Firebase

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T13DF041CB2CE220521151004154C1F808B94BC8FFD50684F8F58C52AA9F6560EA0E355D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12:/wMxC5cJqJmr2xHq/4jX3EdZPXxhuNAczPxdXIgnJrYxNmoQb:/wMxC5JK4jkXXvMDBdYi

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:615:AAAAAAAAAAIACAAAAAAAEEAAAAAAAACAAAAAAAAAAAIBAAAAgBACAAAAAAQggQAAAAAAAAEAAAAAAAAAAAAEABAAAAAAACAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3fffffffffffffff

Perceptual Hash:870707070f0f1f3f

Difference Hash:c000000000000000

Wavelet Hash:30f0f0f0f0f0f0f0

Color Hash:#3a7867

Other Hashes

Crop Resistant:c000000000000000

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: wetransconect-71216.firebaseapp.com