Security Scan: Loading Page

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/d31944de-570f-4845-9029-596755f84509 Domain and IP registration (RDAP)/api/v1/rdap/d31944de-570f-4845-9029-596755f84509 Certificate Transparency/api/v1/ct/web-protect.pages.dev How often this domain was scanned/api/v1/domain/stats/sognnfr.firebaseapp.com Scan history for this domain/api/v1/domain/history/sognnfr.firebaseapp.com?limit=15

This website contacted 7 IPs in 1 country across 6 domains to perform 8 HTTP transactions. The main domain is web-protect.pages.dev and was registered 17 years ago.

Submitted URL: https://sognnfr.firebaseapp.com/

Effective URL:

https://web-protect.pages.dev/?iduser=TkRnek5RPT0=&zZ=VzXbb

Redirected

AI Security Verdict

Moderate Risk

Confidence: 78%

Risk Score

A contentless 'Loading' page that wears Google's copyright while hosted on a Cloudflare Pages developer domain, reached via a cross-domain redirect carrying an obfuscated victim ID — a phishing lure forwarding users to a fake login.

Risk Factors (5)

Impersonation of Google branding on a non-Google, developer-platform host

Cross-domain redirect chain carrying an obfuscated (base64) user identifier

Contentless 'Loading' page designed to forward users onward

Cross-origin fetch to an unranked, unrelated external domain (connect.robot-agachado.org)

External IP-lookup calls typically used to log victim addresses

Safety Factors (5)

No credential or payment form present on the captured page (0 forms, 0 password fields)

No JavaScript malware (YARA) patterns detected

No Indicators of Compromise matches in threat intelligence for the page or its resources

Legal pages (privacy/terms) referenced

Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 8 to 5

Domain age information unavailable

Details

Page Title

Loading Page

Scan Type

public

Favicon Hash

MMH3: 49830300

MD5: 2945a3271019c1a43599ef2b67ae7784

Domain Name Analysis

The domain 'sognnfr.firebaseapp.com' uses the commercial generic top-level domain (.com), featuring subdomain 'sognnfr'. The registrable portion 'firebaseapp' spans 11 characters holding 5 vowels versus six consonants. Segmentation suggests 3 words: fire, base, app. Expect 4 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.66s

Total Load Time

13 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:134 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software41% confidence

Type: static

Method: ml+structural

All Detected Categories

technology software

41%

news media journalism

40%

government public service

36%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	199.36.158.100Fastly · CDN	United States	AS54113Fastly, Inc.
1	142.251.152.119Google · CDN	United States	AS15169Google LLC
1	104.26.12.205Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	142.250.154.100Google · CDN	United States	AS15169Google LLC
1	142.251.151.119Google · CDN	United States	AS15169Google LLC
1	142.250.154.102Google · CDN	United States	AS15169Google LLC
8	7	-	-