Security Scan: https://morad-2a537.web.app/

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/ef9dfa6b-0028-42e4-8d9f-41fb56070bbc Domain and IP registration (RDAP)/api/v1/rdap/ef9dfa6b-0028-42e4-8d9f-41fb56070bbcHow often this domain was scanned/api/v1/domain/stats/morad-2a537.web.app Scan history for this domain/api/v1/domain/history/morad-2a537.web.app?limit=15

This website contacted 1 IP in 1 country across 2 domains to perform 4 HTTP transactions. The main domain is web.app and was registered 7 years ago.

Submitted URL: https://morad-2a537.web.app/

Effective URL:

https://votreremboursementimpos.com/

Redirected

AI Security Verdict

Moderate Risk

Confidence: 62%

Risk Score

Throwaway Firebase subdomain redirects to an unreachable domain named 'your tax refund' — a deceptive French tax-refund lure theme. No forms or malware seen, but the funnel is unverifiable and should be avoided.

Risk Factors (4)

Cross-domain redirect from an anonymous throwaway Firebase subdomain to an unrelated registrable domain

Deceptive hostname built around a government tax-refund lure ('votreremboursementimpos.com')

Destination unreachable during scanning, so its content and any data-collection behavior are unverifiable

No legitimate purpose or self-identifying content on the submitted page

Safety Factors (6)

No credential, password or payment fields were present on the captured page

No threat-intelligence Indicators of Compromise matched the scanned page or its resources

No JavaScript malware patterns, obfuscated scripts, third-party script hosts or cross-origin credential exfiltration detected

No network-level IDS alerts

No concrete malicious signal (no IoC / hunting rule / Safe-Browsing / IDS / credential form / brand impersonation) — elevated risk rested on domain age or reputation alone; clamped from 7 to 5

Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 5 to 5

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

Within the application-focused generic top-level domain (.app), 'morad-2a537.web.app' is registered; it also runs on subdomain 'morad-2a537'. The second-level label 'web' is 3 characters long containing one vowel alongside two consonants. Breaking it apart gives one word: web. The median word length lands at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.34s

Total Load Time

1 KB

Total Size

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	199.36.158.100Fastly · CDN	United States	AS54113Fastly, Inc.
4	1	-	-

Detected Technologies4

Meta-Refresh-Redirect

100%

HTTP/3

40%

HSTS

40%

Firebase

40%

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Average Hash:N/A

Perceptual Hash:N/A

Difference Hash:N/A

Wavelet Hash:N/A

Color Hash:N/A

Other Hashes

Crop Resistant:N/A

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: morad-2a537.web.app