Firebase ports scanning using nmap

Question

Purely for research purposes used nmap to check security of my application deployed to Firebase. However, there some questions which I can't understand:

1. Why Firebase has open so many ports? Something like few hundreds.
2. Almost on every port I'm getting an error auth-owners: ERROR: Script execution failed without any information about it. Why is that? The only one which gives some information are the following ports: 80, 443, 5269, and 65389.
3. Is TCP Sequence Prediction difficulty=17 and Network Distance 2 hops a good or bad result?
4. What means ssl-date: TLS randomness does not represent time?
5. What means IP ID Sequence Generation: Incremental?
6. What are Aggressive OS guesses?
7. I could see the open few hundreds of ports only after first scan, later on couldn't replicate this. Is it possible that Firebase/Google closed the ports or blocked me for some of them? In second scan and every other I could see only information about open ports 80, and 443 with a log "Not shown: 998 filtered ports".
8. I did test this on Kali Linux using VirtualBox. In the nmap output I can see Running: Oracle Virtualbox, OS CPE: cpe:/o:oracle:virtualbox, OS details: Oracle Virtualbox, is it about my system or the scanned website hsoted on Firebase?

Even answers for some of this questions would be already really appreciated!

Edit: I did use the following command nmap -v -A MYAPP.firebaseapp.com (for the first time and later on), also once tried nmap -v -A -sS MYAPP.firebaseapp.com, which gave the same results as second and each next nmap -v -A MYAPP.firebaseapp.com. Only nmap -v -A MYAPP.firebaseapp.com gave at the beginning a different output, i.e. few hundreds of open ports.

Edit2: Using db_nmap -v -sV MYAPP.firebaseapp.com was able to see the few hundreds (more precisely 1000) open ports doing one-by-one from Metasplot Framework's terminal. So there was no block. The command nmap -v -A MYAPP.firebaseapp.com also works now one-by-one. Don't know what was the problem.

Answer 1

I will try my best:

1. There is a chance that this firebase server is having other services available aswell on the system, that's why many ports show up.
2. This is output from a script which tries to guess under which username was the service ran.

For 3-5 please refer to NMAP manual.

6. NMAP by default uses few tricks to determine what remote operating system could be; using packet analyzing such as checking TTL value, opened ports and overall 'behaviour' it tries to guess the remote OS. Aggresive OS Guess is just a risky guess, means there is a chance that the system is XXX, but some of the tricks failed so the guess is not 100% sure.
7. Could be that You used different scan options. Posting full scan command which You've used would be nice to understand why You recieve X and not Y results.
8. This indicates that remote host identifies as Oracle Virtualbox. It looks like You have scanned Your own system somehow.

Without scan command being posted, it would be pretty hard to know i.e. answer for open/filtered ports.

EDIT 17.06.2019:

Here some quick review of used argument options in Your scans

-A: Enables OS detection and Version detection, Script scanning and Traceroute -v Enables verbose output -sS Enables stealth SYN scan (sends raw SYN and waits for SYN-ACK to report open)

There might be possibility that remote server might just drop incomplete TCP handshake (as stealth SYN scan never completes it and stops sending any packets once SYN-ACK or RST received), while it's fine with completed handshakes (default scan option You've used many times is CONNECT scan, means full TCP handshake) - hence different ports are being reported to be open.