www.gleamfashion.com Open in urlscan Pro
136.243.202.227 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
Submission: On July 04 via automatic, source openphish (July 4th 2019, 9:03:45 am UTC)

Summary HTTP 21 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 21 HTTP transactions. The main IP is 136.243.202.227, located in Germany and belongs to HETZNER-AS, DE. The main domain is www.gleamfashion.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 26th 2019. Valid for: 3 months.

This is the only time www.gleamfashion.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

	IP Address	AS Autonomous System
19	136.243.202.227 136.243.202.227	24940 (HETZNER-AS) (HETZNER-AS)
1	52.222.157.232 52.222.157.232	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
21	3

19 136.243.202.227 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.227.202.243.136.clients.your-server.de

www.gleamfashion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.157.232 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-157-232.fra53.r.cloudfront.net

backgrounds.wetransfer.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	gleamfashion.com www.gleamfashion.com	219 KB
1	wetransfer.net backgrounds.wetransfer.net	15 KB
0	Failed function sub() { [native code] }. Failed
21	3

	Domain	Requested by
19	www.gleamfashion.com	www.gleamfashion.com
1	backgrounds.wetransfer.net	www.gleamfashion.com
0	fdcgdnkidjaadafnichfpabhfomcebme Failed	www.gleamfashion.com
21	3

This site contains links to these domains. Also see Links.

Domain
www.000webhost.com

Subject Issuer	Validity	Valid
gleamfashion.com Let's Encrypt Authority X3	`2019-06-26` - `2019-09-24`	3 months	crt.sh
wetransfer.net Amazon	`2018-08-28` - `2019-09-28`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
Frame ID: 933BBFBF5066930163E9F21C07778688
Requests: 8 HTTP requests in this frame

Frame: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
Frame ID: A8D71F7B96D22EE8974083C03A246DF8
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

21
Requests

95 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

234 kB
Transfer

770 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.000webhost.com/?utm_source=000webhostapp&utm_campaign=000_logo&utm_medium=website_app-1539383517&utm_content=footer_img

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.php Show response
www.gleamfashion.com/WeTransfer.com/we/ 15 KB
5 KB 77ms
54ms Document
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

7b8e4bc77a568e72a95e84971a096f591b97c7e2a3992106e834622d0733ac83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: www.gleamfashion.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx
Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Nginx-Cache-Status: EXPIRED
X-Server-Powered-By: Engintron
Content-Encoding: gzip

GET
H/1.1 200
OK analytics.htm Show response
www.gleamfashion.com/WeTransfer.com/we/plus/ 9 KB
3 KB 12ms
11ms Script
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/plus/analytics.htm

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

f739a232c4615383ffb34a296c3fe81f866be7dd866c80ebab3a6a4e19aa7cf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding,User-Agent
X-Nginx-Cache-Status: HIT
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bWqOLA69nu2fsMi45LjA.htm Show response
www.gleamfashion.com/WeTransfer.com/we/plus/ 9 KB
3 KB 34ms
12ms Script
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/plus/bWqOLA69nu2fsMi45LjA.htm

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

f739a232c4615383ffb34a296c3fe81f866be7dd866c80ebab3a6a4e19aa7cf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding,User-Agent
X-Nginx-Cache-Status: HIT
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK gtm.htm Show response
www.gleamfashion.com/WeTransfer.com/we/plus/ 9 KB
3 KB 34ms
12ms Script
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/plus/gtm.htm

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

f739a232c4615383ffb34a296c3fe81f866be7dd866c80ebab3a6a4e19aa7cf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding,User-Agent
X-Nginx-Cache-Status: HIT
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK application-bd95c1c273b3b6f2c6b24f2eaeeaef30be54981e5727d3ac.css
www.gleamfashion.com/WeTransfer.com/we/plus/ 391 KB
50 KB 38ms
26ms Stylesheet
text/css 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/application-bd95c1c273b3b6f2c6b24f2eaeeaef30be54981e5727d3ac.css
Requested by: Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.227.202.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 7650cccb518dc3993c51d7a477c1676cf331e22856d2a5456178e5dc96f0ac39

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 03 Aug 2019 09:03:29 GMT

GET
H/1.1 200
OK remove.js Show response
www.gleamfashion.com/WeTransfer.com/we/plus/ 85 KB
30 KB 47ms
25ms Script
application/javascript 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/remove.js
Requested by: Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.227.202.243.136.clients.your-server.de
Software: nginx /
Resource Hash: d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 03 Aug 2019 09:03:29 GMT

GET webrtc-patch.js
fdcgdnkidjaadafnichfpabhfomcebme/scripts/ 0
0

GET
H/1.1 200
OK bg.htm Show response
www.gleamfashion.com/WeTransfer.com/we/plus/ Frame A8D7 19 KB
5 KB 13ms
13ms Document
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

3c45f092bc244060af4adfd6da88408ebad194c67d97ea737e9b31b18c055fa1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: www.gleamfashion.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com

Response headers

Server: nginx
Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding Accept-Encoding,User-Agent
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Nginx-Cache-Status: HIT
X-Server-Powered-By: Engintron
Content-Encoding: gzip

GET
H/1.1 200
OK index.php
www.gleamfashion.com/WeTransfer.com/we/ 15 KB
15 KB 12ms
12ms Image
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/index.php?email=nobody@mycraftmail.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Vary: Accept-Encoding
X-Nginx-Cache-Status: HIT
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK screen.css
www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/ Frame A8D7 25 KB
9 KB 14ms
13ms Stylesheet
text/css 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/screen.css
Requested by: Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.227.202.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 9cf371add05f24fd2a9522b90aa18961c4c1f71137df2e2ddac7966711f7b14d

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 03 Aug 2019 09:03:29 GMT

GET
H/1.1 200
OK wallpaper-api-2.htm Show response
www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/ Frame A8D7 9 KB
3 KB 15ms
13ms Script
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/wallpaper-api-2.htm

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

f739a232c4615383ffb34a296c3fe81f866be7dd866c80ebab3a6a4e19aa7cf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding,User-Agent
X-Nginx-Cache-Status: HIT
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK wallpaper-toolbox-0.htm Show response
www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/ Frame A8D7 9 KB
3 KB 15ms
14ms Script
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/wallpaper-toolbox-0.htm

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

f739a232c4615383ffb34a296c3fe81f866be7dd866c80ebab3a6a4e19aa7cf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding,User-Agent
X-Nginx-Cache-Status: HIT
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK jquery.htm Show response
www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/ Frame A8D7 9 KB
3 KB 15ms
14ms Script
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/jquery.htm

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

f739a232c4615383ffb34a296c3fe81f866be7dd866c80ebab3a6a4e19aa7cf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding,User-Agent
X-Nginx-Cache-Status: HIT
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bodymovin.htm Show response
www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/ Frame A8D7 9 KB
3 KB 14ms
13ms Script
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/bodymovin.htm

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

f739a232c4615383ffb34a296c3fe81f866be7dd866c80ebab3a6a4e19aa7cf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding,User-Agent
X-Nginx-Cache-Status: HIT
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK copy.htm Show response
www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/ Frame A8D7 9 KB
3 KB 28ms
12ms Script
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/copy.htm

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

f739a232c4615383ffb34a296c3fe81f866be7dd866c80ebab3a6a4e19aa7cf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding,User-Agent
X-Nginx-Cache-Status: HIT
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK trackers.htm Show response
www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/ Frame A8D7 9 KB
3 KB 28ms
13ms Script
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/trackers.htm

Requested by

Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.227.202.243.136.clients.your-server.de

Software

nginx /

Resource Hash

f739a232c4615383ffb34a296c3fe81f866be7dd866c80ebab3a6a4e19aa7cf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding,User-Agent
X-Nginx-Cache-Status: HIT
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK remove.js Show response
www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/ Frame A8D7 85 KB
30 KB 41ms
25ms Script
application/javascript 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg_data/remove.js
Requested by: Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.227.202.243.136.clients.your-server.de
Software: nginx /
Resource Hash: d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Thu, 04 Jul 2019 09:03:29 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Oct 2018 17:24:20 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 03 Aug 2019 09:03:29 GMT

GET
H2 200 1px.png
backgrounds.wetransfer.net/plus/201708/size_orange_v1/images/ Frame A8D7 15 KB
15 KB 29ms
9ms Image
image/png 52.222.157.232
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://backgrounds.wetransfer.net/plus/201708/size_orange_v1/images/1px.png
Requested by: Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.157.232 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-222-157-232.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1fd7ade374faaf1e5ab4a1b13e97e476bd0167d1c25ca0e198bed49d2e53928a

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 17 May 2019 06:53:02 GMT
via: 1.1 492376a657ddc8d381dbc676ab798325.cloudfront.net (CloudFront)
last-modified: Tue, 19 Jun 2018 12:51:28 GMT
server: AmazonS3
age: 7
etag: "c3d9ca9b5f619af2605d125aade2bc7a"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
x-amz-cf-pop: FRA53
accept-ranges: bytes
content-length: 14987
x-amz-cf-id: TQBgwUrc9tShOzGsh-HDpiyClPkmVrHcAopHBJPzqjM2Yiwy-F4pGQ==

GET
H/1.1 404
Not Found texture.png
www.gleamfashion.com/WeTransfer.com/we/plus/images/ Frame A8D7 44 KB
44 KB 842ms
842ms Image
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/images/texture.png
Requested by: Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.227.202.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 72fd9aa1420537456c3a63030402385a234f978477cbfde009c93f9eda03d5ed

Request headers

Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 04 Jul 2019 09:03:30 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Link: <https://www.gleamfashion.com/wp-json/>; rel="https://api.w.org/"

GET
H/1.1 404
Not Found FreightSans-Pro-Semibold.woff
www.gleamfashion.com/WeTransfer.com/we/plus/fonts/ Frame A8D7 0
0 870ms
870ms Font
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/fonts/FreightSans-Pro-Semibold.woff
Requested by: Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.227.202.243.136.clients.your-server.de
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
Origin: https://www.gleamfashion.com

Response headers

Date: Thu, 04 Jul 2019 09:03:30 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Link: <https://www.gleamfashion.com/wp-json/>; rel="https://api.w.org/"

GET
H/1.1 404
Not Found FreightSans-Pro-Medium.woff
www.gleamfashion.com/WeTransfer.com/we/plus/fonts/ Frame A8D7 0
0 852ms
850ms Font
text/html 136.243.202.227
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/fonts/FreightSans-Pro-Medium.woff
Requested by: Host: www.gleamfashion.com
URL: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.202.227 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.227.202.243.136.clients.your-server.de
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.gleamfashion.com/WeTransfer.com/we/plus/bg.htm
Origin: https://www.gleamfashion.com

Response headers

Date: Thu, 04 Jul 2019 09:03:30 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Link: <https://www.gleamfashion.com/wp-json/>; rel="https://api.w.org/"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fdcgdnkidjaadafnichfpabhfomcebme
URL: chrome-extension://fdcgdnkidjaadafnichfpabhfomcebme/scripts/webrtc-patch.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

backgrounds.wetransfer.net
fdcgdnkidjaadafnichfpabhfomcebme
www.gleamfashion.com
fdcgdnkidjaadafnichfpabhfomcebme
136.243.202.227
52.222.157.232
1fd7ade374faaf1e5ab4a1b13e97e476bd0167d1c25ca0e198bed49d2e53928a
3c45f092bc244060af4adfd6da88408ebad194c67d97ea737e9b31b18c055fa1
72fd9aa1420537456c3a63030402385a234f978477cbfde009c93f9eda03d5ed
7650cccb518dc3993c51d7a477c1676cf331e22856d2a5456178e5dc96f0ac39
7b8e4bc77a568e72a95e84971a096f591b97c7e2a3992106e834622d0733ac83
9cf371add05f24fd2a9522b90aa18961c4c1f71137df2e2ddac7966711f7b14d
d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f739a232c4615383ffb34a296c3fe81f866be7dd866c80ebab3a6a4e19aa7cf9

www.gleamfashion.com Open in urlscan Pro 136.243.202.227 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

21 Requests

95 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

234 kBTransfer

770 kBSize

0 Cookies

1 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www.gleamfashion.com Open in urlscan Pro
136.243.202.227 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

95 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

234 kB
Transfer

770 kB
Size

0
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!