urlscan.io logo urlscan.io
SecurityTrails logo

en-wetransfer.pro Open in urlscan Pro
172.67.141.20  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://en-wetransfer.pro/
Submission: On November 07 via automatic, source certstream-suspicious — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 172.67.141.20, located in United States and belongs to CLOUDFLARENET, US. The main domain is en-wetransfer.pro.
TLS certificate: Issued by WE1 on November 7th 2024. Valid for: 3 months.
This is the only time en-wetransfer.pro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

IP Address AS Autonomous System
4 172.67.141.20 13335 (CLOUDFLAR...)
4 1
Apex Domain
Subdomains		 Transfer
4 en-wetransfer.pro
en-wetransfer.pro
985 KB
4 1
Domain Requested by
4 en-wetransfer.pro en-wetransfer.pro
4 1

This site contains no links.

Subject Issuer Validity Valid
en-wetransfer.pro
WE1		 2024-11-07 -
2025-02-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://en-wetransfer.pro/
Frame ID: 97DDBD6925B2E1B25784AFCCDDA866E3
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Unique Download Link | WeTransfer

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

985 kB
Transfer

996 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
en-wetransfer.pro/ 		13 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://en-wetransfer.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.141.20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4ad55342fb278ff3dc70bc9f391c2b5597e8c9aa24d0ef3d688499321f5f38e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8deec7c48bc4e193-MRS
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Thu, 07 Nov 2024 16:43:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OG0GmMD9yy%2F1JpluOUnfp96P1UOC0OHlWCQErndQWjOPdZxr%2BPHzleutpmXwOKOfesya%2FtYl9PzCsYbo30xMeuzxfnUZU0KG%2FHknW9YeMVxAwmvo1L%2Bc6F7B8texUTevbUHKvw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=19770&sent=7&recv=9&lost=0&retrans=0&sent_bytes=3932&recv_bytes=2289&delivery_rate=196481&cwnd=254&unsent_bytes=0&cid=f318643773ea7adf&ts=480&x=0"
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed
style.css
en-wetransfer.pro/ 		7 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://en-wetransfer.pro/style.css
Requested by
Host: en-wetransfer.pro
URL: https://en-wetransfer.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.141.20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d58f4401c1ad0717177f8bc9153d1e193850a9917878ca8bb31b15204efcd434

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://en-wetransfer.pro/

Response headers

cache-control
public, max-age=604800
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
MISS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iGZSqLKV7E0H6uI9%2FIoHW9TkjG9nhh1Y6Nasp4LIvUv579Lwzz2jvaHZ1SHRjPVd%2B%2F5vEj7Gt9YI5YwE0k9u0aq8GfDHs4yK%2FFy7j%2BBlEj6IfqNv0tXSBNuLFumGJE5EExTnbg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8deec7c9d890e193-MRS
expires
Thu, 14 Nov 2024 16:43:07 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=19931&sent=13&recv=14&lost=0&retrans=0&sent_bytes=8182&recv_bytes=2409&delivery_rate=317867&cwnd=257&unsent_bytes=0&cid=f318643773ea7adf&ts=1341&x=0"
date
Thu, 07 Nov 2024 16:43:07 GMT
x-turbo-charged-by
LiteSpeed
content-type
text/css
last-modified
Thu, 07 Nov 2024 16:14:59 GMT
vary
Accept-Encoding
server
cloudflare
bg.png
en-wetransfer.pro/ 		936 KB
937 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://en-wetransfer.pro/bg.png
Requested by
Host: en-wetransfer.pro
URL: https://en-wetransfer.pro/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.141.20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
774391c307037f4702ece38e372b24d6689aa56057d63d7eb11003da6faba7de

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://en-wetransfer.pro/style.css

Response headers

cf-cache-status
MISS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HMBj7GzbK6d5Ze5hYM2eiC0X4PjaBn6PAdhFOeEUCH5Nq1YGFtzz8Jy5zmpFmhv0293XtJ2SazMOzUVRgQwBDL7mg9Z59xX%2B5rYn53V%2Bh9SKP7398AYqYwx%2Bz4h2S8htPrsv%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 14 Nov 2024 16:43:07 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=20055&sent=19&recv=19&lost=0&retrans=0&sent_bytes=10867&recv_bytes=2550&delivery_rate=317867&cwnd=257&unsent_bytes=0&cid=f318643773ea7adf&ts=1661&x=0"
date
Thu, 07 Nov 2024 16:43:07 GMT
content-type
image/png
last-modified
Thu, 07 Nov 2024 16:14:59 GMT
vary
Accept-Encoding
cache-control
public, max-age=604800
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deec7cb8fdde193-MRS
accept-ranges
bytes
content-length
957981
x-turbo-charged-by
LiteSpeed
server
cloudflare
favicon.png
en-wetransfer.pro/ 		41 KB
41 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://en-wetransfer.pro/favicon.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.141.20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d12161435ace47c6883360e08466508593325f134c1852b1d0e6e75d5f76adda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://en-wetransfer.pro/

Response headers

cf-cache-status
MISS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AznSgpFnHj2MNOjU7DA72aOp0Q%2BN9xzYo3b13b0ErRn%2BIGbJe4h%2BTIvokojmnlHawX%2Ffh0J%2BV9g56IdZ5YZohKx3%2FnGjsvNyreEV7O%2BJffzfxJbfDuy2FcrsTfAe98cOCfk86Q%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Thu, 14 Nov 2024 16:43:08 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=21106&sent=791&recv=137&lost=0&retrans=0&sent_bytes=973433&recv_bytes=2615&delivery_rate=18140845&cwnd=896&unsent_bytes=0&cid=f318643773ea7adf&ts=2962&x=0"
date
Thu, 07 Nov 2024 16:43:08 GMT
content-type
image/png
last-modified
Thu, 07 Nov 2024 16:14:59 GMT
vary
Accept-Encoding
cache-control
public, max-age=604800
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deec7d3c862e193-MRS
accept-ranges
bytes
content-length
41566
x-turbo-charged-by
LiteSpeed
server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies