urlscan.io logo urlscan.io
SecurityTrails logo

pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Effective URL: https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Submission: On February 13 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev.
TLS certificate: Issued by E1 on February 6th 2024. Valid for: 3 months.
This is the only time pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700::68... 13335 (CLOUDFLAR...)
5 2606:4700:310... 13335 (CLOUDFLAR...)
2 2606:4700:310... 13335 (CLOUDFLAR...)
8 4
Domain Requested by
5 sdfvgbh.pages.dev pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
2 wetr-3p0.pages.dev pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
1 pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
8 3

This site contains no links.

Subject Issuer Validity Valid
*.r2.dev
E1		 2024-02-06 -
2024-05-06		 3 months crt.sh
sdfvgbh.pages.dev
GTS CA 1P5		 2024-01-09 -
2024-04-08		 3 months crt.sh
wetr-3p0.pages.dev
GTS CA 1P5		 2024-02-04 -
2024-05-04		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Frame ID: E3CF6410370EEB1541D5EEB73B1F2E7A
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

WeTransferaccount | WeTransfer

Page URL History Show full URLs

  1. http://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html HTTP 307
    https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

1312 kB
Transfer

1443 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html HTTP 307
    https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request weetrnsfar.html
pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/
Redirect Chain
  • http://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
  • https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
310 KB
310 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a305be23a8414414dfdd3b63148ee1e3d390abe893c0fa2af8cef0bc458a772f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Accept-Ranges
bytes
CF-RAY
855039579e8e4bc0-BUF
Connection
keep-alive
Content-Length
317250
Content-Type
text/html
Date
Tue, 13 Feb 2024 21:39:26 GMT
ETag
"b3850132da521f2750df77d377b52153"
Last-Modified
Mon, 12 Feb 2024 09:40:40 GMT
Server
cloudflare
Vary
Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Non-Authoritative-Reason
HSTS
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1f39a1017906d512934d04cef8dbd816ebe0206eab872da92d30fdb554c84a89

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type
image/svg+xml
bg.png
sdfvgbh.pages.dev/ 		783 KB
784 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sdfvgbh.pages.dev/bg.png
Requested by
Host: pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
URL: https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2fac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
97915ef3518cf57623d185b62663441724cc9afdd8927518e45c36cffc84be2f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 21:39:26 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"2cfd5689dca667351388f92ec5d22b6e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BeUPdIJmUmL%2BK6K%2BujJxc8chKxqkqfN63oyJqZkcFUNFLIUtR1Sv2HZsBFbe5I1huGPNz5wCR%2BbCR8BOmXwx6YZjFEHpwY3WTvrn4DjskHem30W4gdQK9vhShgvHArsQfzCRhqwRMKamMz0VH6H9cg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8550395949724bd5-BUF
alt-svc
h3=":443"; ma=86400
content-length
801710
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7b18f49b87cf2ce19da6e9ddff3b99cdbb7d79baaddc3911a2d9b5ca74538994

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type
image/svg+xml
jquery.min.js
wetr-3p0.pages.dev/ 		164 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wetr-3p0.pages.dev/jquery.min.js
Requested by
Host: pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
URL: https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2d27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
562892609732b7374aa3c5f488b555236db7a26a8f73c16624407fad46d946f8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 21:39:26 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"529a27b025e86819529a36abf159162d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=87f4TTh8pjJdtjZbWOkTU8kfCwMsdzQJwCqlsYiA5c6xYRLDbi%2BBZs5r%2Fi%2BveA1ngB0vaUxgY4lzgeaukL5U81Zzqby7cYqDSI7anivBAgxab3A2BB5vnuKpP2LcENHDuaJ1Na3VdJKoToldhPXmvWc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
85503959acf64bc7-BUF
alt-svc
h3=":443"; ma=86400
script.min.js
wetr-3p0.pages.dev/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wetr-3p0.pages.dev/script.min.js
Requested by
Host: pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
URL: https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2d27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8b94fe72cf56de9a06e40ac775760e625540ffec7572ad7aa620462bcdcca8f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 21:39:26 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"5387bed7dd09b686dd9202d051cf3814"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=arxA8MQGgI79Hm%2B3Q9qvOaj7g2KI3Bt7mK5lhBjadg1efgnxKyfo%2FvmWKq%2B8tvRp9BCN8dTZd126l5tH9DSdNEanWX%2Bh1uYAIDvDgVQb71lQfUCCDJdfY11l%2Bxa3cnWXrB2lKH0mVu11PMbEL2DmMhY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
85503959acf74bc7-BUF
alt-svc
h3=":443"; ma=86400
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6dbba1863bcfe251266f22a6c3b047f788a4851623c58c7b6b750809f0885dad

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Content-Type
image/svg+xml
GT-Super-Display-Light.woff
sdfvgbh.pages.dev/ 		54 KB
55 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/GT-Super-Display-Light.woff
Requested by
Host: pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
URL: https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2fac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62e704e04089cc468b4bfdd61705d93959532d630e88de5ecef6064ebfd9d29e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/
Origin
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 21:39:26 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6a491dee078a89c780b38ee790f48a41"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yvtec2Hp6husRVAVaScK%2FD7%2FABH7iKzLaAFR77gR2fu0%2FYNjiQifrhmgkCkghpg3WG3bEiUh9EmzeoLMyaiGoqFkTi1YGJEXZeAoIMXlDtA%2FGTqcTkkY9r1YfjyqEf35MOG3iRPO7Z1kmuqj4pT5Vw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
85503959a85a4bcf-BUF
alt-svc
h3=":443"; ma=86400
GT-Super-Display-Bold.woff
sdfvgbh.pages.dev/ 		58 KB
58 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/GT-Super-Display-Bold.woff
Requested by
Host: pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
URL: https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2fac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6046a8f13361f175a3717ef126c0d566f845a69ab36d997f33ed5397fdeb847
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/
Origin
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 21:39:26 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"ee15bd1ec4e070e78b7e92dae24de48d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T1IVvm6NmPje4ME3fOn3me8NWYX85%2BmsC4L6moAKGq%2BcV1t3pXAm3W%2Bd%2BHmqaPDAS6twJFGwBU2UkDdTYvRdo65%2BPBSwnxTDYlttGa4Ciii6X4xgwORqiIj0Odg263HKxyEOl37MDfaO5McpTVntQw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
85503959a85c4bcf-BUF
alt-svc
h3=":443"; ma=86400
ActiefGrotesque-Regular.woff
sdfvgbh.pages.dev/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/ActiefGrotesque-Regular.woff
Requested by
Host: pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
URL: https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2fac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eaddc3fb78d635f6abe0194b732e54a2fb4fc0c71669b50c98b02ac36feb813d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/
Origin
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 21:39:26 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"29ab82d0741efea564b3cfd506a37b72"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l6fBZfW20scrUTjcb0uL3UXkG%2FN3U6YX3uGj9acZuUi5F1BPXBIrtDpgN3KSJndwLly%2FfE8u6ohCqBGSlqaitWL7dIN%2F9HQ1Ebv%2Fmida3Z71iF%2Bp6ljy8KbowfZ%2FCnBPRvzUSQ6ja6SItNGhAY%2FXOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
85503959a85e4bcf-BUF
alt-svc
h3=":443"; ma=86400
ActiefGrotesque-Medium.woff
sdfvgbh.pages.dev/ 		31 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/ActiefGrotesque-Medium.woff
Requested by
Host: pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
URL: https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/weetrnsfar.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2fac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d88b3d358e709fc9e7691fd77af0bcad9d5c8fbe1f408259fe21de34dff97e27
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev/
Origin
https://pub-f1da6661dc4a4271b5f351bbff38a53d.r2.dev
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 21:39:26 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"839ff00046664abd76f6038ebc537e9a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eqWS4eJTpis42Ae7N2UWVt9HpHQp%2B63HAwcOO8bYJdcc4oOtqlQfBtjeanSfkiuaq74M8kpDEvka4OERrV%2FsDaSYztDcI581Y1ZRjyzYOgeG5%2Fg5e4sQivglXs0dJExkj%2BdgsjdcI8E3kInxqNCCBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
85503959a8604bcf-BUF
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies