www.milexmusic.be
Open in
urlscan Pro
2a03:3a60:a1:9::1
Malicious Activity!
Public Scan
URL:
https://www.milexmusic.be/fonts/wt.lt/https-wetransfer.com-downloads-1c0ced943cb26fcf2c91a98230902323-230920n8%3Dncv9uernn...
Submission: On August 31 via api from IE — Scanned from NL
Submission: On August 31 via api from IE — Scanned from NL
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 2a03:3a60:a1:9::1, located in
Rotterdam, Netherlands and
belongs to I3DNET, NL.
The main domain is www.milexmusic.be.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 30th 2022. Valid for: a year.
This is the only time www.milexmusic.be was scanned on urlscan.io!
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 30th 2022. Valid for: a year.
This is the only time www.milexmusic.be was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WeTransfer (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 2a03:3a60:a1:... 2a03:3a60:a1:9::1 | 49544 (I3DNET) (I3DNET) | |
| 7 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
milexmusic.be
www.milexmusic.be |
908 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 7 | www.milexmusic.be |
www.milexmusic.be
|
| 7 | 1 |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| milexmusic.be Sectigo RSA Domain Validation Secure Server CA |
2022-03-30 - 2023-03-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.milexmusic.be/fonts/wt.lt/https-wetransfer.com-downloads-1c0ced943cb26fcf2c91a98230902323-230920n8%3Dncv9uernnund0943%3D20j8n34-934-239nfnlncnvberodfnnf-miuhdfn9ernfoonernf-mneudfner-nmkbdfndf1ae6b27952020220729134106b8fc56/mb_wetransfer_downloads_index.php
Frame ID: 5FF50D85E0DFBA4D2307E88AF5737435
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Wetransfer- ContinueDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
URL: https://hsweb.in/we.tl/hUytjas-jhsdyhw_Mhhsgw
Title: Continue with Microsoft/Outlook
Title: Continue with Microsoft/Outlook
Search URL Search Domain Scan URL
URL: https://hsweb.in/we.tl/Ohjsdkjtyjhkjsd-wetrns
Title: Continue with Yahoo
Title: Continue with Yahoo
Search URL Search Domain Scan URL
URL: https://hsweb.in/wt.tl/uweuinsds0903okkujs
Title: Continue with Gmail
Title: Continue with Gmail
Search URL Search Domain Scan URL
URL: https://hsweb.in/we.tl/s0HghSAhjhdsuAJjgdaj08jhsd
Title: Continue with E-mail
Title: Continue with E-mail
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
mb_wetransfer_downloads_index.php
www.milexmusic.be/fonts/wt.lt/https-wetransfer.com-downloads-1c0ced943cb26fcf2c91a98230902323-230920n8%3Dncv9uernnund0943%3D20j8n34-934-239nfnlncnvberodfnnf-miuhdfn9ernfoonernf-mneudfner-nmkbdfndf1... |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
www.milexmusic.be/fonts/wt.lt/https-wetransfer.com-downloads-1c0ced943cb26fcf2c91a98230902323-230920n8%3Dncv9uernnund0943%3D20j8n34-934-239nfnlncnvberodfnnf-miuhdfn9ernfoonernf-mneudfner-nmkbdfndf1... |
160 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Login-Form-Clean.css
www.milexmusic.be/fonts/wt.lt/https-wetransfer.com-downloads-1c0ced943cb26fcf2c91a98230902323-230920n8%3Dncv9uernnund0943%3D20j8n34-934-239nfnlncnvberodfnnf-miuhdfn9ernfoonernf-mneudfner-nmkbdfndf1... |
1 KB 645 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
styles.css
www.milexmusic.be/fonts/wt.lt/https-wetransfer.com-downloads-1c0ced943cb26fcf2c91a98230902323-230920n8%3Dncv9uernnund0943%3D20j8n34-934-239nfnlncnvberodfnnf-miuhdfn9ernfoonernf-mneudfner-nmkbdfndf1... |
0 153 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wetransfer_logo_we_transfer.png
www.milexmusic.be/fonts/wt.lt/https-wetransfer.com-downloads-1c0ced943cb26fcf2c91a98230902323-230920n8%3Dncv9uernnund0943%3D20j8n34-934-239nfnlncnvberodfnnf-miuhdfn9ernfoonernf-mneudfner-nmkbdfndf1... |
125 KB 126 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.js
www.milexmusic.be/fonts/wt.lt/https-wetransfer.com-downloads-1c0ced943cb26fcf2c91a98230902323-230920n8%3Dncv9uernnund0943%3D20j8n34-934-239nfnlncnvberodfnnf-miuhdfn9ernfoonernf-mneudfner-nmkbdfndf1... |
76 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bg7.png
www.milexmusic.be/fonts/wt.lt/https-wetransfer.com-downloads-1c0ced943cb26fcf2c91a98230902323-230920n8%3Dncv9uernnund0943%3D20j8n34-934-239nfnlncnvberodfnnf-miuhdfn9ernfoonernf-mneudfner-nmkbdfndf1... |
721 KB 722 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WeTransfer (Online)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation number| uidEvent object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.milexmusic.be
2a03:3a60:a1:9::1
3f1c72e824c95f57cb3d13ad549f18e66485221a175a33877f346051a4d302c2
62da598e287db1b7d10c94a89c610096518ed2f101057cd5c278674866e33248
baac93855451e14898a6b5aaf78da07ffa9b61bb4d75c3a5353b18bb6660eab5
c1e4ca8d14febe2eca37805c3d657d89a52f94af9d8742b21e1afd8ecf556429
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5210fa3e7f0245a4c51eb7f280092c0ef99fdd28c45e17dab8cc5854fdf4fd3
ff262c58dd02a1d6eea589754c18d9d68c4b3e88c272d2dbe6cc354ee4658696