urlscan.io logo urlscan.io
SecurityTrails logo

wetrafileexu.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2f8b  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Submission: On October 26 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 2 countries across 7 domains to perform 14 HTTP transactions. The main IP is 2606:4700:310c::ac42:2f8b, located in United States and belongs to CLOUDFLARENET, US. The main domain is wetrafileexu.pages.dev.
TLS certificate: Issued by WE1 on October 20th 2024. Valid for: 3 months.
This is the only time wetrafileexu.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online) Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
4 2606:4700:310... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a04:4e42:400... 54113 (FASTLY)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 169.197.85.95 26548 (PUREVOLTA...)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
14 9
4    2606:4700:310c::ac42:2f8b (United States)

ASN13335 (CLOUDFLARENET, US)
wetrafileexu.pages.dev
2    2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
3    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
1    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
1    169.197.85.95 (United States)

ASN26548 (PUREVOLTAGE-INC, US)
i.ibb.co
1    2606:4700:10::6816:1b65 (United States)

ASN13335 (CLOUDFLARENET, US)
api.geoapify.com
Apex Domain
Subdomains		 Transfer
4 pages.dev
wetrafileexu.pages.dev
14 KB
3 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220
46 KB
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1113
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3270
30 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 412
61 KB
1 geoapify.com
api.geoapify.com — Cisco Umbrella Rank: 221792
2 KB
1 ibb.co
i.ibb.co — Cisco Umbrella Rank: 12145
2 MB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 791
24 KB
14 7
Domain Requested by
4 wetrafileexu.pages.dev wetrafileexu.pages.dev
3 cdnjs.cloudflare.com wetrafileexu.pages.dev
cdnjs.cloudflare.com
2 ajax.googleapis.com wetrafileexu.pages.dev
1 api.geoapify.com wetrafileexu.pages.dev
1 i.ibb.co wetrafileexu.pages.dev
1 stackpath.bootstrapcdn.com wetrafileexu.pages.dev
1 maxcdn.bootstrapcdn.com wetrafileexu.pages.dev
1 code.jquery.com wetrafileexu.pages.dev
14 8

This site contains no links.

Subject Issuer Validity Valid
wetrafileexu.pages.dev
WE1		 2024-10-20 -
2025-01-18		 3 months crt.sh
upload.video.google.com
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
cdnjs.cloudflare.com
WE1		 2024-09-28 -
2024-12-27		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
bootstrapcdn.com
WE1		 2024-09-20 -
2024-12-19		 3 months crt.sh
ibb.co
E6		 2024-10-21 -
2025-01-19		 3 months crt.sh
geoapify.com
WE1		 2024-09-03 -
2024-12-02		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Frame ID: 6FF3C3CD968CBF5045DDE52C0D208E29
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

We Pro Files

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

88 %
IPv6

7
Domains

8
Subdomains

9
IPs

2
Countries

1813 kB
Transfer

2131 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request list
wetrafileexu.pages.dev/ 		24 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70ee23ea1de15441f0ebfd580a0b7dda54aff8d1dc54be2b669ee15aac49fb18
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
8d8716535c4d913c-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Sat, 26 Oct 2024 02:41:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YS5%2BbodY%2BVWIQMpqBDHwFoO4ZfS1jn4dAeB3HUNQGyhjTmxXJs246guh5Smr48PhcXtjHAb5aBuCGCCCPRtqyJe5%2Bk%2Bmbu%2FiR4K3Ul3NuqY5I2P9%2F%2By6NlLpuFrrTghbTVV%2BfFC6RerRpxSfn8m6RmUvz7Qt"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=10173&sent=12&recv=9&lost=0&retrans=0&sent_bytes=4169&recv_bytes=4442&delivery_rate=76823&cwnd=12000&unsent_bytes=0&cid=9ff25f1ae35d9f55&ts=61&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
x-content-type-options
nosniff
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.3/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.3/jquery.min.js
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Referer
https://wetrafileexu.pages.dev/

Response headers

content-encoding
gzip
age
295665
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Wed, 22 Oct 2025 16:33:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 22 Oct 2024 16:33:40 GMT
last-modified
Wed, 11 Jan 2023 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
31191
x-xss-protection
0
server
sffe
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/ 		82 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a361e7885c36bacb3fd9cb068da207c3b9329962cac022d06e28923939f575e8
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Referer
https://wetrafileexu.pages.dev/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"619c057b-3a02"
age
208450
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cTSeRP%2Fzl%2BfqqgYmFWqz5NGT6c%2Fc5engmNBjXqZhYNnIv3Jvsd9aHMzp9MuESmMYJTspFYpza2L6N8K7wWsRj3mY8Hxohlza%2FiTKMPP4JnR0oEKtCODHQw1bpo%2F1MAsbTtmRd0ZuRusqHWHUzwpkhaPS"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 16 Oct 2025 02:41:25 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 26 Oct 2024 02:41:25 GMT
content-type
text/css; charset=utf-8
last-modified
Mon, 22 Nov 2021 21:02:51 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8d8716549c040493-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
14850
server
cloudflare
main.js
wetrafileexu.pages.dev/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wetrafileexu.pages.dev/main.js
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac81df9fbcd51d20d907e5c189d8229522b33751518476610f1f9c543a724462
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Referer
https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/

Response headers

content-encoding
br
etag
W/"17b3cdc77c24525175669f9abc3b1c39"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=knEcRXaQ9sKMnF4VtesFZiWcnWHfX9Wjd2Lo73Ix4ioFo34Mv%2Bn%2BIYBv1Qvh%2BiH2HOoTtlMbszgDCDGDWMV0kp8uQXsUKhqsuKKNw6JjLnWIVdoyLPQjJ1JjS2aGiRBZ04Z97ost1TnYwD8NCclWjpR7H%2BUy"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=8650&sent=25&recv=18&lost=0&retrans=0&sent_bytes=16985&recv_bytes=5444&delivery_rate=135142&cwnd=18000&unsent_bytes=0&cid=9ff25f1ae35d9f55&ts=207&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sat, 26 Oct 2024 02:41:25 GMT
content-type
application/x-javascript
vary
Accept-Encoding
priority
u=1,i=?0
cache-control
public, max-age=0, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8d8716546cc2913c-FRA
access-control-allow-origin
*
server
cloudflare
jquery-3.2.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Origin
https://wetrafileexu.pages.dev
Referer
https://wetrafileexu.pages.dev/

Response headers

content-encoding
gzip
etag
W/"28feccc0-10fdd"
age
3181756
x-cache
HIT, HIT
date
Sat, 26 Oct 2024 02:41:25 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
11, 33797
x-served-by
cache-lga21963-LGA, cache-fra-eddf8230079-FRA
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1729910485.222218,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
23856
server
nginx
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Origin
https://wetrafileexu.pages.dev
Referer
https://wetrafileexu.pages.dev/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03fa9-4af4"
age
116562
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QraS9b33Hg1BKByh7JTDOIo3t4QgcecvzNXwK%2FDYxo9LS16MNdiS63rJLVh7I9z0B1JuS7w7k9pHHI9yi5c%2BUoJZRrR37oJ%2Fq6UB9uPBF7EcFIoBq70rd1vbeSYjG78pHzwRvfzXY6DVTTEzokQQK4UB"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 16 Oct 2025 02:41:25 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 26 Oct 2024 02:41:25 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:15:37 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8d871654988fdbd8-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
6157
server
cloudflare
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 		48 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Origin
https://wetrafileexu.pages.dev
Referer
https://wetrafileexu.pages.dev/

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
W/"14d449eb8876fa55e1ef3c2cc52b0c17"
age
439462
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
date
Sat, 26 Oct 2024 02:41:25 GMT
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
03/18/2024 12:46:36
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
0
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
19e4c25f03b1aa259d290d21a486dcc9
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8d8716549d753a43-FRA
access-control-allow-origin
*
cdn-edgestorageid
1048
server
cloudflare
cdn-requestcountrycode
US
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Referer
https://wetrafileexu.pages.dev/

Response headers

content-encoding
gzip
age
295774
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Wed, 22 Oct 2025 16:31:51 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 22 Oct 2024 16:31:51 GMT
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30028
x-xss-protection
0
server
sffe
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Referer
https://wetrafileexu.pages.dev/

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
W/"67176c242e1bdc20603c878dee836df3"
age
797127
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
date
Sat, 26 Oct 2024 02:41:25 GMT
last-modified
Mon, 25 Jan 2021 22:04:06 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding, Accept-Encoding
cdn-cache
HIT
cdn-cachedat
08/04/2024 20:14:54
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
d111e32d511363007c6323c1993605f3
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8d8716549b249f16-FRA
access-control-allow-origin
*
cdn-edgestorageid
1029
server
cloudflare
cdn-requestcountrycode
US
jquery.min.v2.js
wetrafileexu.pages.dev/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://wetrafileexu.pages.dev/jquery.min.v2.js
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Referer
https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/

Response headers

cache-control
no-store
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YM9G3vLgn1N9fr3xhNkbtgrevQWRDxhms5USzukdELVF4OirwO89Ou7FcYlx7s3P%2Bsrkj1NvZrglwauSZWCW6qnncSC242xE57l8jHB2yHrunGT%2BhkmC%2FvYaoTx%2FsGKAY9xrbaeHtnHmvj4F4RUdD7Gdst7p"}],"group":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8d8716546cc3913c-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=8650&sent=28&recv=18&lost=0&retrans=0&sent_bytes=18624&recv_bytes=5444&delivery_rate=135142&cwnd=18000&unsent_bytes=0&cid=9ff25f1ae35d9f55&ts=208&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sat, 26 Oct 2024 02:41:25 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=1,i=?0
truncated
/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6e21622db6854c7d8163b4673d51d4d880c4fbf4f9b4750db3a633545db75524

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Referer

Response headers

Content-Type
image/png
bgweneed.png
i.ibb.co/S7YFXPk/ 		2 MB
2 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/S7YFXPk/bgweneed.png
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.85.95 , United States, ASN26548 (PUREVOLTAGE-INC, US),
Reverse DNS
Software
nginx /
Resource Hash
536b9f9930d7fd40ceeacee1db4fc2b93b7ce2609cb5e0dc3769eddcd75c14bb

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Referer
https://wetrafileexu.pages.dev/

Response headers

cache-control
max-age=315360000, public
access-control-allow-methods
GET, OPTIONS
expires
Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges
bytes
access-control-allow-origin
*
content-length
1674497
date
Sat, 26 Oct 2024 02:41:25 GMT
content-type
image/png
last-modified
Mon, 24 Jun 2024 20:30:10 GMT
server
nginx
fa-regular-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/webfonts/ 		23 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/webfonts/fa-regular-400.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
886fd1e6ce992ede514743a826fa71fefdb577047a2a899ca95f6f28f3305d09
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Origin
https://wetrafileexu.pages.dev
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css

Response headers

cf-cdnjs-via
cfworker/kv
cf-cache-status
HIT
etag
"619c057b-5cd0"
age
357426
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=myJRCWFfRoq0UbuN7636WpHENZEe5JPyeIhYm%2BmSA70k5phRYFfb7%2FDyij6FvcTUaFArzTIiyhCdE7Dhgn14iSBkZqRfRDsYBFqORFVrTWKT1thascGSJdBPpulLa1uBVRDWn6CC1UHZSD%2Br%2B%2FtNyzIR"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 16 Oct 2025 02:41:25 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 26 Oct 2024 02:41:25 GMT
content-type
application/octet-stream; charset=utf-8
last-modified
Mon, 22 Nov 2021 21:02:51 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8d871655192edbd8-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
23760
server
cloudflare
ipinfo
api.geoapify.com/v1/ 		1 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.geoapify.com/v1/ipinfo?apiKey=139d2378a5554f48bf290b61999b4e8a
Requested by
Host: wetrafileexu.pages.dev
URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:1b65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
13224defd71e1b7459da3a28140fb868864aff9cc669ceb771619763f2d799d5

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Referer
https://wetrafileexu.pages.dev/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
access-control-allow-methods
GET, POST, DELETE, OPTIONS, PUT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 26 Oct 2024 02:41:25 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
priority
u=1,i
access-control-allow-headers
accept, accept-language, content-language, access-control-max-age, access-control-allow-headers, access-control-allow-methods, access-control-allow-origin, allow, api-version, cf-ray, content-encoding, content-type, date, expect-ct, server, status, vary, cache-control, etag, last-modified, expires, host, x-forwarded-for, cf-connecting-ip, cf-iplongitude, accept-encoding, cf-pseudo-ipv4, x-forwarded-proto, cf-iplatitude, cf-ipcountry, cf-visitor, cf-ipcontinent, cf-ipcity, cf-region-code, cf-region, cdn-loop, cf-postal-code, cf-timezone, user-agent, origin, sec-fetch-site, sec-fetch-mode, sec-fetch-dest, referer, priority, x-forwarded-port
cache-control
private, max-age=0, no-cache
api-version
1.0
access-control-allow-credentials
true
cf-ray
8d8716557b9abb61-FRA
access-control-allow-origin
*
server
cloudflare
favicon.ico
wetrafileexu.pages.dev/ 		0
631 B 		Other
General
Check archive.org
Download Go to
Full URL
https://wetrafileexu.pages.dev/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2_1) AppleWebKit/537.3666 (KHTML, like Gecko) Chrome/110.0.0.0.0 Safari/537.3666
Referer
https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/

Response headers

cache-control
no-store
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QkzzGrqg27X94xtYIAjM8sVZ1%2BkNtqeIdW0a%2BbyWtj98IyFJGGlwlF9Pz2yd767X1FwoyeCGlhjhigZyoIAHLFdcS4y1s3soTdmHm4ybW4BzT%2B2FyORZG5QbfzVhaZBWfEmZExgX1%2BfpDEguUSQjT%2BfhzgjQ"}],"group":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8d87165f78fb913c-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=8720&sent=30&recv=21&lost=0&retrans=0&sent_bytes=19301&recv_bytes=5936&delivery_rate=103178&cwnd=18000&unsent_bytes=0&cid=9ff25f1ae35d9f55&ts=1979&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sat, 26 Oct 2024 02:41:26 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=1,i

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online) Generic Email (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| Popper object| bootstrap

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://wetrafileexu.pages.dev/jquery.min.v2.js
Message:
Failed to load resource: the server responded with a status of 404 ()
recommendation verbose URL: https://wetrafileexu.pages.dev/list?e=c********.d*******@u**********.de/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network error URL: https://wetrafileexu.pages.dev/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff