urlscan.io logo urlscan.io
SecurityTrails logo

wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro Open in urlscan Pro
172.67.141.20  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/
Submission: On November 11 via api from US — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 172.67.141.20, located in United States and belongs to CLOUDFLARENET, US. The main domain is wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro.
TLS certificate: Issued by WE1 on November 7th 2024. Valid for: 3 months.
This is the only time wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

IP Address AS Autonomous System
4 172.67.141.20 13335 (CLOUDFLAR...)
4 1
Domain Requested by
4 wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro
4 1

This site contains no links.

Subject Issuer Validity Valid
en-wetransfer.pro
WE1		 2024-11-07 -
2025-02-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/
Frame ID: 53CEA81FD191C65580C19E66E1F3D58F
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Unique Download Link | WeTransfer

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

985 kB
Transfer

996 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/ 		13 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.141.20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4ad55342fb278ff3dc70bc9f391c2b5597e8c9aa24d0ef3d688499321f5f38e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8e0ee9b8dd1ce1ed-MRS
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Mon, 11 Nov 2024 14:18:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UO7CasunHd%2B5bHLJ6d9nKNPFPsAxBDN16Kmoq7jd4IFGJtl4wQmaQziokH1h%2FBy7ccdF0XeXchYqv5lNgZp8aGrC0mMTGu%2Fx9g8ZA72VWZnb1Y%2Fu2UxJ6Z1Q57epwJe%2Bw9RfMbOhtd0mVhTfkajS2wSvGin9ZoAEGCI5nGpx7b6vaq%2BbvUzuxlaeqVgqJ4NQF5rPNEk%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=28087&sent=7&recv=8&lost=0&retrans=0&sent_bytes=3910&recv_bytes=2389&delivery_rate=139383&cwnd=253&unsent_bytes=0&cid=f2f567f99d049764&ts=1760&x=0"
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed
style.css
wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/ 		7 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/style.css
Requested by
Host: wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro
URL: https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.141.20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d58f4401c1ad0717177f8bc9153d1e193850a9917878ca8bb31b15204efcd434

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/

Response headers

cache-control
public, max-age=604800
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
MISS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0ANKdDeU7EJrugmB%2F1logAzCfxV9ZYcoV4y5yqeLQfkAf58fjSxagcBL5fEeL0zgeXQzDL%2F7Go%2Fl%2FpPPO8Re8mQphiVUd1cMwgpYgj97naEcsz3UuBh%2FXBFSw0HES2dOxhON5xvkpQZoXIvZzWaMIuIO%2FSnj1tAvVnFij%2F3Hf3y7hgVXXHF48sCXyBOcR%2BcANJf7B2Y%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e0ee9bc5acae1ed-MRS
expires
Mon, 18 Nov 2024 14:18:41 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=27929&sent=14&recv=13&lost=0&retrans=0&sent_bytes=8211&recv_bytes=2544&delivery_rate=278185&cwnd=256&unsent_bytes=0&cid=f2f567f99d049764&ts=2252&x=0"
date
Mon, 11 Nov 2024 14:18:42 GMT
x-turbo-charged-by
LiteSpeed
content-type
text/css
last-modified
Thu, 07 Nov 2024 16:14:48 GMT
vary
Accept-Encoding
server
cloudflare
bg.png
wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/ 		936 KB
937 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/bg.png
Requested by
Host: wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro
URL: https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.141.20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
774391c307037f4702ece38e372b24d6689aa56057d63d7eb11003da6faba7de

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/style.css

Response headers

cf-cache-status
MISS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fq88y4r%2FK5lYpCLLSZoHJGK6aSnmEAoTdFbKGTzNtXB7WCMPyJqFhvu87WvsgIMD1tUAoOap79vLi6wOjRUtEHs1yZsjR79bwIZ%2Fca%2FBqpxNbzFC3LTZev%2F6ciPqZwdHi2XEPSy8U2VciNk0EWVaxdFXGJbklXxVFUu7%2FposVhXbXcJIRiU289fNyuMChpoKLVn35Go%3D"}],"group":"cf-nel","max_age":604800}
expires
Mon, 18 Nov 2024 14:18:44 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=28272&sent=19&recv=17&lost=0&retrans=0&sent_bytes=10946&recv_bytes=2720&delivery_rate=278185&cwnd=256&unsent_bytes=0&cid=f2f567f99d049764&ts=4806&x=0"
date
Mon, 11 Nov 2024 14:18:44 GMT
content-type
image/png
last-modified
Thu, 07 Nov 2024 16:14:48 GMT
vary
Accept-Encoding
cache-control
public, max-age=604800
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8e0ee9cc0aeee1ed-MRS
accept-ranges
bytes
content-length
957981
x-turbo-charged-by
LiteSpeed
server
cloudflare
favicon.png
wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/ 		41 KB
41 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/favicon.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.141.20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d12161435ace47c6883360e08466508593325f134c1852b1d0e6e75d5f76adda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://wetransfer-com-downloads-4hbdazdn7ybgiariadg3nki.en-wetransfer.pro/

Response headers

cf-cache-status
MISS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VzLhr1xqO%2BSI7oKaIA3jt7lDMw%2F5ASbItH004NprLACerczfF9BLDttE1oCHWe9iHiwyiFvS1%2Fi7iCLTeLZjfZcZd2hR9I64TAok%2BQ%2B2Z57rdD1wL6N7ZtntC6GcXkMxtl97JQj5P44W7%2FiO0Q%2B%2F3gLcaWnWuu48syHUq1vXJxvxxr8Zq8luWfh79z6D3P8tNYRYkJY%3D"}],"group":"cf-nel","max_age":604800}
expires
Mon, 18 Nov 2024 14:18:48 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=33322&sent=781&recv=86&lost=0&retrans=0&sent_bytes=973634&recv_bytes=2785&delivery_rate=10751015&cwnd=881&unsent_bytes=0&cid=f2f567f99d049764&ts=8896&x=0"
date
Mon, 11 Nov 2024 14:18:48 GMT
content-type
image/png
last-modified
Thu, 07 Nov 2024 16:14:48 GMT
vary
Accept-Encoding
cache-control
public, max-age=604800
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8e0ee9e5ac6ee1ed-MRS
accept-ranges
bytes
content-length
41566
x-turbo-charged-by
LiteSpeed
server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies