usmaninterlining.com
Open in
urlscan Pro
69.46.6.135
Malicious Activity!
Public Scan
Effective URL: https://usmaninterlining.com/wetransfer/
Submission: On November 09 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 27th 2021. Valid for: 3 months.
This is the only time usmaninterlining.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WeTransfer (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 13 | 69.46.6.135 69.46.6.135 | 29802 (HVC-AS) (HVC-AS) | |
1 | 2606:4700::68... 2606:4700::6810:125e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 2 |
ASN29802 (HVC-AS, US)
PTR: 69-46-6-135.static.hvvc.us
usmaninterlining.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
usmaninterlining.com
2 redirects
usmaninterlining.com |
225 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
7 KB |
12 | 2 |
Domain | Requested by | |
---|---|---|
13 | usmaninterlining.com |
2 redirects
usmaninterlining.com
|
1 | cdnjs.cloudflare.com |
usmaninterlining.com
|
12 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
usmaninterlining.com cPanel, Inc. Certification Authority |
2021-09-27 - 2021-12-26 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-09-21 - 2022-09-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://usmaninterlining.com/wetransfer/
Frame ID: 94FD99562D6781226A52DF4A67467E70
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Log in | WeTransferPage URL History Show full URLs
-
http://usmaninterlining.com/wetransfer
HTTP 301
https://usmaninterlining.com/wetransfer HTTP 301
https://usmaninterlining.com/wetransfer/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://usmaninterlining.com/wetransfer
HTTP 301
https://usmaninterlining.com/wetransfer HTTP 301
https://usmaninterlining.com/wetransfer/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
usmaninterlining.com/wetransfer/ Redirect Chain
|
11 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
usmaninterlining.com/wetransfer/vendor/bootstrap/css/ |
138 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
usmaninterlining.com/wetransfer/style/ |
2 KB 618 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.css
usmaninterlining.com/wetransfer/style/ |
37 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wetransfer.png
usmaninterlining.com/wetransfer/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
weT.png
usmaninterlining.com/wetransfer/images/ |
29 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-2.2.3.min.js
usmaninterlining.com/wetransfer/vendor/jquery/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
usmaninterlining.com/wetransfer/vendor/bootstrap/js/ |
52 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
data.js
usmaninterlining.com/wetransfer/js/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w3.jpg
usmaninterlining.com/wetransfer/images/ |
37 KB 37 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont.woff2
usmaninterlining.com/wetransfer/fonts/ |
75 KB 75 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WeTransfer (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler boolean| ndsj function| HttpClient function| rand function| token function| w function| A function| $ function| jQuery function| Popper object| bootstrap object| text_holder object| IagreeBtn0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
usmaninterlining.com
2606:4700::6810:125e
69.46.6.135
025a17a3f4cdb31d295e09d55c7e18044514540ba281bc921b13f48fe5906810
11657aec9fb4f05f3647f8b805efc2820ca05f26516494baa2880db98430f5e8
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
75e6810b2c599c15cfcf3b49e71ff8dbe6984c1e83dd3827133c20df944f172b
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
9b8486131fddb370c0766a22e3da94a0e71acb962f0b7100e6a93f86df27a419
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
cdb9e3adf65d66fd77c7581dfd8dbc10899e4a0bccdc993d6e466c60f37fbc20
d116994c4f3ef6809d64c14e669c218fec1608b5ea553261815e5028a022c665
d20600196f5841c359ddeec2535811c23d857d4895760e7c7bfa561f7d17a501
f164cfab1b431202820695a0ec41d25957cb7b51b8699f6da6286d6c0688bc46