wetransfer-plussecure8.ml Open in urlscan Pro
2606:4700:3037::681b:ab5e Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://wetransfer-plussecure8.ml/wetransfer
Effective URL:
http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1...
Submission Tags: @ipnigh
Submission: On April 12 via api (April 12th 2020, 2:13:19 pm UTC) from GB

Summary HTTP 29 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 29 HTTP transactions. The main IP is 2606:4700:3037::681b:ab5e, located in United States and belongs to CLOUDFLARENET, US. The main domain is wetransfer-plussecure8.ml.

This is the only time wetransfer-plussecure8.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 28	2606:4700:303... 2606:4700:3037::681b:ab5e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	143.204.97.114 143.204.97.114	16509 (AMAZON-02) (AMAZON-02)
29	3

28 2606:4700:3037::681b:ab5e (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

wetransfer-plussecure8.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.97.114 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-97-114.fra50.r.cloudfront.net

backgrounds.wetransfer.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	wetransfer-plussecure8.ml 2 redirects wetransfer-plussecure8.ml	521 KB
1	wetransfer.net backgrounds.wetransfer.net	15 KB
0	Failed function sub() { [native code] }. Failed
29	3

	Domain	Requested by
28	wetransfer-plussecure8.ml	2 redirects wetransfer-plussecure8.ml
1	backgrounds.wetransfer.net	wetransfer-plussecure8.ml
0	fdcgdnkidjaadafnichfpabhfomcebme Failed	wetransfer-plussecure8.ml
29	3

This site contains links to these domains. Also see Links.

Domain
www.000webhost.com

Subject Issuer	Validity	Valid
wetransfer.net Amazon	`2019-09-09` - `2020-10-09`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 8DB15BB5852E89829781037EA6990F08
Requests: 12 HTTP requests in this frame

Frame: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html
Frame ID: CEE3DC6CB9CD33B8BCB8DC26B17C8CFD
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://wetransfer-plussecure8.ml/wetransfer HTTP 301
http://wetransfer-plussecure8.ml/wetransfer/ HTTP 302
http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fi... Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

29
Requests

3 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

571 kB
Transfer

1126 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.000webhost.com/?utm_source=000webhostapp&utm_campaign=000_logo&utm_medium=website_wetransfer-205-105&utm_content=footer_img

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://wetransfer-plussecure8.ml/wetransfer HTTP 301
http://wetransfer-plussecure8.ml/wetransfer/ HTTP 302
http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

29 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 1ss3elv1t7xsvskc2v569u4d.php Show response wetransfer-plussecure8.ml/wetransfer/ Redirect Chain http://wetransfer-plussecure8.ml/wetransfer http://wetransfer-plussecure8.ml/wetransfer/ http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1...	234 KB 170 KB	574ms 574ms	Document text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.4 Resource Hash `9d2114b561290a8a8399a8664461a1317a2de9332ce5695f797d3925f2849779` Request headers Host wetransfer-plussecure8.ml Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Cookie __cfduid=d407a26d4040bda241e559297579544321586700766; PHPSESSID=1l27k76hambb0qo4bvil28d651 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:47 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive X-Powered-By PHP/7.4.4 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache CF-Cache-Status DYNAMIC Server cloudflare CF-RAY 582d8b542883c2db-FRA Content-Encoding gzip Redirect headers Date Sun, 12 Apr 2020 14:12:47 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive X-Powered-By PHP/7.4.4 Set-Cookie PHPSESSID=1l27k76hambb0qo4bvil28d651; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Location 1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 CF-Cache-Status DYNAMIC Server cloudflare CF-RAY 582d8b4ffec9c2db-FRA
GET		webrtc-patch.js fdcgdnkidjaadafnichfpabhfomcebme/scripts/	0 0

GET H/1.1	404 Not Found	analytics.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/	0 0	562ms 556ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/analytics.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:48 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b57cc1edfd3-FRA
GET H/1.1	200 OK	1ss3elv1t7xsvskc2v569u4d.php Show response wetransfer-plussecure8.ml/wetransfer/	234 KB 170 KB	566ms 561ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.4 Resource Hash `9d2114b561290a8a8399a8664461a1317a2de9332ce5695f797d3925f2849779` Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 12 Apr 2020 14:12:48 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare X-Powered-By PHP/7.4.4 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection keep-alive CF-RAY 582d8b57ccc69736-FRA Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	404 Not Found	bWqOLA69nu2fsMi45LjA.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/	0 0	543ms 542ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bWqOLA69nu2fsMi45LjA.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:49 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b5ece09dfd3-FRA
GET H/1.1	404 Not Found	gtm.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/	0 0	571ms 565ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/gtm.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:49 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b5edbc6dfcb-FRA
GET		webrtc-patch.js fdcgdnkidjaadafnichfpabhfomcebme/scripts/	0 0

GET H/1.1	200 OK	application-bd95c1c273b3b6f2c6b24f2eaeeaef30be54981e5727d3ac981a5e003b93d6a6.css wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/	391 KB 48 KB	1618ms 1612ms	Stylesheet text/css	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/application-bd95c1c273b3b6f2c6b24f2eaeeaef30be54981e5727d3ac981a5e003b93d6a6.css Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7650cccb518dc3993c51d7a477c1676cf331e22856d2a5456178e5dc96f0ac39` Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:50 GMT Content-Encoding gzip CF-Cache-Status MISS Last-Modified Fri, 03 Apr 2020 22:52:16 GMT Server cloudflare ETag W/"61cf2-5a26ac4e0f85a" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b5ecc619716-FRA
GET H/1.1	200 OK	remove.js.download Show response wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/	85 KB 30 KB	582ms 576ms	Script application/javascript	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/remove.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f` Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:49 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Last-Modified Fri, 03 Apr 2020 22:52:16 GMT Server cloudflare ETag W/"15285-5a26ac4dba12c" Transfer-Encoding chunked Content-Type application/javascript Connection keep-alive CF-RAY 582d8b5ec8991f3d-FRA
GET H/1.1	200 OK	Cookie set bg.html Show response wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	18 KB 5 KB	548ms 547ms	Document text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `33588276e260bfa6e5cb5e3639e07d1495789140ee856fe9df17b192c00ba4e6` Request headers Host wetransfer-plussecure8.ml Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Response headers Date Sun, 12 Apr 2020 14:12:51 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d2ab4ba308a900e89e1e7c9a6a0a800431586700770; expires=Tue, 12-May-20 14:12:50 GMT; path=/; domain=.wetransfer-plussecure8.ml; HttpOnly; SameSite=Lax Last-Modified Fri, 03 Apr 2020 22:52:16 GMT CF-Cache-Status DYNAMIC Server cloudflare CF-RAY 582d8b68fe0b9716-FRA Content-Encoding gzip
GET H/1.1	200 OK	1ss3elv1t7xsvskc2v569u4d.php wetransfer-plussecure8.ml/wetransfer/	1 KB 1 KB	275ms 275ms	Image text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.4 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 12 Apr 2020 14:12:50 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare X-Powered-By PHP/7.4.4 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection keep-alive CF-RAY 582d8b68fb561f3d-FRA Expires Thu, 19 Nov 1981 08:52:00 GMT
GET DATA	200 OK	truncated /	18 KB 18 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3b88fd385e931c8c787986ae5f6d21e897c9e493fda93b1af523e0060032f569` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Origin http://wetransfer-plussecure8.ml Response headers Content-Type application/font-woff2;charset=utf-8
GET DATA	200 OK	truncated /	18 KB 18 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `18f3122036b407fe4d392273d5dc596e5195a0c75ac3d53138a63f72430d5d26` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://wetransfer-plussecure8.ml/wetransfer/1ss3elv1t7xsvskc2v569u4d.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Origin http://wetransfer-plussecure8.ml Response headers Content-Type application/font-woff2;charset=utf-8
GET H/1.1	200 OK	screen.css wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	25 KB 9 KB	815ms 814ms	Stylesheet text/css	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/screen.css Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9cf371add05f24fd2a9522b90aa18961c4c1f71137df2e2ddac7966711f7b14d` Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:52 GMT Content-Encoding gzip CF-Cache-Status MISS Last-Modified Fri, 03 Apr 2020 22:52:16 GMT Server cloudflare ETag W/"65c3-5a26ac4e06fa2" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b6c79499736-FRA
GET H/1.1	404 Not Found	wallpaper-api-2.0.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	541ms 539ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/wallpaper-api-2.0.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:52 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b6e0ac19716-FRA
GET H/1.1	404 Not Found	wallpaper-toolbox-0.4.0.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	547ms 546ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/wallpaper-toolbox-0.4.0.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:52 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b6e0aabdfcb-FRA
GET H/1.1	404 Not Found	jquery.min.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	283ms 282ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/jquery.min.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:51 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b6e0df2dfd3-FRA
GET H/1.1	404 Not Found	bodymovin.min.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	296ms 295ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bodymovin.min.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:51 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b6e0817c2db-FRA
GET H/1.1	404 Not Found	copy.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	556ms 550ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/copy.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:52 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b6e1f7b9748-FRA
GET H/1.1	404 Not Found	trackers.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	622ms 338ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/trackers.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:52 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b6fc99bdfd3-FRA
GET H/1.1	200 OK	remove.js(1).download Show response wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	85 KB 85 KB	622ms 326ms	Script text/plain	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/remove.js(1).download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f` Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:52 GMT CF-Cache-Status DYNAMIC Last-Modified Fri, 03 Apr 2020 22:52:16 GMT Server cloudflare ETag "15285-5a26ac4e01d9a" Connection keep-alive Accept-Ranges bytes CF-RAY 582d8b6fecc4c2db-FRA Content-Length 86661
GET H2	200	1px.png backgrounds.wetransfer.net/plus/201708/size_orange_v1/images/ Frame CEE3	15 KB 15 KB	247ms 160ms	Image image/png	143.204.97.114 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://backgrounds.wetransfer.net/plus/201708/size_orange_v1/images/1px.png Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.97.114 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-97-114.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `1fd7ade374faaf1e5ab4a1b13e97e476bd0167d1c25ca0e198bed49d2e53928a` Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 12 Apr 2020 14:12:53 GMT via 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront) last-modified Tue, 19 Jun 2018 12:51:28 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "c3d9ca9b5f619af2605d125aade2bc7a" x-cache Miss from cloudfront content-type image/png status 200 accept-ranges bytes content-length 14987 x-amz-cf-id 3OsW-El9dwH3Jq01CY96sg3jm5r_hbHqrPTdUxCGsHTSJTX1IA2hSg==
GET H/1.1	404 Not Found	texture.png wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/images/ Frame CEE3	1 KB 1 KB	546ms 546ms	Image text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/images/texture.png Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a80daa1b4f68151ba34b51d5f2cd4f4ea8025b8afa402c7317b1bde2d54db44c` Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:52 GMT Content-Encoding gzip CF-Cache-Status MISS Server cloudflare Vary accept-language,accept-charset, Accept-Encoding Content-Language en Content-Type text/html; charset=utf-8 Cache-Control max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b718a0e9748-FRA
GET H/1.1	404 Not Found	FreightSans-Pro-Semibold.woff wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/fonts/ Frame CEE3	0 0	554ms 553ms	Font text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/fonts/FreightSans-Pro-Semibold.woff Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Origin http://wetransfer-plussecure8.ml Response headers Date Sun, 12 Apr 2020 14:12:52 GMT Content-Encoding gzip CF-Cache-Status MISS Server cloudflare Vary accept-language,accept-charset, Accept-Encoding Content-Language en Content-Type text/html; charset=utf-8 Cache-Control max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b718e9d9736-FRA
GET H/1.1	404 Not Found	FreightSans-Pro-Medium.woff wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/fonts/ Frame CEE3	0 0	550ms 549ms	Font text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/fonts/FreightSans-Pro-Medium.woff Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Origin http://wetransfer-plussecure8.ml Response headers Date Sun, 12 Apr 2020 14:12:52 GMT Content-Encoding gzip CF-Cache-Status MISS Server cloudflare Vary accept-language,accept-charset, Accept-Encoding Content-Language en Content-Type text/html; charset=utf-8 Cache-Control max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b718c81dfcb-FRA
GET H/1.1	404 Not Found	wallpaper-api-2.0.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	296ms 295ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/wallpaper-api-2.0.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:52 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b720a96c2db-FRA
GET H/1.1	404 Not Found	wallpaper-toolbox-0.4.0.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	736ms 735ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/wallpaper-toolbox-0.4.0.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:53 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b73ef7ac2db-FRA
GET H/1.1	404 Not Found	jquery.min.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	281ms 281ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/jquery.min.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:53 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b787a26c2db-FRA
GET H/1.1	404 Not Found	bodymovin.min.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	277ms 277ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bodymovin.min.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:53 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b7a3e68c2db-FRA
GET H/1.1	404 Not Found	copy.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	297ms 297ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/copy.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:54 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b7bfa83c2db-FRA
GET H/1.1	404 Not Found	trackers.js.download wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/ Frame CEE3	0 0	296ms 295ms	Script text/html	2606:4700:3037::681b:ab5e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/trackers.js.download Requested by Host: wetransfer-plussecure8.ml URL: http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html Protocol HTTP/1.1 Server 2606:4700:3037::681b:ab5e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://wetransfer-plussecure8.ml/wetransfer/WeTransfer_files/bg.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 12 Apr 2020 14:12:54 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Vary accept-language,accept-charset Content-Language en Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 582d8b7dded2c2db-FRA

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fdcgdnkidjaadafnichfpabhfomcebme
URL: chrome-extension://fdcgdnkidjaadafnichfpabhfomcebme/scripts/webrtc-patch.js

Domain: fdcgdnkidjaadafnichfpabhfomcebme
URL: chrome-extension://fdcgdnkidjaadafnichfpabhfomcebme/scripts/webrtc-patch.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.wetransfer-plussecure8.ml/	1970-01-19 09:28:12	Name: __cfduid Value: d2ab4ba308a900e89e1e7c9a6a0a800431586700770
			wetransfer-plussecure8.ml/	1969-12-31 23:59:59	Name: PHPSESSID Value: kq3ks665js7bvasj67cdf3adra

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

backgrounds.wetransfer.net
fdcgdnkidjaadafnichfpabhfomcebme
wetransfer-plussecure8.ml
fdcgdnkidjaadafnichfpabhfomcebme
143.204.97.114
2606:4700:3037::681b:ab5e
18f3122036b407fe4d392273d5dc596e5195a0c75ac3d53138a63f72430d5d26
1fd7ade374faaf1e5ab4a1b13e97e476bd0167d1c25ca0e198bed49d2e53928a
33588276e260bfa6e5cb5e3639e07d1495789140ee856fe9df17b192c00ba4e6
3b88fd385e931c8c787986ae5f6d21e897c9e493fda93b1af523e0060032f569
7650cccb518dc3993c51d7a477c1676cf331e22856d2a5456178e5dc96f0ac39
9cf371add05f24fd2a9522b90aa18961c4c1f71137df2e2ddac7966711f7b14d
9d2114b561290a8a8399a8664461a1317a2de9332ce5695f797d3925f2849779
a80daa1b4f68151ba34b51d5f2cd4f4ea8025b8afa402c7317b1bde2d54db44c
d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

wetransfer-plussecure8.ml Open in urlscan Pro 2606:4700:3037::681b:ab5e Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

29 Requests

3 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

571 kBTransfer

1126 kBSize

2 Cookies

1 Outgoing links

Page URL History

Redirected requests

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

wetransfer-plussecure8.ml Open in urlscan Pro
2606:4700:3037::681b:ab5e Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

29
Requests

3 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

571 kB
Transfer

1126 kB
Size

2
Cookies

29 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!