wetranfer.se
Open in
urlscan Pro
78.128.92.188
Malicious Activity!
Public Scan
Effective URL: https://wetranfer.se/secure-login-share/
Submission: On January 31 via manual from US
Summary
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on January 29th 2018. Valid for: a year.
This is the only time wetranfer.se was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) DocuSign (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 65.55.169.46 65.55.169.46 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
1 1 | 104.47.45.28 104.47.45.28 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
1 | 52.16.42.78 52.16.42.78 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
5 | 78.128.92.188 78.128.92.188 | 44901 (BELCLOUD) (BELCLOUD) | |
1 | 13.32.145.189 13.32.145.189 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
10 | 4 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
PTR: na01-bl2-obe.ptr.protection.outlook.com
na01.safelinks.protection.outlook.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
nam04.safelinks.protection.outlook.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-16-42-78.eu-west-1.compute.amazonaws.com
redirect-secure.droppages.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-145-189.fra56.r.cloudfront.net
backgrounds.wetransfer.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
wetranfer.se
wetranfer.se |
65 KB |
2 |
outlook.com
2 redirects
na01.safelinks.protection.outlook.com nam04.safelinks.protection.outlook.com |
1 KB |
1 |
wetransfer.net
backgrounds.wetransfer.net cdn.wetransfer.net Failed |
483 KB |
1 |
droppages.com
redirect-secure.droppages.com |
508 B |
10 | 4 |
Domain | Requested by | |
---|---|---|
5 | wetranfer.se |
wetranfer.se
|
1 | backgrounds.wetransfer.net |
wetranfer.se
|
1 | redirect-secure.droppages.com | |
1 | nam04.safelinks.protection.outlook.com | 1 redirects |
1 | na01.safelinks.protection.outlook.com | 1 redirects |
0 | cdn.wetransfer.net Failed |
wetranfer.se
|
10 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.wetranfer.se COMODO RSA Domain Validation Secure Server CA |
2018-01-29 - 2019-01-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://wetranfer.se/secure-login-share/
Frame ID: (EFFDAE5B53684726E8027D06C747F2CE)
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredirect-secure.droppages.com%2F&data=02%7C01%7CDonald.Chu...
HTTP 302
https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredirect-secure.droppages.com%2F&data=02%7C01%7CDonald.Chu... HTTP 302
http://redirect-secure.droppages.com/ Page URL
- https://wetranfer.se/secure-login-share/ Page URL
Detected technologies
Ruby (Programming Languages) ExpandDetected patterns
- meta csrf-param /authenticity_token/i
Windows Server (Operating Systems) Expand
Detected patterns
- headers server /IIS(?:\/([\d.]+))?/i
Ruby on Rails (Web Frameworks) Expand
Detected patterns
- meta csrf-param /authenticity_token/i
IIS (Web Servers) Expand
Detected patterns
- headers server /IIS(?:\/([\d.]+))?/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredirect-secure.droppages.com%2F&data=02%7C01%7CDonald.Chuppa%40myccmortgage.com%7C52644faa9eaa448c175e08d568307493%7Cc9787ba229de494491f073594c12f85d%7C1%7C1%7C636529479739692516&sdata=ff%2FBdnA6RY7EJARWKznFVfzghSc%2F9xyPXDiH1q6vHSc%3D&reserved=0
HTTP 302
https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredirect-secure.droppages.com%2F&data=02%7C01%7CDonald.Chuppa%40myccmortgage.com%7C52644faa9eaa448c175e08d568307493%7Cc9787ba229de494491f073594c12f85d%7C1%7C1%7C636529479739692516&sdata=ff%2FBdnA6RY7EJARWKznFVfzghSc%2F9xyPXDiH1q6vHSc%3D&reserved=0 HTTP 302
http://redirect-secure.droppages.com/ Page URL
- https://wetranfer.se/secure-login-share/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredirect-secure.droppages.com%2F&data=02%7C01%7CDonald.Chuppa%40myccmortgage.com%7C52644faa9eaa448c175e08d568307493%7Cc9787ba229de494491f073594c12f85d%7C1%7C1%7C636529479739692516&sdata=ff%2FBdnA6RY7EJARWKznFVfzghSc%2F9xyPXDiH1q6vHSc%3D&reserved=0 HTTP 302
- https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredirect-secure.droppages.com%2F&data=02%7C01%7CDonald.Chuppa%40myccmortgage.com%7C52644faa9eaa448c175e08d568307493%7Cc9787ba229de494491f073594c12f85d%7C1%7C1%7C636529479739692516&sdata=ff%2FBdnA6RY7EJARWKznFVfzghSc%2F9xyPXDiH1q6vHSc%3D&reserved=0 HTTP 302
- http://redirect-secure.droppages.com/
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
redirect-secure.droppages.com/ Redirect Chain
|
150 B 508 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
wetranfer.se/secure-login-share/ |
15 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
application-4a37a2f0f9235d35d45ce46c31a32a7333169b7ccbb8234e05d2ac17f619ffc0.css
wetranfer.se/secure-login-share/files/ |
305 KB 39 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MaskedPassword.js
wetranfer.se/secure-login-share/files/adobe/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office365.jpeg
wetranfer.se/secure-login-share/files/adobe/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
others.jpeg
wetranfer.se/secure-login-share/files/adobe/ |
16 KB 11 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
danoba4gl_1920x1200.jpg
backgrounds.wetransfer.net/ |
482 KB 483 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
FaktProWeb-Medium-fd3bbe8c665638bbd898d20dbf232f1bac9d2b11c31eefc006370f43ee8f1994.woff
cdn.wetransfer.net/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
FaktCyrWeb-Normal-0038c5aa5c3243bb2995139e9aeb9519f62f098d0e0f7fab6c8b655a292d857d.woff
cdn.wetransfer.net/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
FaktGrkWeb-Medium-8eb863415ca103c7f90b369e54e6be4786c90c30a06ce32f3dca803206bf74dd.woff
cdn.wetransfer.net/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- cdn.wetransfer.net
- URL
- https://cdn.wetransfer.net/assets/FaktProWeb-Medium-fd3bbe8c665638bbd898d20dbf232f1bac9d2b11c31eefc006370f43ee8f1994.woff
- Domain
- cdn.wetransfer.net
- URL
- https://cdn.wetransfer.net/assets/FaktCyrWeb-Normal-0038c5aa5c3243bb2995139e9aeb9519f62f098d0e0f7fab6c8b655a292d857d.woff
- Domain
- cdn.wetransfer.net
- URL
- https://cdn.wetransfer.net/assets/FaktGrkWeb-Medium-8eb863415ca103c7f90b369e54e6be4786c90c30a06ce32f3dca803206bf74dd.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) DocuSign (Online)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| MaskedPassword0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
backgrounds.wetransfer.net
cdn.wetransfer.net
na01.safelinks.protection.outlook.com
nam04.safelinks.protection.outlook.com
redirect-secure.droppages.com
wetranfer.se
cdn.wetransfer.net
104.47.45.28
13.32.145.189
52.16.42.78
65.55.169.46
78.128.92.188
0a414d236356660281f707e1345068834135fe80ef80a7187f0e9b15245dc9d3
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
4a37a2f0f9235d35d45ce46c31a32a7333169b7ccbb8234e05d2ac17f619ffc0
933099b34ed040d254b9f5b2fced95e76fad3f0fd933929c111259722d8ccd33
93ee4de61be217c38ee16a572de5b7ad5e5af581c24735388f6bd5917fa5bb0a
ba22fb6251ed670ef7e814fd0673b81389dbae1532b775e979de52aa08754c71