wtr.etatronds-it.com Open in urlscan Pro
93.157.63.185 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx
Submission: On November 17 via automatic, source openphish (November 17th 2021, 1:08:21 am UTC) — Scanned from IT

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 93.157.63.185, located in Russian Federation and belongs to NFORCE, NL. The main domain is wtr.etatronds-it.com.
TLS certificate: Issued by R3 on November 3rd 2021. Valid for: 3 months.

This is the only time wtr.etatronds-it.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

	IP Address		AS Autonomous System
10	93.157.63.185 93.157.63.185		43350 (NFORCE) (NFORCE)
10	1

10 93.157.63.185 (Russian Federation)

ASN43350 (NFORCE, NL)
PTR: server.dnsfreevoice.com

wtr.etatronds-it.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	etatronds-it.com wtr.etatronds-it.com	19 KB
10	1

	Domain	Requested by
10	wtr.etatronds-it.com	wtr.etatronds-it.com
10	1

This site contains no links.

Subject Issuer	Validity	Valid
wtr.etatronds-it.com R3	`2021-11-03` - `2022-02-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx
Frame ID: B16156914EC482AF60B5AD99F9C01B35
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WeTransfer

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

19 kB
Transfer

8467 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/	26 KB 3 KB	227ms 37ms	Document text/html	93.157.63.185 NFORCE
General Check archive.org Show headers Download Go to Full URL https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 93.157.63.185 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS server.dnsfreevoice.com Software / Resource Hash `094136b43e2fd3df8439e11fd8b3823c61118f476948618f1c906c05073e14c2` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language it-IT,it;q=0.9 Response headers content-type text/html last-modified Wed, 09 Jun 2021 01:16:30 GMT accept-ranges bytes content-encoding br vary Accept-Encoding content-length 2466 date Wed, 17 Nov 2021 01:08:16 GMT alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET H2	200	main.css wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/css/	8 KB 2 KB	37ms 37ms	Stylesheet text/css	93.157.63.185 NFORCE
General Check archive.org Show headers Download Go to Full URL https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/css/main.css Requested by Host: wtr.etatronds-it.com URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 93.157.63.185 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS server.dnsfreevoice.com Software / Resource Hash `6d6cf67b746e0a9e7ef1cf897e6c381b0843e0ab08d612493957cd37c344e424` Request headers Accept-Language it-IT,it;q=0.9 Referer https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Wed, 17 Nov 2021 01:08:16 GMT content-encoding br last-modified Wed, 09 Jun 2021 01:21:56 GMT vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 1851 expires Wed, 24 Nov 2021 01:08:16 GMT
GET H2	200	main.prod.js Show response wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/js/dist/	886 B 483 B	37ms 36ms	Script application/javascript	93.157.63.185 NFORCE
General Check archive.org Show headers Download Go to Full URL https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/js/dist/main.prod.js Requested by Host: wtr.etatronds-it.com URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 93.157.63.185 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS server.dnsfreevoice.com Software / Resource Hash `1b9439a0b0659450e5fd483a9bc556ff5a04a91e3058d81995200b8d9eba1ccf` Request headers Accept-Language it-IT,it;q=0.9 Referer https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Wed, 17 Nov 2021 01:08:16 GMT content-encoding br last-modified Wed, 09 Jun 2021 01:11:41 GMT vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 412 expires Wed, 24 Nov 2021 01:08:16 GMT
GET H2	200	papaparse.min.js Show response wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/js/	32 KB 8 KB	37ms 37ms	Script application/javascript	93.157.63.185 NFORCE
General Check archive.org Show headers Download Go to Full URL https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/js/papaparse.min.js Requested by Host: wtr.etatronds-it.com URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 93.157.63.185 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS server.dnsfreevoice.com Software / Resource Hash `973cc34081a91649314e7f3a88904c778bd72424f53a260815893ab18d441e74` Request headers Accept-Language it-IT,it;q=0.9 Referer https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Wed, 17 Nov 2021 01:08:16 GMT content-encoding br last-modified Wed, 09 Jun 2021 00:43:40 GMT vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 8164 expires Wed, 24 Nov 2021 01:08:16 GMT
GET H2	200	download-list.prod.js Show response wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/js/dist/	1 KB 672 B	40ms 40ms	Script application/javascript	93.157.63.185 NFORCE
General Check archive.org Show headers Download Go to Full URL https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/js/dist/download-list.prod.js Requested by Host: wtr.etatronds-it.com URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 93.157.63.185 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS server.dnsfreevoice.com Software / Resource Hash `3a0f79ea23840d05ea71c390a9fd883b98b73476c75c6c5cf5697843213424a5` Request headers Accept-Language it-IT,it;q=0.9 Referer https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Wed, 17 Nov 2021 01:08:16 GMT content-encoding br last-modified Wed, 09 Jun 2021 01:11:46 GMT vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 615 expires Wed, 24 Nov 2021 01:08:16 GMT
GET H2	200	logo.png wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/images/	5 KB 5 KB	56ms 56ms	Image image/png	93.157.63.185 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/images/logo.png Requested by Host: wtr.etatronds-it.com URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 93.157.63.185 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS server.dnsfreevoice.com Software / Resource Hash `c9cbd958adce91008f3ff15f6567003821b33277582c939135bc9b4c539d5f48` Request headers Accept-Language it-IT,it;q=0.9 Referer https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Wed, 17 Nov 2021 01:08:16 GMT cache-control public, max-age=604800 last-modified Thu, 23 Jan 2020 00:18:15 GMT accept-ranges bytes content-type image/png content-length 4691 expires Wed, 24 Nov 2021 01:08:16 GMT
GET H2	206	1805971670.mp4 wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/images/	8 MB 0	53ms 53ms	Media video/mp4	93.157.63.185 NFORCE
General Check archive.org Show headers Download Go to Full URL https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/images/1805971670.mp4 Requested by Host: wtr.etatronds-it.com URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 93.157.63.185 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS server.dnsfreevoice.com Software / Resource Hash Request headers Referer https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx Accept-Encoding identity;q=1, ;q=0 Accept-Language* it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Range bytes=0- Response headers Content-Range bytes 0-12060470/12060471 date Wed, 17 Nov 2021 01:08:16 GMT last-modified Wed, 27 May 2020 05:38:40 GMT Content-Length 12060471 content-type video/mp4
GET H3-Q050	404	bg.gif wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/images/	708 B 708 B	32ms 32ms	Image text/html	93.157.63.185 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/images/bg.gif Requested by Host: wtr.etatronds-it.com URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/css/main.css Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 93.157.63.185 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS server.dnsfreevoice.com Software / Resource Hash `37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa` Request headers Accept-Language it-IT,it;q=0.9 Referer https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/css/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers pragma no-cache date Wed, 17 Nov 2021 01:08:16 GMT cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-length 708 content-type text/html
GET H3-Q050	403	Freight-Sans-Medium.otf wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/fonts/	0 0	32ms 32ms	Font text/html	93.157.63.185 NFORCE
General Check archive.org Show headers Download Go to Full URL https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/fonts/Freight-Sans-Medium.otf Requested by Host: wtr.etatronds-it.com URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/css/main.css Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 93.157.63.185 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS server.dnsfreevoice.com Software / Resource Hash Request headers Referer https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/css/main.css Origin https://wtr.etatronds-it.com Accept-Language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers pragma no-cache date Wed, 17 Nov 2021 01:08:16 GMT cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-length 699 content-type text/html
GET H3-Q050	200	files.csv Show response wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/	243 B 297 B	32ms 32ms	XHR text/csv	93.157.63.185 NFORCE
General Check archive.org Show headers Download Go to Full URL https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/files.csv Requested by Host: wtr.etatronds-it.com URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/js/dist/download-list.prod.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 93.157.63.185 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS server.dnsfreevoice.com Software / Resource Hash `bd05895403803b4685c884ee97cb6a2074f93103704cad0f27d484cc2ded69f7` Request headers Accept-Language it-IT,it;q=0.9 Referer https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/?email=mystiquerough7@xxxxx.xxx User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Wed, 17 Nov 2021 01:08:16 GMT last-modified Wed, 09 Jun 2021 00:48:56 GMT accept-ranges bytes content-length 243 content-type text/csv

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/images/bg.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://wtr.etatronds-it.com/BTozJAfCAkcEVcX/dMWwNbubXxJkZOe/assets/fonts/Freight-Sans-Medium.otf Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

wtr.etatronds-it.com
93.157.63.185
094136b43e2fd3df8439e11fd8b3823c61118f476948618f1c906c05073e14c2
1b9439a0b0659450e5fd483a9bc556ff5a04a91e3058d81995200b8d9eba1ccf
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
3a0f79ea23840d05ea71c390a9fd883b98b73476c75c6c5cf5697843213424a5
6d6cf67b746e0a9e7ef1cf897e6c381b0843e0ab08d612493957cd37c344e424
973cc34081a91649314e7f3a88904c778bd72424f53a260815893ab18d441e74
bd05895403803b4685c884ee97cb6a2074f93103704cad0f27d484cc2ded69f7
c9cbd958adce91008f3ff15f6567003821b33277582c939135bc9b4c539d5f48

wtr.etatronds-it.com Open in urlscan Pro 93.157.63.185 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

19 kBTransfer

8467 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

wtr.etatronds-it.com Open in urlscan Pro
93.157.63.185 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

19 kB
Transfer

8467 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!