urlscan.io logo urlscan.io
SecurityTrails logo

469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev Open in urlscan Pro
35.247.106.28  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/#spcf%40hkelectric.com
Effective URL: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Submission Tags: falconsandbox
Submission: On February 07 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 35.247.106.28, located in The Dalles, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev.
TLS certificate: Issued by R3 on January 24th 2024. Valid for: 3 months.
This is the only time 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

IP Address AS Autonomous System
1 35.247.106.28 396982 (GOOGLE-CL...)
5 2606:4700:310... 13335 (CLOUDFLAR...)
2 2a06:98c1:312... 13335 (CLOUDFLAR...)
8 4
Domain Requested by
5 sdfvgbh.pages.dev 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
2 wetr-3p0.pages.dev 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
1 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
8 3

This site contains no links.

Subject Issuer Validity Valid
*.kirk.replit.dev
R3		 2024-01-24 -
2024-04-23		 3 months crt.sh
sdfvgbh.pages.dev
GTS CA 1P5		 2024-01-09 -
2024-04-08		 3 months crt.sh
wetr-3p0.pages.dev
GTS CA 1P5		 2024-02-04 -
2024-05-04		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Frame ID: EAD597D58B2B9A69A76F8CC49DC20E29
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

WeTransferaccount | WeTransfer

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

1279 kB
Transfer

1411 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/ 		277 KB
278 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.247.106.28 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.106.247.35.bc.googleusercontent.com
Software
/
Resource Hash
6977cb3f0d5e82b58012a0046e16665df036092909dea2a81837e549b20550ad

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin
*
Content-Length
283947
Content-Type
text/html; charset=utf-8
Date
Wed, 07 Feb 2024 07:41:05 GMT
Replit-Cluster
kirk
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1f39a1017906d512934d04cef8dbd816ebe0206eab872da92d30fdb554c84a89

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type
image/svg+xml
bg.png
sdfvgbh.pages.dev/ 		783 KB
784 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sdfvgbh.pages.dev/bg.png
Requested by
Host: 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
URL: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2c54 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
97915ef3518cf57623d185b62663441724cc9afdd8927518e45c36cffc84be2f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Wed, 07 Feb 2024 07:41:05 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"2cfd5689dca667351388f92ec5d22b6e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UZ6atdS2PwFBIOqZ0LHMmtOhLefM8zKCXg1zIV5eoRGTwBXvNjluz1UfwDHfdRQXixHAkLOJSvXO4v5qkkXe3KetAmHGYDsLLo%2FxoV8i6raKyzivDUwTVIvMI%2Fz7lM3bB2nXt3tiv3KJ2Uc3SDY%2FQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8519fd0febfd1da6-FRA
alt-svc
h3=":443"; ma=86400
content-length
801710
GT-Super-Display-Light.woff
sdfvgbh.pages.dev/ 		54 KB
55 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/GT-Super-Display-Light.woff
Requested by
Host: 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
URL: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2c54 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62e704e04089cc468b4bfdd61705d93959532d630e88de5ecef6064ebfd9d29e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Origin
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Wed, 07 Feb 2024 07:41:06 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6a491dee078a89c780b38ee790f48a41"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kHCS4kJ6XUoFpdgWdmnBmPBs98V0JqA0Fm6gQ3JxrdeZW7UiASdmAqN%2FbYzU8Bi%2F8Y1eoJOP7L6lZxctcU1uuW4EmKAzH2LLDIVTGX899fpED8txQIJjgLt0RtC9L6NKBmoJVRSxBaB5jHNZiVxKnA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8519fd0fec3f0410-FRA
alt-svc
h3=":443"; ma=86400
GT-Super-Display-Bold.woff
sdfvgbh.pages.dev/ 		58 KB
58 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/GT-Super-Display-Bold.woff
Requested by
Host: 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
URL: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2c54 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6046a8f13361f175a3717ef126c0d566f845a69ab36d997f33ed5397fdeb847
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Origin
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Wed, 07 Feb 2024 07:41:06 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"ee15bd1ec4e070e78b7e92dae24de48d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mve6hruZOSLdih0%2FKFiiD6CopbgmxHvP5g87FkXfcgjMLStEg4bJoDwv4XEkYpUyGSoVyJR%2FRSJWbKUbTFx927SorAgzTtJ43Sny2sGKDXFn9kM7%2FcfH5Dj7i3SqgdqqKzG%2Fu453IJC5B9ySVVLEug%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8519fd0fec420410-FRA
alt-svc
h3=":443"; ma=86400
ActiefGrotesque-Regular.woff
sdfvgbh.pages.dev/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/ActiefGrotesque-Regular.woff
Requested by
Host: 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
URL: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2c54 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eaddc3fb78d635f6abe0194b732e54a2fb4fc0c71669b50c98b02ac36feb813d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Origin
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Wed, 07 Feb 2024 07:41:05 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"29ab82d0741efea564b3cfd506a37b72"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fdDze7gBuENdVgreNxtiLs5V5UBRIJ7Knal8NeTib3iUWpPA1JVhr7cm%2FvnDIWsnVAqqhCvZx6W%2FBtxjVXe3mYA8U6wA%2FtnhGKmCvTcD6tj69ay7nU5sBVoRk6%2BZ6dSS06%2FXRsGNrj9yhw7YG%2FKvwg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8519fd0fec440410-FRA
alt-svc
h3=":443"; ma=86400
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7b18f49b87cf2ce19da6e9ddff3b99cdbb7d79baaddc3911a2d9b5ca74538994

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type
image/svg+xml
jquery.min.js
wetr-3p0.pages.dev/ 		164 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wetr-3p0.pages.dev/jquery.min.js
Requested by
Host: 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
URL: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
562892609732b7374aa3c5f488b555236db7a26a8f73c16624407fad46d946f8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Wed, 07 Feb 2024 07:41:06 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"529a27b025e86819529a36abf159162d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j1X%2Bx5d4rzDsxh34RynfYNME3YdcWj028WvHt%2FUWjSJemeAmFxMKxpjyng0pk1KHlvanvtbSVuBIfTHTSgInUKjhUj8oekHAbZC6CHjKhvs%2FDDF1ja0YaRIZm5R5m2DTjy8VFfIZyL3tl9Ou9ZOtE20%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8519fd100ecd1c03-FRA
alt-svc
h3=":443"; ma=86400
script.min.js
wetr-3p0.pages.dev/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wetr-3p0.pages.dev/script.min.js
Requested by
Host: 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
URL: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8b94fe72cf56de9a06e40ac775760e625540ffec7572ad7aa620462bcdcca8f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Wed, 07 Feb 2024 07:41:06 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"5387bed7dd09b686dd9202d051cf3814"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HnUyvkRMFzpWm%2F8EdSbjCK%2BvFP6xDU95dSriDJr8IkdSzrgvN3Ad83i52zMzawHYE%2F%2Bnla2F%2BeylRLegMkK0%2FvRuAivGmyaJjQWlo8M4WApKRtp4fl7QJlPsnbE46AL7Wi6oBbmz5gDc5BX2%2FrUWW%2B4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8519fd100ece1c03-FRA
alt-svc
h3=":443"; ma=86400
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6dbba1863bcfe251266f22a6c3b047f788a4851623c58c7b6b750809f0885dad

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type
image/svg+xml
ActiefGrotesque-Medium.woff
sdfvgbh.pages.dev/ 		31 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/ActiefGrotesque-Medium.woff
Requested by
Host: 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
URL: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2c54 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d88b3d358e709fc9e7691fd77af0bcad9d5c8fbe1f408259fe21de34dff97e27
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Origin
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Wed, 07 Feb 2024 07:41:06 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"839ff00046664abd76f6038ebc537e9a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CiRCPslcjor2lp4LNmqrqgznkFNYtGabNdN%2BoN%2FTPnTcZ2u%2FoT7nxEW3vrpbfivGhyWwgBiJmDsgg6%2Fe7KtTqH4Y38e6OHnUPFwJjicrbSY4BVWeTDVVU3g06wIMBjtBQ1ko3LvdYzuXpl2k1NGnYw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8519fd0fec3a0410-FRA
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies