wetransfer-xrt.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:3fb0::1  Malicious Activity! Public Scan

URL: https://wetransfer-xrt.000webhostapp.com/
Submission: On September 03 via api from QA

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 16 HTTP transactions. The main IP is 2a02:4780:dead:3fb0::1, located in United States and belongs to AWEX, US. The main domain is wetransfer-xrt.000webhostapp.com.
TLS certificate: Issued by RapidSSL RSA CA 2018 on June 11th 2019. Valid for: 2 years.
This is the only time wetransfer-xrt.000webhostapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

IP Address AS Autonomous System
13 2a02:4780:dea... 204915 (AWEX)
1 13.225.78.30 16509 (AMAZON-02)
16 3
Domain Requested by
13 wetransfer-xrt.000webhostapp.com wetransfer-xrt.000webhostapp.com
1 backgrounds.wetransfer.net wetransfer-xrt.000webhostapp.com
0 fdcgdnkidjaadafnichfpabhfomcebme Failed wetransfer-xrt.000webhostapp.com
16 3

This site contains no links.

Subject Issuer Validity Valid
*.000webhostapp.com
RapidSSL RSA CA 2018
2019-06-11 -
2021-07-10
2 years crt.sh
wetransfer.net
Amazon
2020-08-11 -
2021-09-10
a year crt.sh

This page contains 2 frames:

Primary Page: https://wetransfer-xrt.000webhostapp.com/
Frame ID: 09D45EF4A5B8749BA84C316EC6DD1FB9
Requests: 7 HTTP requests in this frame

Frame: https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
Frame ID: 3DBE1BA8C04DEE94D02F959B403FE901
Requests: 9 HTTP requests in this frame

Screenshot


Page Statistics

16
Requests

88 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

1077 kB
Transfer

1515 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
wetransfer-xrt.000webhostapp.com/
15 KB
5 KB
Document
General
Full URL
https://wetransfer-xrt.000webhostapp.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
db4648d19eed7a4fe96c75016c1a20a617cd065a1097638b58a2508d7952874b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
wetransfer-xrt.000webhostapp.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 03 Sep 2020 01:13:59 GMT
content-type
text/html; charset=UTF-8
server
awex
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-request-id
925b248579d08c959d710286d898514e
content-encoding
gzip
analytics.js.download
wetransfer-xrt.000webhostapp.com/we_files/
0
0
Script
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/analytics.js.download
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:13:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
awex
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
x-request-id
93fe8b5e47f7c3d4a3471165039e8965
bWqOLA69nu2fsMi45LjA.js.download
wetransfer-xrt.000webhostapp.com/we_files/
0
0
Script
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/bWqOLA69nu2fsMi45LjA.js.download
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:13:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
awex
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
x-request-id
b6f1e39847253d2d7396bd2546aea8e9
gtm.js.download
wetransfer-xrt.000webhostapp.com/we_files/
0
0
Script
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/gtm.js.download
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:13:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
awex
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
x-request-id
f108ceeedbd984a8d77ed63b86ab64e9
webrtc-patch.js
fdcgdnkidjaadafnichfpabhfomcebme/scripts/
0
0

application-bd95c1c273b3b6f2c6b24f2eaeeaef30be54981e5727d3ac981a5e003b93d6a6.css
wetransfer-xrt.000webhostapp.com/we_files/
391 KB
67 KB
Stylesheet
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/application-bd95c1c273b3b6f2c6b24f2eaeeaef30be54981e5727d3ac981a5e003b93d6a6.css
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
7650cccb518dc3993c51d7a477c1676cf331e22856d2a5456178e5dc96f0ac39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:13:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 26 Aug 2020 10:33:36 GMT
server
awex
content-type
text/css
status
200
x-xss-protection
1; mode=block
x-request-id
b3a76e4f12203f9e072aa5f942c8c898
remove.js
wetransfer-xrt.000webhostapp.com/
85 KB
34 KB
Script
General
Full URL
https://wetransfer-xrt.000webhostapp.com/remove.js
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:13:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 26 Aug 2020 10:33:36 GMT
server
awex
content-type
application/javascript
status
200
x-xss-protection
1; mode=block
x-request-id
99d5fa992f152afaf55c30bff57b1ea8
bg.html
wetransfer-xrt.000webhostapp.com/we_files/ Frame 3DBE
3 KB
2 KB
Document
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
1f1618ddd4e6a8fd712dfe3b5cf51e7e128c3a155ee02386c15d8f73f377894d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
wetransfer-xrt.000webhostapp.com
:scheme
https
:path
/we_files/bg.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://wetransfer-xrt.000webhostapp.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://wetransfer-xrt.000webhostapp.com/

Response headers

status
200
date
Thu, 03 Sep 2020 01:14:00 GMT
content-type
text/html; charset=UTF-8
server
awex
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-request-id
0aa5d312df493256aa728b7d6f4824dc
content-encoding
gzip
wallpaper-toolbox-2.1.0.css
wetransfer-xrt.000webhostapp.com/we_files/ Frame 3DBE
5 KB
2 KB
Stylesheet
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/wallpaper-toolbox-2.1.0.css
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
05a86484ed4d67184b3ddb0cf1f4919fec585e3fcc7e55fc3bb0e07aa8d3405e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:14:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 26 Aug 2020 10:33:36 GMT
server
awex
content-type
text/css
status
200
x-xss-protection
1; mode=block
x-request-id
fab11948e07569375f1bf9cf8d541021
css
wetransfer-xrt.000webhostapp.com/we_files/ Frame 3DBE
0
0

uaest.js.download
wetransfer-xrt.000webhostapp.com/we_files/ Frame 3DBE
0
0
Script
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/uaest.js.download
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:14:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
awex
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
x-request-id
e239188d2206daf4bec355f931a54a56
wallpaper-api-2.2.2.js.download
wetransfer-xrt.000webhostapp.com/we_files/ Frame 3DBE
0
0
Script
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/wallpaper-api-2.2.2.js.download
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:14:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
awex
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
x-request-id
8482740ce3ac9724b3b8b31288f2e6f6
wallpaper-toolbox-2.1.0.js.download
wetransfer-xrt.000webhostapp.com/we_files/ Frame 3DBE
0
0
Script
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/wallpaper-toolbox-2.1.0.js.download
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:14:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
awex
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
x-request-id
51cb0de44bc502a2a22e6a8e26d3cd42
jquery-3.3.1.slim.min.js.download
wetransfer-xrt.000webhostapp.com/we_files/ Frame 3DBE
0
0
Script
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/jquery-3.3.1.slim.min.js.download
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://wetransfer-xrt.000webhostapp.com
Referer
https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:14:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
awex
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
x-request-id
6ce002a2b104e96175fdcf3c7616219b
remove.js
wetransfer-xrt.000webhostapp.com/we_files/ Frame 3DBE
85 KB
34 KB
Script
General
Full URL
https://wetransfer-xrt.000webhostapp.com/we_files/remove.js
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:3fb0::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:14:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 26 Aug 2020 10:33:36 GMT
server
awex
content-type
application/javascript
status
200
x-xss-protection
1; mode=block
x-request-id
d2b2439f2029d7f75fe7daabcac1a54b
2ca0326b0d9755a4d392ee19eeb0b512..jpg
backgrounds.wetransfer.net/wallpaper-wizard/production/wallpapers/1000332/assets/wallpaper160420122946/background/ Frame 3DBE
932 KB
933 KB
Image
General
Full URL
https://backgrounds.wetransfer.net/wallpaper-wizard/production/wallpapers/1000332/assets/wallpaper160420122946/background/2ca0326b0d9755a4d392ee19eeb0b512..jpg
Requested by
Host: wetransfer-xrt.000webhostapp.com
URL: https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-30.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
aff83cc707385c2a08dcf3ebd5a4a1cf7bf78b7f2ca0155635a82022b720525f

Request headers

Referer
https://wetransfer-xrt.000webhostapp.com/we_files/bg.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Sep 2020 01:14:01 GMT
via
1.1 7158aa4ac648947d564b98d9769b5b2b.cloudfront.net (CloudFront)
last-modified
Tue, 04 Aug 2020 10:24:57 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C2
etag
"e6a61b17dcf660a9987a52434a00bd0c"
x-cache
RefreshHit from cloudfront
status
200
accept-ranges
bytes
content-length
954390
x-amz-cf-id
R98k91C0B6GCayNyzdw-aZlj9u2Yx6mfWWBa34ukSYIuybWfr5kkIw==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fdcgdnkidjaadafnichfpabhfomcebme
URL
chrome-extension://fdcgdnkidjaadafnichfpabhfomcebme/scripts/webrtc-patch.js
Domain
wetransfer-xrt.000webhostapp.com
URL
https://wetransfer-xrt.000webhostapp.com/we_files/css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes string| message function| clickIE function| clickNS function| disableCtrlKeyCombination function| $ function| jQuery

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block