![](/screenshots/c3b82db5-9334-4058-b38b-32dc25470935.png)
newwetransfer-9te.pages.dev
Open in
urlscan Pro
172.66.47.27
Malicious Activity!
Public Scan
Effective URL: https://newwetransfer-9te.pages.dev/?zg0wd2vhuxhhwgx5zudsdmruzg9ksfl3wkc5mmrubdnlbvj5zdjkbmviwjfnakexzgpgnmrhvm1lblppzedab2rtedflsfl...
Submission: On April 09 via api from US — Scanned from US
Summary
TLS certificate: Issued by E1 on March 24th 2024. Valid for: 3 months.
This is the only time newwetransfer-9te.pages.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WeTransfer (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 172.66.47.27 172.66.47.27 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 18.173.219.49 18.173.219.49 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:80c::200a | 15169 (GOOGLE) (GOOGLE) | |
12 | 4 |
ASN16509 (AMAZON-02, US)
PTR: server-18-173-219-49.jfk52.r.cloudfront.net
auth-cdn.wetransfer.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
wetransfer.com
auth-cdn.wetransfer.com — Cisco Umbrella Rank: 404216 |
768 KB |
3 |
pages.dev
newwetransfer-9te.pages.dev |
77 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 746 |
31 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
5 | auth-cdn.wetransfer.com |
newwetransfer-9te.pages.dev
auth-cdn.wetransfer.com |
3 | newwetransfer-9te.pages.dev |
newwetransfer-9te.pages.dev
|
1 | ajax.googleapis.com |
newwetransfer-9te.pages.dev
|
12 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
newwetransfer-9te.pages.dev E1 |
2024-03-24 - 2024-06-22 |
3 months | crt.sh |
wetransfer.com Amazon RSA 2048 M02 |
2023-06-09 - 2024-07-07 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://newwetransfer-9te.pages.dev/?zg0wd2vhuxhhwgx5zudsdmruzg9ksfl3wkc5mmrubdnlbvj5zdjkbmviwjfnakexzgpgnmrhvm1lblppzedab2rtedflsfl5yw1wmgjiqjnkbxh3y1hadgvhrjvkm0pvzg10a2fisnrhsgwxtuhacmqzwmtlr1juwm5sdgf6vjvksfo2zdnzewftbhhivgwxzg5wbwrubhfabxqytvhcbgrxehdkmkoyyw5smmjuqxhkakptz...~311~...vibljpwjnkmgriumhkmjf4ufqwpq==
Frame ID: 5D1E6DC762232672EB1ACF80401FEE04
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/c3b82db5-9334-4058-b38b-32dc25470935.png)
Page Title
WeTransfer account | WeTransferPage URL History Show full URLs
-
http://newwetransfer-9te.pages.dev/?zg0wd2vhuxhhwgx5zudsdmruzg9ksfl3wkc5mmrubdnlbvj5zdjkbmviwjfnakexzgpgnmrhvm1...
HTTP 307
https://newwetransfer-9te.pages.dev/?zg0wd2vhuxhhwgx5zudsdmruzg9ksfl3wkc5mmrubdnlbvj5zdjkbmviwjfnakexzgpgnmrhvm1... Page URL
Detected technologies
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://newwetransfer-9te.pages.dev/?zg0wd2vhuxhhwgx5zudsdmruzg9ksfl3wkc5mmrubdnlbvj5zdjkbmviwjfnakexzgpgnmrhvm1lblppzedab2rtedflsfl5yw1wmgjiqjnkbxh3y1hadgvhrjvkm0pvzg10a2fisnrhsgwxtuhacmqzwmtlr1juwm5sdgf6vjvksfo2zdnzewftbhhivgwxzg5wbwrubhfabxqytvhcbgrxehdkmkoyyw5smmjuqxhkakptz...~311~...vibljpwjnkmgriumhkmjf4ufqwpq==
HTTP 307
https://newwetransfer-9te.pages.dev/?zg0wd2vhuxhhwgx5zudsdmruzg9ksfl3wkc5mmrubdnlbvj5zdjkbmviwjfnakexzgpgnmrhvm1lblppzedab2rtedflsfl5yw1wmgjiqjnkbxh3y1hadgvhrjvkm0pvzg10a2fisnrhsgwxtuhacmqzwmtlr1juwm5sdgf6vjvksfo2zdnzewftbhhivgwxzg5wbwrubhfabxqytvhcbgrxehdkmkoyyw5smmjuqxhkakptz...~311~...vibljpwjnkmgriumhkmjf4ufqwpq== Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
newwetransfer-9te.pages.dev/ Redirect Chain
|
23 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
auth-cdn.wetransfer.com/assets/styles/ |
824 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
newwetransfer-9te.pages.dev/styles/ |
194 KB 55 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
transfer_login_styles.css
newwetransfer-9te.pages.dev/styles/ |
31 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wetransfer-text-logo.svg
auth-cdn.wetransfer.com/assets/images/ |
6 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transfer-general.png
auth-cdn.wetransfer.com/assets/images/ |
732 KB 733 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-free-mobile.svg
auth-cdn.wetransfer.com/assets/images/ |
6 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
10 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
943 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ActiefGrotesque-W-Regular.woff
auth-cdn.wetransfer.com/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
565 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
GT-Super-WT-Regular.woff
auth-cdn.wetransfer.com/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ActiefGrotesque-W-Medium.woff
auth-cdn.wetransfer.com/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
auth-cdn.wetransfer.com/assets/images/ |
28 KB 28 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- auth-cdn.wetransfer.com
- URL
- https://auth-cdn.wetransfer.com/assets/fonts/ActiefGrotesque-W-Regular.woff
- Domain
- auth-cdn.wetransfer.com
- URL
- https://auth-cdn.wetransfer.com/assets/fonts/GT-Super-WT-Regular.woff
- Domain
- auth-cdn.wetransfer.com
- URL
- https://auth-cdn.wetransfer.com/assets/fonts/ActiefGrotesque-W-Medium.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WeTransfer (Online)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| load string| vnci string| dvnci string| encodedParams object| hashParams string| decry object| p0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
auth-cdn.wetransfer.com
newwetransfer-9te.pages.dev
auth-cdn.wetransfer.com
172.66.47.27
18.173.219.49
2607:f8b0:4006:80c::200a
1f39a1017906d512934d04cef8dbd816ebe0206eab872da92d30fdb554c84a89
26350bef02c0812b33389f4d5336ba0aa3422ad165cd536507b8431a22992582
3e2cff1592515bd58eae9f128660bfd207833025c76560451d47e1bc3a529f70
42c52bdbaa9c00ee5d298c01ccd6399083ff9283156da45904f679542243fe24
5981f65aeddede91c5d9900f524c1403334c0ec539dfd643f4ec14bf8bed403d
6b1b212852205d9d0fdf8848c2f0f574f47221a0cb8a9daa3f64741db620cde6
6dbba1863bcfe251266f22a6c3b047f788a4851623c58c7b6b750809f0885dad
90cda0d984d153d5c0f88b43b02a26c033eb29b40da0c9b6e400d3cc0bdd9312
9fe25d8abe96455f6df6a86e43a7647cdd2c6fc3a9594fdb09911cece95d6b72
c81224c9eaf598b22ad1104c9d95a64e45e2382432f4c9f4940d0ea174219566
cde80e58fff4561911f7397ef39dca6cfd699cf91ae6a205ff0a38b248d9d2d4
e7bf2df0a16db084dfa378e073c399b14fa4c48e92764bdb5497051f9786ce77
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fd7108379b77e618b1f8e812a72c90338233b88137fe80666d236db4295ed57c