urlscan.io logo urlscan.io
SecurityTrails logo

e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev Open in urlscan Pro
35.247.106.28  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Submission Tags: phishing wetransfer Search All
Submission: On January 25 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 35.247.106.28, located in The Dalles, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev.
TLS certificate: Issued by R3 on January 24th 2024. Valid for: 3 months.
This is the only time e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

IP Address AS Autonomous System
1 35.247.106.28 396982 (GOOGLE-CL...)
5 2606:4700:310... 13335 (CLOUDFLAR...)
2 2606:4700:310... 13335 (CLOUDFLAR...)
8 4
Domain Requested by
5 sdfvgbh.pages.dev e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
2 flmz.pages.dev e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
1 e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
8 3

This site contains no links.

Subject Issuer Validity Valid
*.kirk.replit.dev
R3		 2024-01-24 -
2024-04-23		 3 months crt.sh
sdfvgbh.pages.dev
GTS CA 1P5		 2024-01-09 -
2024-04-08		 3 months crt.sh
flmz.pages.dev
E1		 2023-12-21 -
2024-03-20		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Frame ID: 484EC569DEFA61C7049D88FB484C40D8
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

WeTransferaccount | WeTransfer

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

1308 kB
Transfer

1440 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/ 		307 KB
307 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.247.106.28 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.106.247.35.bc.googleusercontent.com
Software
/
Resource Hash
abd72941300a448af33e9d7e265daa284355f792b0583c66e7f61b14440cd510

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Access-Control-Allow-Origin
*
Content-Length
313921
Content-Type
text/html; charset=utf-8
Date
Thu, 25 Jan 2024 13:11:38 GMT
Replit-Cluster
kirk
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1f39a1017906d512934d04cef8dbd816ebe0206eab872da92d30fdb554c84a89

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/svg+xml
bg.png
sdfvgbh.pages.dev/ 		783 KB
784 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sdfvgbh.pages.dev/bg.png
Requested by
Host: e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
URL: https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2fac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
97915ef3518cf57623d185b62663441724cc9afdd8927518e45c36cffc84be2f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 25 Jan 2024 13:11:40 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"2cfd5689dca667351388f92ec5d22b6e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JHChe8DsTtdkchT0NX4rvlpRijaSvnfFCdaMbTak%2BrjSJ1XOvQGx46AqcnCazHx0DQJTgHj2nLG0Er92IzBgLSuBDIH4dPZWMLFQ2WTX%2F1zHtW%2BfjGQL4NxV5gClmGc3G74U9eCL7aXh8r1VyuVAbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
84b0c364c86920b9-NRT
alt-svc
h3=":443"; ma=86400
content-length
801710
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7b18f49b87cf2ce19da6e9ddff3b99cdbb7d79baaddc3911a2d9b5ca74538994

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/svg+xml
jquery.min.js
flmz.pages.dev/ 		164 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://flmz.pages.dev/jquery.min.js
Requested by
Host: e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
URL: https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2efe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
562892609732b7374aa3c5f488b555236db7a26a8f73c16624407fad46d946f8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 25 Jan 2024 13:11:39 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"529a27b025e86819529a36abf159162d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AsyX16552zAv6ChWQgJ8Ec91cecxCpspRy3emLlqqL1C8%2FdJn8OIIHxGw3OnBqR4LIlO8n1BJlEWuum5KL0cV%2FK2SEAHBFh4iM38BD54pbeAoFxB1dFB5SQGgIS300zCGXYqKcxSI%2Fxtv0x%2Fsw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
84b0c364f9ba7825-NRT
alt-svc
h3=":443"; ma=86400
script.min.js
flmz.pages.dev/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://flmz.pages.dev/script.min.js
Requested by
Host: e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
URL: https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2efe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4e9bfdd4e1ae1ebb735aeddffa60d0a4838027e1bc9846da9929ef506839ebb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 25 Jan 2024 13:11:39 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"efd9efcd2e54a917b681c69cf25bcd24"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ASirDb0ZUv2WVb9DwAkTfqlzVThDbHB6sHGYDsXNmrDMorPU%2Bfm9E%2BM20%2Bg5MsPzoO%2BTlABLyJke%2BzH7Uztzw0MjPh6YxQ%2F%2FiuPGEl%2FV4Od5xZPKu%2BXWXINNbVJ5nQPGVP9uRfqtHHM26FcnWg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
84b0c364f9bc7825-NRT
alt-svc
h3=":443"; ma=86400
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6dbba1863bcfe251266f22a6c3b047f788a4851623c58c7b6b750809f0885dad

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/svg+xml
GT-Super-Display-Light.woff
sdfvgbh.pages.dev/ 		54 KB
55 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/GT-Super-Display-Light.woff
Requested by
Host: e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
URL: https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2fac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62e704e04089cc468b4bfdd61705d93959532d630e88de5ecef6064ebfd9d29e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Origin
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 25 Jan 2024 13:11:39 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6a491dee078a89c780b38ee790f48a41"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B3RaAeWJsUuNlFdGlmTknO1%2BRhU3MbrIUDrMKSzdjEkW8J4U2la6H%2BKW5lqPEq%2BV%2F6fhErOCqfk6q5oJc7pQ090gaxfjOp%2FBoPrZvpC%2Bzt%2FQexN21Ia2PNhQuowTpCY1giA2jEdRT59WPtvbl8jmnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
84b0c364e85ce07a-NRT
alt-svc
h3=":443"; ma=86400
GT-Super-Display-Bold.woff
sdfvgbh.pages.dev/ 		58 KB
58 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/GT-Super-Display-Bold.woff
Requested by
Host: e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
URL: https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2fac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6046a8f13361f175a3717ef126c0d566f845a69ab36d997f33ed5397fdeb847
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Origin
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 25 Jan 2024 13:11:39 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"ee15bd1ec4e070e78b7e92dae24de48d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2gq0IJmAEsi543WcGWIuUCn9mDmoi0Da4FdLDsX0UjTes%2B00D4klIC2ulTz644CEA6U2787lBt0U1sPQSWC62gmYKBFWXCl81hNiwEgPrumij1pH4rXDEKR15SZK9apByPeiRJcnc48145h2HMBPxA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
84b0c364e85ee07a-NRT
alt-svc
h3=":443"; ma=86400
ActiefGrotesque-Regular.woff
sdfvgbh.pages.dev/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/ActiefGrotesque-Regular.woff
Requested by
Host: e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
URL: https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2fac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eaddc3fb78d635f6abe0194b732e54a2fb4fc0c71669b50c98b02ac36feb813d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Origin
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 25 Jan 2024 13:11:39 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"29ab82d0741efea564b3cfd506a37b72"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sAeoi5A93kjS0AV3E0szlkyQWnCMFKgQXew3khc5aAyyTys5vRS9BeRBA0lspDa1m8iCHlJO87%2FpLP4Q28GL%2FwPCYuu%2Bqgtt4PvoArn2DkNr0DblhGeGroWPAHbTUUqptZ7Wig56KwtVGmQac4jllA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
84b0c364e85fe07a-NRT
alt-svc
h3=":443"; ma=86400
ActiefGrotesque-Medium.woff
sdfvgbh.pages.dev/ 		31 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sdfvgbh.pages.dev/ActiefGrotesque-Medium.woff
Requested by
Host: e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
URL: https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2fac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d88b3d358e709fc9e7691fd77af0bcad9d5c8fbe1f408259fe21de34dff97e27
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev/
Origin
https://e3799a8e-0142-49fb-a981-48974b4be597-00-2lvvgir2i9cq.kirk.replit.dev
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 25 Jan 2024 13:11:39 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"839ff00046664abd76f6038ebc537e9a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qb5szn1cBid2UnH5Ve7FJCXIUDTcXYrfSVXK%2FfM5Q4YVLK8vL8nVpyYfKVL7%2B3E1yE2smWcPyZM4q6CkvoFJI55AMK6bdv5eW3d4V1s2n%2FyeEKyF6hVvQkhtPQH9NWVqi4TtroqvvffMPzw%2FzFULsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
84b0c364e861e07a-NRT
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies