WEBSITE ANALYSIS REPORT

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

06 Oct 2026 · 01:40:15.000 UTCpublic

Report tags: wetransfer phishing financial suspicious telegram_bot
Submit tags: openphish

Request review

Phishing detected

9 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

01:39:36.840 GET 200 document 860.6 KB 54 ms 8 alerts

Transaction #01

Request / response

URL

GET HTTPS

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

IP / ASN

216.198.79.131

AS16509 · AMAZON-02

Requested by: Not recorded

Resource information

File type: HTML document, ASCII text, with CRLF line terminators
MIME type: text/html; charset=utf-8
First seen (UTC): 05 Oct 2026 · 16:43:39.833 UTC
Last seen (UTC): 06 Oct 2026 · 16:34:56.082 UTC
Times seen: 7

Size: 860.6 KB (881281 bytes)
MD5: 3bd8988ddaca0ffe9441d331cf92065f
SHA1: 66b45ffd42b5d5b8eced2b642b50a3085738ca4a
SHA256: 374c6b82eb091a4c892e6f2a64e956f30b7af00166bdaa21eed991966d2bcdb2

Certificate information

Issuer: Google Trust Services · WR1
Subject: *.vercel.app
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: E9:FE:9E:58:E9:B3:95:78:1F:9A:AE:FE:41:C4:01:64:C9:FB:2A:BC
Valid from: Sat, 29 Aug 2026 19:48:09 GMT
Valid until: Fri, 27 Nov 2026 19:48:08 GMT

Technology fingerprints

Popper:1.12.9 (Miscellaneous)
Vercel (PaaS)
Ruby on Rails (Web frameworks)
Bootstrap:4.0.0 (UI frameworks)
Unpkg (CDN)
SweetAlert (JavaScript libraries)
BootstrapCDN:4.0.0 (CDN)
jQuery:2.2.4 (JavaScript libraries)
cdnjs (CDN)
Google Hosted Libraries (CDN)
HSTS (Security)
Ruby (Programming languages)
Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - WeTransfer	medium	Phishing
urlquery Suspicious - Suspicious Javascript code	medium	Suspicious
YARAhub by abuse.ch Detects file containing Telegram Bot API	medium	malware
OpenDNS Phishing Block	medium	Phishing
DNS4EU Sinkholed	medium	Malicious
Quad9 DNS Sinkholed	medium	Malicious
Cloudflare DNS Sinkholed	medium	Malicious
CIRA Canadian Shield DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET / HTTP/1.1
Host: wetransfer-smoky.vercel.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
access-control-allow-origin: *
age: 50764
cache-control: public, max-age=0, must-revalidate
content-disposition: inline
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 06 Oct 2026 01:39:36 GMT
etag: W/"3bd8988ddaca0ffe9441d331cf92065f"
last-modified: Mon, 05 Oct 2026 11:33:32 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-vercel-cache: HIT
x-vercel-id: arn1::8g4sm-1791250776891-65f1e379eb44
X-Firefox-Spdy: h2

01:39:37.318 GET 200 script 4.82 MB 137 ms —

01:39:37.325 GET 200 script 18.7 KB 45 ms —

01:39:37.327 GET 200 script 47.8 KB 40 ms —

01:39:37.330 GET 200 script 83.6 KB 93 ms —

01:39:37.332 GET 200 script 49.8 KB 29 ms —

01:39:37.334 GET 302 script 0 B 45 ms —

01:39:37.502 GET 200 script 39.9 KB 16 ms —

01:39:38.153 GET 404 img 79 B 39 ms 6 alerts

01:39:38.285 GET 404 img 79 B 15 ms 6 alerts

01:39:38.423 GET 200 script 18.7 KB 11 ms —

01:39:38.450 GET 404 img 79 B 19 ms 6 alerts

01:39:38.465 GET 200 script 47.8 KB 7 ms —

01:39:38.489 GET 200 script 83.6 KB 24 ms —

01:39:38.533 GET 200 script 49.8 KB 8 ms —

01:39:38.563 GET 302 script 0 B 21 ms —

01:39:38.598 GET 200 script 39.9 KB 18 ms —

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

Domain graph

Hostnames

Connections