WEBSITE ANALYSIS REPORT

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

06 Oct 2026 · 01:40:15.000 UTCpublic

Report tags: wetransfer phishing financial suspicious telegram_bot
Submit tags: openphish

Request review

Phishing detected

9 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

01:39:36.840 GET 200 document 860.6 KB 54 ms 8 alerts

01:39:37.318 GET 200 script 4.82 MB 137 ms —

01:39:37.325 GET 200 script 18.7 KB 45 ms —

01:39:37.327 GET 200 script 47.8 KB 40 ms —

01:39:37.330 GET 200 script 83.6 KB 93 ms —

01:39:37.332 GET 200 script 49.8 KB 29 ms —

01:39:37.334 GET 302 script 0 B 45 ms —

01:39:37.502 GET 200 script 39.9 KB 16 ms —

01:39:38.153 GET 404 img 79 B 39 ms 6 alerts

Transaction #16

Request / response

URL

GET HTTPS

https://wetransfer-smoky.vercel.app/favicon.ico

IP / ASN

216.198.79.131

AS16509 · AMAZON-02

Requested by: https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

Resource information

File type: ASCII text
MIME type: text/plain; charset=utf-8
First seen (UTC): 06 Oct 2026 · 01:40:25.675 UTC
Last seen (UTC): 06 Oct 2026 · 01:40:25.675 UTC
Times seen: 1

Size: 79 B (79 bytes)
MD5: b2a8931c9ea66d22b6c59463feccf36f
SHA1: 09e44639c9abd46e11288db6b7ad01bae5cb648c
SHA256: 8fc2fba3525a25a7508e7315fca794e20008afb225f5e507da1a6b9cf8499bd7

Certificate information

Issuer: Google Trust Services · WR1
Subject: *.vercel.app
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: E9:FE:9E:58:E9:B3:95:78:1F:9A:AE:FE:41:C4:01:64:C9:FB:2A:BC
Valid from: Sat, 29 Aug 2026 19:48:09 GMT
Valid until: Fri, 27 Nov 2026 19:48:08 GMT

Technology fingerprints

HSTS (Security)
Vercel (PaaS)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - WeTransfer	medium	Phishing
OpenDNS Phishing Block	medium	Phishing
Cloudflare DNS Sinkholed	medium	Malicious
DNS4EU Sinkholed	medium	Malicious
Quad9 DNS Sinkholed	medium	Malicious
CIRA Canadian Shield DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /favicon.ico HTTP/1.1
Host: wetransfer-smoky.vercel.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Referer: https://wetransfer-smoky.vercel.app/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Priority: u=6
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 404 
cache-control: public, max-age=0, must-revalidate
content-type: text/plain; charset=utf-8
date: Tue, 06 Oct 2026 01:39:38 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-vercel-error: NOT_FOUND
x-vercel-id: arn1::6xnnq-1791250778163-12801403a3c2
content-length: 79
X-Firefox-Spdy: h2

01:39:38.285 GET 404 img 79 B 15 ms 6 alerts

01:39:38.423 GET 200 script 18.7 KB 11 ms —

01:39:38.450 GET 404 img 79 B 19 ms 6 alerts

01:39:38.465 GET 200 script 47.8 KB 7 ms —

01:39:38.489 GET 200 script 83.6 KB 24 ms —

01:39:38.533 GET 200 script 49.8 KB 8 ms —

01:39:38.563 GET 302 script 0 B 21 ms —

01:39:38.598 GET 200 script 39.9 KB 18 ms —

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

Domain graph

Hostnames

Connections

Network requests

Transaction #16

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #16

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

Domain graph

Network requests