WEBSITE ANALYSIS REPORT

https://5paalgxwvcd3wzsglg2k6nwi.vercel.app/?naps

10 Oct 2026 · 01:33:45.000 UTCpublic

Report tags: wetransfer phishing financial suspicious telegram_bot
Submit tags: openphish

Request review

Phishing detected

7 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

01:25:55.188 GET 200 document 860.6 KB 53 ms 6 alerts

Transaction #07

Request / response

URL

GET HTTPS

https://5paalgxwvcd3wzsglg2k6nwi.vercel.app/?naps

IP / ASN

216.198.79.195

AS16509 · AMAZON-02

Requested by: Not recorded

Resource information

File type: HTML document, ASCII text, with CRLF line terminators
MIME type: text/html; charset=utf-8
First seen (UTC): 07 Oct 2026 · 15:51:57.425 UTC
Last seen (UTC): 10 Oct 2026 · 13:56:38.700 UTC
Times seen: 4

Size: 860.6 KB (881281 bytes)
MD5: b99157f088c4b660155c1c7146de53d1
SHA1: a262bb4f637d72655078ae0210c85d5f0c0bbb31
SHA256: 0d94bbd69ea393124742ec9a8a3c52b0ea33ffdf38b29fb5e63f493e50baa7db

Certificate information

Issuer: Google Trust Services · WR1
Subject: *.vercel.app
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: E9:FE:9E:58:E9:B3:95:78:1F:9A:AE:FE:41:C4:01:64:C9:FB:2A:BC
Valid from: Sat, 29 Aug 2026 19:48:09 GMT
Valid until: Fri, 27 Nov 2026 19:48:08 GMT

Technology fingerprints

Cloudflare (CDN)
Bootstrap:4.0.0 (UI frameworks)
BootstrapCDN:4.0.0 (CDN)
jQuery:2.2.4 (JavaScript libraries)
cdnjs (CDN)
Ruby (Programming languages)
HSTS (Security)
Unpkg (CDN)
Google Hosted Libraries (CDN)
Ruby on Rails (Web frameworks)
Popper:1.12.9 (Miscellaneous)
SweetAlert (JavaScript libraries)
Vercel (PaaS)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - WeTransfer	medium	Phishing
urlquery Suspicious - Suspicious Javascript code	medium	Suspicious
YARAhub by abuse.ch Detects file containing Telegram Bot API	medium	malware
DNS4EU Sinkholed	medium	Malicious
OpenDNS Phishing Block	medium	Phishing
Quad9 DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /?naps HTTP/1.1
Host: 5paalgxwvcd3wzsglg2k6nwi.vercel.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
access-control-allow-origin: *
age: 154745
cache-control: public, max-age=0, must-revalidate
content-disposition: inline
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 10 Oct 2026 01:25:55 GMT
etag: W/"b99157f088c4b660155c1c7146de53d1"
last-modified: Thu, 08 Oct 2026 06:26:49 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-vercel-cache: HIT
x-vercel-id: arn1::fl5gw-1791595555235-e74ad32ccec5
X-Firefox-Spdy: h2

01:25:55.654 GET 429 script 0 B 0 ms —

01:25:55.660 GET 200 script 18.7 KB 45 ms —

01:25:55.662 GET 200 script 47.8 KB 74 ms —

01:25:55.663 GET 200 script 83.6 KB 82 ms —

01:25:55.665 GET 200 script 49.8 KB 31 ms —

01:25:55.667 GET 302 script 0 B 43 ms —

01:25:55.736 GET 200 script 39.9 KB 16 ms —

01:25:55.859 GET 404 img 79 B 16 ms 4 alerts

01:25:55.921 GET 404 img 79 B 17 ms 4 alerts

https://5paalgxwvcd3wzsglg2k6nwi.vercel.app/?naps

Domain graph

Hostnames

Connections