WEBSITE ANALYSIS REPORT

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

06 Oct 2026 · 01:40:16.000 UTCpublic

Report tags: wetransfer phishing financial suspicious telegram_bot
Submit tags: openphish

Request review

Phishing detected

9 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

01:39:38.030 GET 200 document 860.6 KB 54 ms 8 alerts

01:39:38.581 GET 200 script 4.82 MB 120 ms —

01:39:38.587 GET 200 script 18.7 KB 39 ms —

01:39:38.589 GET 200 script 47.8 KB 36 ms —

01:39:38.590 GET 200 script 83.6 KB 87 ms —

01:39:38.593 GET 200 script 49.8 KB 35 ms —

01:39:38.598 GET 302 script 0 B 40 ms —

01:39:38.755 GET 200 script 39.9 KB 16 ms —

01:39:39.396 GET 404 img 79 B 15 ms 6 alerts

01:39:39.436 GET 404 img 79 B 14 ms 6 alerts

Transaction #02

Request / response

URL

GET HTTPS

https://wetransfer-smoky.vercel.app/packs/media/images/globe-dd3d31e7.svg

IP / ASN

64.29.17.3

AS16509 · AMAZON-02

Requested by: https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

Resource information

File type: ASCII text
MIME type: text/plain; charset=utf-8
First seen (UTC): 06 Oct 2026 · 01:40:30.231 UTC
Last seen (UTC): 06 Oct 2026 · 01:40:30.231 UTC
Times seen: 1

Size: 79 B (79 bytes)
MD5: bfbad7dbd3c1fe9be22dda7cac98b6ee
SHA1: e9c707cfcb000cdd4031d4ee31395b59e51ba6dc
SHA256: 6acc8699178c2c4b0dba3b84e82da1368393c2f7605f2fcab4d7ca9173e69963

Certificate information

Issuer: Google Trust Services · WR1
Subject: *.vercel.app
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: E9:FE:9E:58:E9:B3:95:78:1F:9A:AE:FE:41:C4:01:64:C9:FB:2A:BC
Valid from: Sat, 29 Aug 2026 19:48:09 GMT
Valid until: Fri, 27 Nov 2026 19:48:08 GMT

Technology fingerprints

HSTS (Security)
Vercel (PaaS)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - WeTransfer	medium	Phishing
Cloudflare DNS Sinkholed	medium	Malicious
OpenDNS Phishing Block	medium	Phishing
DNS4EU Sinkholed	medium	Malicious
Quad9 DNS Sinkholed	medium	Malicious
CIRA Canadian Shield DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /packs/media/images/globe-dd3d31e7.svg HTTP/1.1
Host: wetransfer-smoky.vercel.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://wetransfer-smoky.vercel.app/
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Priority: u=4, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 404 
cache-control: public, max-age=0, must-revalidate
content-type: text/plain; charset=utf-8
date: Tue, 06 Oct 2026 01:39:39 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-vercel-error: NOT_FOUND
x-vercel-id: arn1::kfk9j-1791250779441-465a0ed3b86d
content-length: 79
X-Firefox-Spdy: h2

01:39:39.570 GET 200 script 18.7 KB 15 ms —

01:39:39.595 GET 200 script 47.8 KB 8 ms —

01:39:39.614 GET 404 img 79 B 13 ms 6 alerts

01:39:39.633 GET 200 script 83.6 KB 23 ms —

01:39:39.681 GET 200 script 49.8 KB 10 ms —

01:39:39.705 GET 302 script 0 B 21 ms —

01:39:39.732 GET 200 script 39.9 KB 18 ms —

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

Domain graph

Hostnames

Connections

Network requests

Transaction #02

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #02

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

Domain graph

Network requests