WEBSITE ANALYSIS REPORT

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

06 Oct 2026 · 01:40:16.000 UTCpublic

Report tags: wetransfer phishing financial suspicious telegram_bot
Submit tags: openphish

Request review

Phishing detected

9 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

01:39:38.030 GET 200 document 860.6 KB 54 ms 8 alerts

01:39:38.581 GET 200 script 4.82 MB 120 ms —

01:39:38.587 GET 200 script 18.7 KB 39 ms —

01:39:38.589 GET 200 script 47.8 KB 36 ms —

01:39:38.590 GET 200 script 83.6 KB 87 ms —

01:39:38.593 GET 200 script 49.8 KB 35 ms —

01:39:38.598 GET 302 script 0 B 40 ms —

01:39:38.755 GET 200 script 39.9 KB 16 ms —

01:39:39.396 GET 404 img 79 B 15 ms 6 alerts

Transaction #04

Request / response

URL

GET HTTPS

https://wetransfer-smoky.vercel.app/favicon.ico

IP / ASN

64.29.17.3

AS16509 · AMAZON-02

Requested by: https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

Resource information

File type: ASCII text
MIME type: text/plain; charset=utf-8
First seen (UTC): 06 Oct 2026 · 01:40:30.242 UTC
Last seen (UTC): 06 Oct 2026 · 01:40:30.242 UTC
Times seen: 1

Size: 79 B (79 bytes)
MD5: b0c4a95f1be8e782128636c5d2638c2b
SHA1: 9d35ab62ffea320e3dd094100ce8feef1cd2e7cf
SHA256: be642ea0a0d9dd4de9aa08d1494e99b46d1023c8fad1d099b2501d2da9420e5b

Certificate information

Issuer: Google Trust Services · WR1
Subject: *.vercel.app
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: E9:FE:9E:58:E9:B3:95:78:1F:9A:AE:FE:41:C4:01:64:C9:FB:2A:BC
Valid from: Sat, 29 Aug 2026 19:48:09 GMT
Valid until: Fri, 27 Nov 2026 19:48:08 GMT

Technology fingerprints

HSTS (Security)
Vercel (PaaS)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - WeTransfer	medium	Phishing
Quad9 DNS Sinkholed	medium	Malicious
Cloudflare DNS Sinkholed	medium	Malicious
OpenDNS Phishing Block	medium	Phishing
DNS4EU Sinkholed	medium	Malicious
CIRA Canadian Shield DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /favicon.ico HTTP/1.1
Host: wetransfer-smoky.vercel.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Referer: https://wetransfer-smoky.vercel.app/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Priority: u=6
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 404 
cache-control: public, max-age=0, must-revalidate
content-type: text/plain; charset=utf-8
date: Tue, 06 Oct 2026 01:39:39 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-vercel-error: NOT_FOUND
x-vercel-id: arn1::c9m5z-1791250779402-cd9fa20b8868
content-length: 79
X-Firefox-Spdy: h2

01:39:39.436 GET 404 img 79 B 14 ms 6 alerts

01:39:39.570 GET 200 script 18.7 KB 15 ms —

01:39:39.595 GET 200 script 47.8 KB 8 ms —

01:39:39.614 GET 404 img 79 B 13 ms 6 alerts

01:39:39.633 GET 200 script 83.6 KB 23 ms —

01:39:39.681 GET 200 script 49.8 KB 10 ms —

01:39:39.705 GET 302 script 0 B 21 ms —

01:39:39.732 GET 200 script 39.9 KB 18 ms —

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

Domain graph

Hostnames

Connections

Network requests

Transaction #04

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #04

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

https://wetransfer-smoky.vercel.app/#mirensys@veltobox.net

Domain graph

Network requests