Security Scan: WeTransfer

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/31009a4a-531b-44a8-ad7f-f9507dd4d2f5 Domain and IP registration (RDAP)/api/v1/rdap/31009a4a-531b-44a8-ad7f-f9507dd4d2f5How often this domain was scanned/api/v1/domain/stats/transfer-doc-23dec5.netlify.app Scan history for this domain/api/v1/domain/history/transfer-doc-23dec5.netlify.app?limit=15

This website contacted 3 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main domain is netlify.app and was registered 8 years ago.

Submitted URL: https://transfer-doc-23dec5.netlify.app/

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Fake WeTransfer page on a netlify.app subdomain that harvests email and password and POSTs them to the unrelated domain trentdavid.com. Classic credential phishing — do not enter any data.

Risk Factors (5)

Brand impersonation of WeTransfer on a non-official netlify.app subdomain

Credential (email + password) form submitting to a cross-origin, unrelated domain (trentdavid.com)

JavaScript disables DevTools/right-click and view-source; uses dynamic Function() code generation

Unranked domain with no legitimate reputation while claiming a major file-transfer brand

Decoy/mismatched content (stock-footage headers, 'Purchase Order.pdf') inconsistent with the WeTransfer brand

Domain age information unavailable

Details

Page Title

WeTransfer

Scan Type

public

Domain Name Analysis

The domain 'transfer-doc-23dec5.netlify.app' uses the application-focused generic top-level domain (.app) and includes subdomain 'transfer-doc-23dec5'. Its registrable label 'netlify' stretches across 7 characters holding two vowels versus 5 consonants. Splitting it apart reveals three words: net, li, fy. The median word length lands at two characters. No strong language cues emerged from the frequency lists.

Screenshot

if Th WD car | fp am Eno ee wee. LPC LOC” PD Dyan Lepr VE Lies Fs Confirm Receiving Email Ready when you are Files deleted in 24 hours Enter Receiver Email Enter Password Purchase Order.pdt 09 MB...

Page Load Overview

10.02s

Total Load Time

1.9 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:386 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical64% confidence

Type: webapp

Method: ml+structural+ocr_tiebreaker

All Detected Categories

documentation technical

64%

finance banking

55%

e-commerce shopping

47%

technology software

47%

adult content

43%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	63.176.8.218Aws · CLOUD	Frankfurt am Main, Hesse, Germany	AS16509Amazon.com, Inc.
3	27.254.44.187	Thailand	AS9891CS LOXINFO Public Company Limited.
3	35.157.26.135Aws · CLOUD	Frankfurt am Main, Hesse, Germany	AS16509Amazon.com, Inc.
9	3	-	-