Security Scan: WeTransfer

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/46da175b-10a3-4e69-9c2f-e85786cf2b6e Domain and IP registration (RDAP)/api/v1/rdap/46da175b-10a3-4e69-9c2f-e85786cf2b6eHow often this domain was scanned/api/v1/domain/stats/wetransfer-1.vercel.app Scan history for this domain/api/v1/domain/history/wetransfer-1.vercel.app?limit=15

This website contacted 11 IPs in 1 country across 8 domains to perform 13 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: https://www.wetransfer-1.vercel.app/

Effective URL:

https://wetransfer-1.vercel.app/

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Fake WeTransfer login page on a Vercel subdomain, impersonating the brand and capturing email/password; a critical hunting rule stealer rule and an embedded Telegram bot token indicate credential exfiltration to Telegram. Confirmed phishing.

Risk Factors (6)

Impersonation of WeTransfer brand on a non-official Vercel subdomain

Credential capture form (email + password) on an impersonating page

Critical hunting rule stealer rule hit (Okta_Phishing_Kit_Telegram_Exfil)

Telegram bot token embedded in page script — credential exfiltration channel

Indicators of Compromise: phishing report on primary domain (openphish.com); IDS alerts for abused cloud hosting domain

Unknown creation date for the hosting-platform subdomain

Domain age information unavailable

Details

Page Title

WeTransfer

Scan Type

public

Favicon Hash

MMH3: -537232643

MD5: 692e1c7339c359b6412f059c9c9a0474

Domain Name Analysis

Domain 'www.wetransfer-1.vercel.app' uses the application-focused generic top-level domain (.app), featuring subdomain 'www.wetransfer-1'. The registrable portion 'vercel' spans 6 characters with 2 vowels and 4 consonants. Segmentation suggests two words: ver, cel. The median word length lands at three characters. No strong language cues emerged from the frequency lists.

Screenshot

wetransfer SRCNMENEBER Email Even more peace of mind with Plus Password protect your transfers Get WeTransfer Plus Help About us Got Plus?

Page Load Overview

1.99s

Total Load Time

261 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:50%

Script:Latin

Direction:ltr

Detection Details

Text Length:60 chars

Detector Agreement:100%

Website Classification

Primary Category

download file sharing58% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

download file sharing

58%

technology software

54%

documentation technical

39%

news media journalism

33%

government public service

31%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	64.29.17.3Aws · CLOUD	United States	AS16509Amazon.com, Inc.
1	216.198.79.3Aws · CLOUD	United States	AS16509Amazon.com, Inc.
1	216.198.79.131Aws · CLOUD	United States	AS16509Amazon.com, Inc.
1	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.17.207.5Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	142.251.20.95Google · CDN	United States	AS15169Google LLC
1	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.18.0.22Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	207.174.214.183	Phoenix, Arizona, United States	AS46606Unified Layer
1	64.29.17.131Aws · CLOUD	United States	AS16509Amazon.com, Inc.
13	11	-	-