Security Scan: WeTransfer

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/f58261b0-093f-4517-b458-239c39cd9538 Domain and IP registration (RDAP)/api/v1/rdap/f58261b0-093f-4517-b458-239c39cd9538How often this domain was scanned/api/v1/domain/stats/1619a6a6.dffeefaaw.pages.dev Scan history for this domain/api/v1/domain/history/1619a6a6.dffeefaaw.pages.dev?limit=15

This website contacted 2 IPs in 1 country across 3 domains to perform 9 HTTP transactions. The main domain is pages.dev and was registered 6 years ago.

Submitted URL: https://1619a6a6.dffeefaaw.pages.dev/dlivery.html

Effective URL:

https://1619a6a6.dffeefaaw.pages.dev/dlivery

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 88%

Risk Score

Confirmed phishing page impersonating WeTransfer on a Cloudflare Pages subdomain, using fake file-share lures to harvest email credentials 'to confirm receiving' files. Flagged by Safe Browsing for social engineering.

Risk Factors (5)

Brand impersonation of WeTransfer on a mismatched, non-official domain

Credential-collecting form (password + email) framed as 'email confirmation'

Google Safe Browsing Social Engineering threats (2 instances)

Use of a free/instant hosting subdomain with a randomized hostname

Unranked domain with no legitimate reputation consistent with the claimed brand

Domain age information unavailable

Details

Page Title

WeTransfer

Scan Type

public

Favicon Hash

MMH3: -537232643

MD5: 692e1c7339c359b6412f059c9c9a0474

Domain Name Analysis

The domain '1619a6a6.dffeefaaw.pages.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain '1619a6a6.dffeefaaw'. Count 5 characters in 'pages' split between two vowels and 3 consonants. Segmentation suggests 1 word: pages. No strong language cues emerged from the frequency lists.