Scan report · 3 months agoPublic

email.best.wondershare.com

34.102.239.211AS396982 · US

Submittedhttps://email.best.wondershare.com/c/eJyEkkGPmzAQhX-NuSWyZ4yxDxy2Rem1UlX1aBkzIXQBI2wa7b-vWNM2qiLtkcd7M988uasld6BFQbWotORaAFbFrdaAV9RkFEJbidZ1LRdeOO6UdIBaFkMNHBSvhBQgSwlnDtgq1aLquhJaqZjkLcV0voe5ozXe3EpnH6ZirG8pLZHhC4MLg8t1GKewuv99DC5uS-Hk3ZKGMJ9vaRoZXu79YpPrGTaotDDGcisMYIUKUFVcG620MbYyojSWJjeMDFT0Nq3Ov9qhY9h0lQBtOiGvwitO2ns0V9SahO5aTToHwkKr2zfn0J9jrQEJ3Fhpj_33fsmBiWJ0PWX7E6bsWmLYVk8Mmwe4bohpmH3KWWW0NKYUR2J7Ji7HFi4YfNZSHUfStIwuHQzvHRz2Nfwknxg231_sjy9f7be3mGhioPY-p9h_QP2vjNx9Vodo4-u20_uwzelR92FbwvyodFue8FeLFGP-dlxwNGV7KkmIk6QrnYysxEkDeipBidKUOeNdoj6sbztG3CdVnxg2T380xVqPoR_mITHJ-73s9-eX6idXFr9q-B0AAP__vX_qRQ

Landed onhttps://filmora.wondershare.com/auto-caption.html?wgp_tag=368199_0_1923736236708986899_79159_email&sc_track_id=d71289d14f1c60e8cc39f388e18db8e8&sc_operation_id=20260714_924209_4_368199_wgp&sc_message_id=1923736236708986899&sc_psource=email&sc_distinct_id=698499519&sc_uid=698499519&sc_pid=1901,846&sc_template_id=79159&sc_project=UA_WGP_System&wgp_msg_id=1923736236708986899&sc_operation_tag=&sc_is_sku_discount=&sc_is_coupon=&sc_is_duration=&sc_session=a010395b-5e11-4efe-9471-823ce5261595&sc_category_tags=%7B=sc_category_tags=%7D· 1 redirect

Verdict

0 of 7 enginesCleanAutomated

Own this site?

Looks safe

Automated

Our automated checks did not find known threat signals on this site at the time of the scan.

What to do

No action needed. Stay alert as usual — a clean result reflects this scan only, and sites can change after they are checked.

A clean result means no known threat signals were found in this scan — it is not an absolute guarantee, and a site can change after it is checked.

Findings

Strongest first

InfoCross-domain scripts injected at runtime

25 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileCleanThe engine stored it under a generated name

SHA-25662c8a3780f0eb14744c8b57404f3faba4f228c8cb2154c70508b4d4062295c89

Infrastructure

IP: 34.102.239.211GOOGLE-CLOUD-PLATFORM - Google LLC, US · AS396982US
TLS: CN=YE2, O=Let's Encrypt, C=US · expires Sep 12, 2026
Redirects: 1 hop · /c/eJyEkkGPmzAQhX-NuSWyZ4yxD…s9-eX6idXFr9q-B0AAP__vX_qRQ → /auto-caption.html?wgp_tag=3…gs=%7B=sc_category_tags=%7D

WHOIS

Registrar: Xiamen 35.com Information Co., Ltd.
Created: Sep 17, 2003
Expires: Sep 17, 2030
Nameservers: vip3.alidns.comvip4.alidns.com

6 malicious

Hashes & fingerprints

Page Hashed16ab3e222cd0a37faa5f36e558b57cf53a1c2fdceb70f5fbfe26cd5d79bef3 Favicon Hashcf7573cddb95dcf5d5bf39153f11ee4d212a05db6d7aadd18dd42b038a866060 DOM Hashc069a06198ce7ffad9dec629a1a8c661575e881236d7462ad1bb3ea97ea0af57 Screenshot pHash97e68199c307fb18 JARM40d40d40d00000000043d40d40d43d684d61a135bd962c8dd9c541ddbaefa8 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint08C6B4968B3188C6F85F095FCA90FE6B026A3F27 Cert IssuerCN=YE2, O=Let's Encrypt, C=US

Page capture

Live

Title “Automatic Caption in Videos | Filmora”

Visit Site

Engines

7 · time to verdict