mafupdate.wapamp.com
Open in
urlscan Pro
54.36.158.42
Malicious Activity!
Public Scan
Effective URL: http://mafupdate.wapamp.com/index
Submission: On August 19 via manual from GB
Summary
This is the only time mafupdate.wapamp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.192.94.58 54.192.94.58 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 54.36.158.42 54.36.158.42 | 16276 (OVH) (OVH) | |
6 | 203.16.41.161 203.16.41.161 | 10148 (UNIMELB-A...) (UNIMELB-AS-AP The University of Melbourne) | |
5 | 178.33.123.218 178.33.123.218 | 16276 (OVH) (OVH) | |
1 | 91.228.74.251 91.228.74.251 | 27281 (QUANTCAST) (QUANTCAST - Quantcast Corporation) | |
1 2 | 2600:9000:200... 2600:9000:200c:b800:6:44e3:f8c0:93a1 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 91.228.74.144 91.228.74.144 | 27281 (QUANTCAST) (QUANTCAST - Quantcast Corporation) | |
17 | 7 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-192-94-58.fra2.r.cloudfront.net
eu-west-1.protection.sophos.com |
ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU)
PTR: outlook.rch.org.au
outlook.rch.org.au |
ASN16276 (OVH, FR)
PTR: d2.xtgem.com
9.thumbs.xtstatic.com | |
enif.images.xtstatic.com | |
cif.images.xtstatic.com | |
xtgem.com |
ASN27281 (QUANTCAST - Quantcast Corporation, US)
edge.quantserve.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
rules.quantcount.com |
ASN27281 (QUANTCAST - Quantcast Corporation, US)
pixel.quantserve.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
rch.org.au
outlook.rch.org.au |
40 KB |
3 |
xtstatic.com
9.thumbs.xtstatic.com enif.images.xtstatic.com cif.images.xtstatic.com |
2 KB |
2 |
quantcount.com
1 redirects
rules.quantcount.com |
777 B |
2 |
xtgem.com
xtgem.com |
931 B |
2 |
quantserve.com
edge.quantserve.com pixel.quantserve.com |
6 KB |
2 |
wapamp.com
mafupdate.wapamp.com |
8 KB |
1 |
sophos.com
1 redirects
eu-west-1.protection.sophos.com |
369 B |
17 | 7 |
Domain | Requested by | |
---|---|---|
6 | outlook.rch.org.au |
mafupdate.wapamp.com
|
2 | rules.quantcount.com |
1 redirects
mafupdate.wapamp.com
|
2 | xtgem.com |
mafupdate.wapamp.com
|
2 | mafupdate.wapamp.com |
mafupdate.wapamp.com
|
1 | pixel.quantserve.com |
mafupdate.wapamp.com
|
1 | cif.images.xtstatic.com |
mafupdate.wapamp.com
|
1 | enif.images.xtstatic.com |
mafupdate.wapamp.com
|
1 | edge.quantserve.com |
mafupdate.wapamp.com
|
1 | 9.thumbs.xtstatic.com |
mafupdate.wapamp.com
|
1 | eu-west-1.protection.sophos.com | 1 redirects |
17 | 10 |
Subject Issuer | Validity | Valid | |
---|---|---|---|
outlook.rch.org.au DigiCert SHA2 High Assurance Server CA |
2017-03-20 - 2020-05-13 |
3 years | crt.sh |
1970-01-01 - 1970-01-01 |
a few seconds | crt.sh | |
*.quantserve.com DigiCert SHA2 High Assurance Server CA |
2018-10-16 - 2019-10-21 |
a year | crt.sh |
This page contains 4 frames:
Primary Page:
http://mafupdate.wapamp.com/index
Frame ID: 48DD69B9D33B53E0792ADC9561CFB2FC
Requests: 14 HTTP requests in this frame
Frame:
http://enif.images.xtstatic.com/tp.gif
Frame ID: 5044DA55D2F0E5E3C3706366E043C474
Requests: 1 HTTP requests in this frame
Frame:
http://cif.images.xtstatic.com/tp.gif
Frame ID: FF648E46885A148B73BBA0C225465612
Requests: 1 HTTP requests in this frame
Frame:
http://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9tYWZ1cGRhdGUud2FwYW1wLmNvbVwvaW5kZXgiLCJsb2dnZWRfaW4iOmZhbHNlLCJkb21haW4iOiJtYWZ1cGRhdGUud2FwYW1wLmNvbSIsInBvc2l0aW9uIjp7ImFic29sdXRlIjoiZml4ZWQifX0=
Frame ID: 6CFB3CBF8AAF44CBCBF28F0309EAFDCE
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://eu-west-1.protection.sophos.com/?d=wapamp.com&u=aHR0cDovL21hZnVwZGF0ZS53YXBhbXAuY29tL2luZGV4&e=dGVycnkucnVpd...
HTTP 302
http://mafupdate.wapamp.com/index Page URL
Detected technologies
Quantcast (Analytics) ExpandDetected patterns
- script /\.quantserve\.com\/quant\.js/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: The Soda Pop»
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://eu-west-1.protection.sophos.com/?d=wapamp.com&u=aHR0cDovL21hZnVwZGF0ZS53YXBhbXAuY29tL2luZGV4&e=dGVycnkucnVpdGVuYnVyZ0BzY3ZvLm9yZy51aw==&t=NTIzblM4VXJDbjdYUk5zL0g4RWJqYlBJcEQvQUNjTHA2c254K2J2VnorND0=
HTTP 302
http://mafupdate.wapamp.com/index Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 14- http://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js HTTP 301
- https://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
index
mafupdate.wapamp.com/ Redirect Chain
|
22 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logon.css
outlook.rch.org.au/owa/auth/15.0.847/themes/resources/ |
10 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flogon.js
outlook.rch.org.au/owa/auth/15.0.847/scripts/premium/ |
15 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
olk_logo_white.png
outlook.rch.org.au/owa/auth/15.0.847/themes/resources/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
olk_logo_white_small.png
outlook.rch.org.au/owa/auth/15.0.847/themes/resources/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
owa_text_blue.png
outlook.rch.org.au/owa/auth/15.0.847/themes/resources/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Sign_in_arrow.png
outlook.rch.org.au/owa/auth/15.0.847/themes/resources/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
the-soda-pop-14984.jpg
9.thumbs.xtstatic.com/100/50/-/91a39b4cdfcd4a2c027f149ab2280554/backtooldschool.xtgem.com/images/blog/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
quant.js
edge.quantserve.com/ |
12 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tp.gif
enif.images.xtstatic.com/ Frame 5044 |
0 0 |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tp.gif
cif.images.xtstatic.com/ Frame FF64 |
0 0 |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_gradient_login.png
mafupdate.wapamp.com/owa/auth/15.0.847/themes/resources/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
segoeui-regular.ttf
outlook.rch.org.au/owa/auth/15.0.847/themes/resources/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
__xt_authbar
xtgem.com/ Frame 6CFB |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
close2.png
xtgem.com/images/ |
564 B 931 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rules-p-0cfM8Oh7M9bVQ.js
rules.quantcount.com/ Redirect Chain
|
3 B 354 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel;r=520014676;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Fmafupdate.wapamp.com%2Findex;fpan=1;fpa=P0-1558992570-1566201493888;ns=0;ce=1;qjs=1;qv=4c19192-20180628134937;cm=;ref=;je=0;sr=1600x1200x24...
pixel.quantserve.com/ |
35 B 494 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- outlook.rch.org.au
- URL
- https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/segoeui-regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)38 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| initLogon function| redir function| shw function| hd function| clkExp function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick object| _qevents boolean| cookies number| len function| quantserve function| __qc object| ezt object| _qoptions8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
xtgem.com/ | Name: __template Value: web |
|
xtgem.com/ | Name: __lang Value: us |
|
.xtgem.com/ | Name: session Value: d2~037tj6f4b99d6hu55veh6qo860 |
|
mafupdate.wapamp.com/ | Name: cookieTest Value: 1 |
|
mafupdate.wapamp.com/ | Name: Value: test |
|
.wapamp.com/ | Name: __qca Value: P0-1558992570-1566201493888 |
|
.wapamp.com/ | Name: _xta_vid Value: 4cd26227082e9ec4508fe3ed25c10a7f-1566201491 |
|
.wapamp.com/ | Name: _xta_uid Value: 7df3f6af4180173d7299449af194ef90 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
9.thumbs.xtstatic.com
cif.images.xtstatic.com
edge.quantserve.com
enif.images.xtstatic.com
eu-west-1.protection.sophos.com
mafupdate.wapamp.com
outlook.rch.org.au
pixel.quantserve.com
rules.quantcount.com
xtgem.com
outlook.rch.org.au
178.33.123.218
203.16.41.161
2600:9000:200c:b800:6:44e3:f8c0:93a1
54.192.94.58
54.36.158.42
91.228.74.144
91.228.74.251
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
19c90326f386496efc6fa59724f5cbd579c069c3cbfdab55dcb2ddad541e65dd
3c56a7d6987506e5f6717b38a93d8eef986cc2ffb9b590cb393e1310972d91cc
404a9b0ffbcc813e8ddbb8d8510a24a69c09079282f8083ee94f4adc5d627176
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
67a67cf4237b674289013cb8ed12409c1f02196c6976f8f965d3cb0cb66dd237
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
9ef7af29eb089378a05e678a3331ef7616a7d07454f02c6002f83792d6ba1b29
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
bc5dcb35fc074321d66b9d7809e286e4afe72c7b08d1e799672126c92150ecd3
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
fc0d7caa36e3501250c6adf0446ec8171304a33792ab430d24b0915b9bd179a1