mafupdate.wapamp.com Open in urlscan Pro
54.36.158.41  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set index Show response mafupdate.wapamp.com/	22 KB 7 KB	4968ms 1109ms	Document text/html	54.36.158.41 OVH
General Check archive.org Show headers Download Go to Full URL http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Server 54.36.158.41 , France, ASN16276 (OVH, FR), Reverse DNS lb.xtgem.com Software / Resource Hash 245f92464ace823eeb7fc688c1c5b3b52c4e81c3017b67e2beda6bdaae5495d0 Request headers Host mafupdate.wapamp.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 17 Aug 2019 09:15:42 GMT Vary Host,Accept-Encoding Set-Cookie _xta_uid=c08cb3ede30f3ed86b475c33b392e81e; expires=Mon, 16-Aug-2021 09:15:42 GMT; Max-Age=63072000; path=/; domain=.wapamp.com; httponly _xta_vid=b9ccb212480d2642b5f18676194f3326-1566033343; expires=Sat, 17-Aug-2019 09:45:43 GMT; Max-Age=1800; path=/; domain=.wapamp.com; httponly Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Pragma no-cache Expires Wed, 17 Sep 1975 21:32:10 GMT Content-Encoding gzip Content-Length 6106 Content-Type text/html; charset=utf-8 X-App-Server bk-xtgem/w4 Age 0 X-Cache MISS X-Cache-Hits 0 Accept-Ranges bytes Connection close
GET H/1.1	200 OK	logon.css outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	10 KB 10 KB	2864ms 697ms	Stylesheet text/css	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/logon.css Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 3c56a7d6987506e5f6717b38a93d8eef986cc2ffb9b590cb393e1310972d91cc Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id f9a8dcdf-0330-4464-a5ea-6943f26a2004 Date Sat, 17 Aug 2019 09:15:45 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type text/css Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 10174
GET H/1.1	200 OK	flogon.js Show response outlook.rch.org.au/owa/auth/15.0.847/scripts/premium/	15 KB 15 KB	3282ms 418ms	Script application/javascript	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Full URL https://outlook.rch.org.au/owa/auth/15.0.847/scripts/premium/flogon.js Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 19c90326f386496efc6fa59724f5cbd579c069c3cbfdab55dcb2ddad541e65dd Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id 240bc7ab-99ac-481e-a0fa-7889ae4dae2f Date Sat, 17 Aug 2019 09:15:45 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type application/javascript Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 15416
GET H/1.1	200 OK	olk_logo_white.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	2 KB 3 KB	3562ms 280ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/olk_logo_white.png Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id 99de0f18-5980-4eb7-b5b3-fca9bf112f7a Date Sat, 17 Aug 2019 09:15:46 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 2503
GET H/1.1	200 OK	olk_logo_white_small.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	4 KB 4 KB	3843ms 281ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/olk_logo_white_small.png Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id 0b37a8af-90c8-43be-9632-02d107cf90ea Date Sat, 17 Aug 2019 09:15:46 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 3595
GET H/1.1	200 OK	owa_text_blue.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	6 KB 6 KB	848ms 287ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/owa_text_blue.png Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717 Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id b66ed37f-c670-48a6-bb35-ef471dd3d59b Date Sat, 17 Aug 2019 09:15:46 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 5856
GET H/1.1	200 OK	Sign_in_arrow.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	1 KB 2 KB	1175ms 325ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/Sign_in_arrow.png Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7 Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id 761d992f-1cdf-42cf-a638-f2c9bbf60bb0 Date Sat, 17 Aug 2019 09:15:47 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 1441
GET H/1.1	200 OK	disneyland-1972-love-the-old-s-92184.jpg 5.thumbs.xtstatic.com/100/50/-/5a863a045714f1131d9c0a62603ddf96/backtooldschool.xtgem.com/images/blog/	2 KB 2 KB	1159ms 124ms	Image image/jpeg	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://5.thumbs.xtstatic.com/100/50/-/5a863a045714f1131d9c0a62603ddf96/backtooldschool.xtgem.com/images/blog/disneyland-1972-love-the-old-s-92184.jpg Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security , , Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash b4c5e88c51a0bf8f35880acda55d57853738b0c066fd11608b57c71bca755e4b Request headers Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 17 Aug 2019 09:15:47 GMT X-Ngz 1 Last-Modified Sun, 28 Oct 2018 05:53:10 GMT Age 0 ETag "6a9-0" Sent-XS 0.000 X-Cache MISS Content-Type image/jpeg Expires Mon, 19 Aug 2019 09:15:47 GMT Cache-Control max-age=172800, pre-check=172800 Connection close Accept-Ranges bytes X-App-Server bk-xtstatic-int/w4 Content-Length 1705 X-Cache-Hits 0
GET		quant.js edge.quantserve.com/	0 0
GET H/1.1	200 OK	tp.gif enif.images.xtstatic.com/ Frame E9BA	0 0	1087ms 56ms	Document image/gif	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Full URL http://enif.images.xtstatic.com/tp.gif Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash Request headers Host enif.images.xtstatic.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Referer http://mafupdate.wapamp.com/index Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://mafupdate.wapamp.com/index Response headers Date Sat, 17 Aug 2019 09:15:47 GMT Last-Modified Mon, 11 Dec 2017 13:05:49 GMT ETag "2a-5601031744540" Content-Length 42 Cache-Control max-age=2592000 Expires Mon, 16 Sep 2019 09:15:47 GMT Content-Type image/gif X-App-Server bk-xtstatic-int/w4 Age 0 X-Cache MISS X-Cache-Hits 0 Accept-Ranges bytes Connection close
GET		tp.gif cif.images.xtstatic.com/ Frame 6569	0 0
GET		bg_gradient_login.png mafupdate.wapamp.com/owa/auth/15.0.847/themes/resources/	0 0
GET		segoeui-regular.ttf outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	0 0
GET		__xt_authbar xtgem.com/ Frame 1006	0 0
GET		close2.png xtgem.com/images/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

edge.quantserve.com

URL

http://edge.quantserve.com/quant.js

Domain

cif.images.xtstatic.com

URL

http://cif.images.xtstatic.com/tp.gif

Domain

mafupdate.wapamp.com

URL

http://mafupdate.wapamp.com/owa/auth/15.0.847/themes/resources/bg_gradient_login.png

Domain

outlook.rch.org.au

URL

https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/segoeui-regular.ttf

Domain

xtgem.com

URL

http://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9tYWZ1cGRhdGUud2FwYW1wLmNvbVwvaW5kZXgiLCJsb2dnZWRfaW4iOmZhbHNlLCJkb21haW4iOiJtYWZ1cGRhdGUud2FwYW1wLmNvbSIsInBvc2l0aW9uIjp7ImFic29sdXRlIjoiZml4ZWQifX0=

Domain

xtgem.com

URL

http://xtgem.com/images/close2.png?v=0.01

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| initLogon function| redir function| shw function| hd function| clkExp function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick object| _qevents boolean| cookies number| len

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mafupdate.wapamp.com/	1969-12-31 23:59:59	Name: cookieTest Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5.thumbs.xtstatic.com
cif.images.xtstatic.com
edge.quantserve.com
enif.images.xtstatic.com
mafupdate.wapamp.com
outlook.rch.org.au
xtgem.com
cif.images.xtstatic.com
edge.quantserve.com
mafupdate.wapamp.com
outlook.rch.org.au
xtgem.com
178.33.123.218
203.16.41.161
54.36.158.41
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
19c90326f386496efc6fa59724f5cbd579c069c3cbfdab55dcb2ddad541e65dd
245f92464ace823eeb7fc688c1c5b3b52c4e81c3017b67e2beda6bdaae5495d0
3c56a7d6987506e5f6717b38a93d8eef986cc2ffb9b590cb393e1310972d91cc
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
b4c5e88c51a0bf8f35880acda55d57853738b0c066fd11608b57c71bca755e4b
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b