www.mailfiltersec.xyz

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 178.159.36.89, located in Russian Federation and belongs to AS-MAROSNET Moscow, Russia, RU. The main domain is www.mailfiltersec.xyz.

This is the only time www.mailfiltersec.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

	IP Address		AS Autonomous System
7	178.159.36.89 178.159.36.89		48666 (AS-MAROSN...) (AS-MAROSNET Moscow)
7	1

7 178.159.36.89 (Russian Federation)

ASN48666 (AS-MAROSNET Moscow, Russia, RU)

www.mailfiltersec.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	mailfiltersec.xyz www.mailfiltersec.xyz	464 KB
7	1

	Domain	Requested by
7	www.mailfiltersec.xyz	www.mailfiltersec.xyz
7	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://www.mailfiltersec.xyz/almost/wt/
Frame ID: 8D4A64C88BE0F903D645A05C920C509E
Requests: 6 HTTP requests in this frame

Frame: http://www.mailfiltersec.xyz/almost/wt/bg.png
Frame ID: 517CD1AD7DB5ACF2348C439952046BD9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

464 kB
Transfer

463 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.mailfiltersec.xyz/almost/wt/	9 KB 9 KB	362ms 213ms	Document text/html	178.159.36.89 AS-MAROSNET Moscow
General Check archive.org Show headers Download Go to Full URL http://www.mailfiltersec.xyz/almost/wt/ Protocol HTTP/1.1 Server 178.159.36.89 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU), Reverse DNS Software Apache / Resource Hash `04ea5ae178d46aa6f043ba69308eaace009a9896e8d173e1c6015152495a4524` Request headers Host www.mailfiltersec.xyz Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 05 Mar 2020 18:38:38 GMT Server Apache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	404 Not Found	analytics.js.html www.mailfiltersec.xyz/almost/wt/WeTransfer_files/	0 0	145ms 125ms	Script text/html	178.159.36.89 AS-MAROSNET Moscow
General Check archive.org Show headers Download Go to Full URL http://www.mailfiltersec.xyz/almost/wt/WeTransfer_files/analytics.js.html Requested by Host: www.mailfiltersec.xyz URL: http://www.mailfiltersec.xyz/almost/wt/ Protocol HTTP/1.1 Server 178.159.36.89 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU), Reverse DNS Software Apache / Resource Hash Request headers Referer http://www.mailfiltersec.xyz/almost/wt/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 05 Mar 2020 18:38:39 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	bWqOLA69nu2fsMi45LjA.js.html www.mailfiltersec.xyz/almost/wt/WeTransfer_files/	0 0	146ms 125ms	Script text/html	178.159.36.89 AS-MAROSNET Moscow
General Check archive.org Show headers Download Go to Full URL http://www.mailfiltersec.xyz/almost/wt/WeTransfer_files/bWqOLA69nu2fsMi45LjA.js.html Requested by Host: www.mailfiltersec.xyz URL: http://www.mailfiltersec.xyz/almost/wt/ Protocol HTTP/1.1 Server 178.159.36.89 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU), Reverse DNS Software Apache / Resource Hash Request headers Referer http://www.mailfiltersec.xyz/almost/wt/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 05 Mar 2020 18:38:39 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	gtm.js.html www.mailfiltersec.xyz/almost/wt/WeTransfer_files/	0 0	146ms 126ms	Script text/html	178.159.36.89 AS-MAROSNET Moscow
General Check archive.org Show headers Download Go to Full URL http://www.mailfiltersec.xyz/almost/wt/WeTransfer_files/gtm.js.html Requested by Host: www.mailfiltersec.xyz URL: http://www.mailfiltersec.xyz/almost/wt/ Protocol HTTP/1.1 Server 178.159.36.89 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU), Reverse DNS Software Apache / Resource Hash Request headers Referer http://www.mailfiltersec.xyz/almost/wt/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 05 Mar 2020 18:38:39 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	webrtc-patch.js www.mailfiltersec.xyz/almost/wt/chrome-extension_/fdcgdnkidjaadafnichfpabhfomcebme/scripts/	0 0	147ms 127ms	Script text/html	178.159.36.89 AS-MAROSNET Moscow
General Check archive.org Show headers Download Go to Full URL http://www.mailfiltersec.xyz/almost/wt/chrome-extension_/fdcgdnkidjaadafnichfpabhfomcebme/scripts/webrtc-patch.js Requested by Host: www.mailfiltersec.xyz URL: http://www.mailfiltersec.xyz/almost/wt/ Protocol HTTP/1.1 Server 178.159.36.89 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU), Reverse DNS Software Apache / Resource Hash Request headers Referer http://www.mailfiltersec.xyz/almost/wt/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 05 Mar 2020 18:38:39 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	application-bd95c1c273b3b6f2c6b24f2eaeeaef30be54981e5727d3ac981a5e003b93d6a6.css www.mailfiltersec.xyz/almost/wt/WeTransfer_files/	391 KB 391 KB	79ms 72ms	Stylesheet text/css	178.159.36.89 AS-MAROSNET Moscow
General Check archive.org Show headers Download Go to Full URL http://www.mailfiltersec.xyz/almost/wt/WeTransfer_files/application-bd95c1c273b3b6f2c6b24f2eaeeaef30be54981e5727d3ac981a5e003b93d6a6.css Requested by Host: www.mailfiltersec.xyz URL: http://www.mailfiltersec.xyz/almost/wt/ Protocol HTTP/1.1 Server 178.159.36.89 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU), Reverse DNS Software Apache / Resource Hash `7650cccb518dc3993c51d7a477c1676cf331e22856d2a5456178e5dc96f0ac39` Request headers Referer http://www.mailfiltersec.xyz/almost/wt/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 05 Mar 2020 18:38:38 GMT Last-Modified Sat, 15 Sep 2018 14:13:10 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 400626
GET H/1.1	200 OK	bg.png Show response www.mailfiltersec.xyz/almost/wt/ Frame 517C	63 KB 63 KB	141ms 125ms	Document image/png	178.159.36.89 AS-MAROSNET Moscow
General Check archive.org Show headers Download Go to Full URL http://www.mailfiltersec.xyz/almost/wt/bg.png Requested by Host: www.mailfiltersec.xyz URL: http://www.mailfiltersec.xyz/almost/wt/ Protocol HTTP/1.1 Server 178.159.36.89 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU), Reverse DNS Software Apache / Resource Hash `0af2fd6548db2f2f7ce85324b228f9a1c4b8413b755ba7e898aa8926c6f25660` Request headers Host www.mailfiltersec.xyz Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://www.mailfiltersec.xyz/almost/wt/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mailfiltersec.xyz/almost/wt/ Response headers Date Thu, 05 Mar 2020 18:38:39 GMT Server Apache Last-Modified Wed, 31 Jul 2019 13:39:48 GMT Accept-Ranges bytes Content-Length 64304 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| init

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://www.mailfiltersec.xyz/almost/wt/(Line 70) Message: [object CSSStyleDeclaration]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.mailfiltersec.xyz
178.159.36.89
04ea5ae178d46aa6f043ba69308eaace009a9896e8d173e1c6015152495a4524
0af2fd6548db2f2f7ce85324b228f9a1c4b8413b755ba7e898aa8926c6f25660
7650cccb518dc3993c51d7a477c1676cf331e22856d2a5456178e5dc96f0ac39

www.mailfiltersec.xyz Open in urlscan Pro 178.159.36.89 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

464 kBTransfer

463 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.mailfiltersec.xyz Open in urlscan Pro
178.159.36.89 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

464 kB
Transfer

463 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!