mafupdate.wapamp.com Open in urlscan Pro
54.36.158.42  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set index Show response mafupdate.wapamp.com/	22 KB 7 KB	2226ms 1417ms	Document text/html	54.36.158.42 OVH
General Check archive.org Show headers Download Go to Full URL http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Server 54.36.158.42 , France, ASN16276 (OVH, FR), Reverse DNS lb.xtgem.com Software / Resource Hash 9a4b43b9b098bdb1cecf50ef2a61c0cfdacc03c424c30b6364419cc417a0ca7f Request headers Host mafupdate.wapamp.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 21 Aug 2019 18:19:16 GMT Vary Host,Accept-Encoding Set-Cookie _xta_uid=d0dcc2e89b770ee013025cf1f8ed4d2d; expires=Fri, 20-Aug-2021 18:19:17 GMT; Max-Age=63072000; path=/; domain=.wapamp.com; httponly _xta_vid=b50f2a1cf7c6ec243a8bb714b435782b-1566411557; expires=Wed, 21-Aug-2019 18:49:17 GMT; Max-Age=1800; path=/; domain=.wapamp.com; httponly Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Pragma no-cache Expires Wed, 17 Sep 1975 21:32:10 GMT Content-Encoding gzip Content-Length 6093 Content-Type text/html; charset=utf-8 X-App-Server bk-xtgem/w4 Age 0 X-Cache MISS X-Cache-Hits 0 Accept-Ranges bytes Connection close
GET H/1.1	200 OK	logon.css outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	10 KB 10 KB	8962ms 557ms	Stylesheet text/css	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/logon.css Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 3c56a7d6987506e5f6717b38a93d8eef986cc2ffb9b590cb393e1310972d91cc Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id b4486392-73bc-42c9-9ce7-6c9d197a736b Date Wed, 21 Aug 2019 18:19:26 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type text/css Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 10174
GET H/1.1	200 OK	flogon.js Show response outlook.rch.org.au/owa/auth/15.0.847/scripts/premium/	15 KB 15 KB	9245ms 283ms	Script application/javascript	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Full URL https://outlook.rch.org.au/owa/auth/15.0.847/scripts/premium/flogon.js Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 19c90326f386496efc6fa59724f5cbd579c069c3cbfdab55dcb2ddad541e65dd Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id 3a3c2ca9-505f-4c47-abaf-0a75e2593755 Date Wed, 21 Aug 2019 18:19:26 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type application/javascript Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 15416
GET H/1.1	200 OK	olk_logo_white.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	2 KB 3 KB	9526ms 281ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/olk_logo_white.png Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id 66846d26-e059-47b4-a99c-f32836c337e2 Date Wed, 21 Aug 2019 18:19:26 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 2503
GET H/1.1	200 OK	olk_logo_white_small.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	4 KB 4 KB	9885ms 359ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/olk_logo_white_small.png Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id fb68160d-6c4e-428e-ad7f-cb6f7547a481 Date Wed, 21 Aug 2019 18:19:27 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 3595
GET H/1.1	200 OK	owa_text_blue.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	6 KB 6 KB	967ms 328ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/owa_text_blue.png Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717 Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id de0ec30b-ab35-4d4f-8be5-a759955e18e7 Date Wed, 21 Aug 2019 18:19:27 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 5856
GET H/1.1	200 OK	Sign_in_arrow.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	1 KB 2 KB	1248ms 281ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/Sign_in_arrow.png Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS outlook.rch.org.au Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7 Request headers Sec-Fetch-Mode no-cors Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers request-id baff7d1e-bf92-4d20-9480-61cf081d679c Date Wed, 21 Aug 2019 18:19:27 GMT Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "050875422ecf1:0" Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 1441
GET H/1.1	200 OK	pacman-rainbows-and-roller-ska-4284.jpg 3.thumbs.xtstatic.com/100/50/-/3b6c32f88af4658b12f405e98a802385/backtooldschool.xtgem.com/images/blog/	2 KB 2 KB	15852ms 107ms	Image image/jpeg	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://3.thumbs.xtstatic.com/100/50/-/3b6c32f88af4658b12f405e98a802385/backtooldschool.xtgem.com/images/blog/pacman-rainbows-and-roller-ska-4284.jpg Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security , , Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash 417bc1845525cb09a8bb7450808c2fc0c1ac774a97483e412c2b77a3d6037bc4 Request headers Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 21 Aug 2019 18:19:42 GMT X-Ngz 1 Last-Modified Sun, 28 Oct 2018 05:28:59 GMT Age 0 ETag "750-0" Sent-XS 0.000 X-Cache MISS Content-Type image/jpeg Expires Fri, 23 Aug 2019 18:19:42 GMT Cache-Control max-age=172800, pre-check=172800 Connection close Accept-Ranges bytes X-App-Server bk-xtstatic-int/w3 Content-Length 1872 X-Cache-Hits 0
GET		quant.js edge.quantserve.com/	0 0
GET		tp.gif enif.images.xtstatic.com/ Frame 61AA	0 0
GET		tp.gif cif.images.xtstatic.com/ Frame BF39	0 0
GET H/1.1	404 Not Found	bg_gradient_login.png mafupdate.wapamp.com/owa/auth/15.0.847/themes/resources/	1 KB 1 KB	3639ms 570ms	Image text/html	54.36.158.42 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://mafupdate.wapamp.com/owa/auth/15.0.847/themes/resources/bg_gradient_login.png Requested by Host: mafupdate.wapamp.com URL: http://mafupdate.wapamp.com/index Protocol HTTP/1.1 Security , , Server 54.36.158.42 , France, ASN16276 (OVH, FR), Reverse DNS lb.xtgem.com Software / Resource Hash fc0d7caa36e3501250c6adf0446ec8171304a33792ab430d24b0915b9bd179a1 Request headers Referer http://mafupdate.wapamp.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 21 Aug 2019 18:19:30 GMT X-Ngz 1 Age 0 X-Cache MISS Content-Type text/html; charset=UTF-8 Connection close X-App-Server bk-xtgem/w4 Content-Length 1311 X-Cache-Hits 0
GET		segoeui-regular.ttf outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	0 0
GET		__xt_authbar xtgem.com/ Frame FD86	0 0
GET		close2.png xtgem.com/images/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

edge.quantserve.com

URL

http://edge.quantserve.com/quant.js

Domain

enif.images.xtstatic.com

URL

http://enif.images.xtstatic.com/tp.gif

Domain

cif.images.xtstatic.com

URL

http://cif.images.xtstatic.com/tp.gif

Domain

outlook.rch.org.au

URL

https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/segoeui-regular.ttf

Domain

xtgem.com

URL

http://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9tYWZ1cGRhdGUud2FwYW1wLmNvbVwvaW5kZXgiLCJsb2dnZWRfaW4iOmZhbHNlLCJkb21haW4iOiJtYWZ1cGRhdGUud2FwYW1wLmNvbSIsInBvc2l0aW9uIjp7ImFic29sdXRlIjoiZml4ZWQifX0=

Domain

xtgem.com

URL

http://xtgem.com/images/close2.png?v=0.01

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| initLogon function| redir function| shw function| hd function| clkExp function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick object| _qevents boolean| cookies number| len

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3.thumbs.xtstatic.com
cif.images.xtstatic.com
edge.quantserve.com
enif.images.xtstatic.com
mafupdate.wapamp.com
outlook.rch.org.au
xtgem.com
cif.images.xtstatic.com
edge.quantserve.com
enif.images.xtstatic.com
outlook.rch.org.au
xtgem.com
178.33.123.218
203.16.41.161
54.36.158.42
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
19c90326f386496efc6fa59724f5cbd579c069c3cbfdab55dcb2ddad541e65dd
3c56a7d6987506e5f6717b38a93d8eef986cc2ffb9b590cb393e1310972d91cc
417bc1845525cb09a8bb7450808c2fc0c1ac774a97483e412c2b77a3d6037bc4
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
9a4b43b9b098bdb1cecf50ef2a61c0cfdacc03c424c30b6364419cc417a0ca7f
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
fc0d7caa36e3501250c6adf0446ec8171304a33792ab430d24b0915b9bd179a1