mass.report
Scan Intelligence Report0/100
medium Risk
airwallex.tqclaboratorio.com
https://airwallex.tqclaboratorio.com/
IP
172.67.185.56 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
5372 days
HTTP
200 · 25.2s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Visual Evidence
Zoom
Title: "Airwallex: Open a Business Account In Minutes for Global Businesses"
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Airwallex
Vendors
28/31
Status
partial
✓ bitdefender✓ microsoft✓ apple✓ spamhaus✓ netcraft✓ urlquery✓ apwg✓ virustotal✓ yandex✓ polyswarm✓ avast✓ urlabuse✗ brightcloud✓ openphish✓ urlscan✓ cisa✓ phishreport✓ isitphish✓ sophos✓ avg✓ drweb✗ norton✓ mcafee✓ emsisoft✓ phishtank✓ eset✓ chainpatrol✓ kaspersky✗ threatyeti✓ google✓ fortiguard
Registered-domain escalation
Submit tqclaboratorio.com as the primary IOC, enriched with evidence from hostile subdomains like airwallex.tqclaboratorio.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Airwallex
Credential Phishingfinance | technology · 7/19/2026
Summary
The page presents Airwallex branding with a page title and visuals consistent with Airwallex. However, the domain airwallex.tqclaboratorio.com is not the official Airwallex domain; the HTML embeds an iframe loading content from web.sakshiinfoway.com and includes a third-party script from cdn.searchad.com.br. The combination of a non-official subdomain, heavy reliance on an iframe, and external assets suggests impersonation or a high risk of credential capture through a SPA rendered inside an iframe. The static HTML contains no login form, but the SPA-rendered content could render a credential form at runtime, supported by the observed iframe and external assets. The SSL cert is legitimate for tqclaboratorio.com, but the host is a subdomain under tqclaboratorio.com, with an ATO-brand-name risk factor noted in the metadata.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://airwallex.tqclaboratorio.com/cdn-cgi/rum?.
▸Distinctive asset clues: v4513226cdae34746b4dedf0b4dfa099e1781791509496, v37Dosp373x-store.js, entry.BnO0UWo9.css, airwallex-common.C32PmmH7.css.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 206
Hosts: 4
Domains: 4
Attack Techniques (5)
Brand logo and page title visible on non-official domainUse of an iframe to load external content (iframe-based credential capture risk)SPA-like behavior indicated by zero static forms but presence of scripts rendering UIExternal script loading from third-party domain (cdn.searchad.com.br) and tracking beacon (cloudflareinsights)Redirection/embedding via iframe to an external domain (web.sakshiinfoway.com) used to present Airwallex UI
Indicators of Compromise (6)
▸Hostname airwallex.tqclaboratorio.com presenting Airwallex branding
▸Iframe loading from https://web.sakshiinfoway.com/airwallex
▸External assets from cdn.searchad.com.br and cloudflareinsights
▸POST request to https://airwallex.tqclaboratorio.com/cdn-cgi/rum? (204) – suspicious telemetry/rumor endpoint
▸No static login form in HTML; SPA-style rendering expected
▸SSL cert subject for tqclaboratorio.com, not official Airwallex domain
Risk AssessmentUsed in abuse reports
The page is impersonating Airwallex branding on a non-official subdomain and uses an iframe to load content from an external domain, which is a common pattern for credential-phishing attempts. While the static HTML does not show a login form, the SPA architecture and iframe content could render credential capture interfaces at runtime. The presence of unfamiliar third-party hosting and a suspicious POST endpoint adds to the risk. This warrants action and further investigation by the hosting provider and brand protection teams.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API