mass.report
Scan Intelligence Report0/100
low Risk
www-airwallex.mainst.biz
https://www-airwallex.mainst.biz/?utm_source=google&utm_medium=cpc&utm_campaign=24011657401&utm_content=201215669227_815770802391&utm_term=airwallex&gclid=CjwKCAjwpK3SBhASEiwAtV1SPP68kqta3CbezLVeblWVYfhkMQzZxuEa_BvH_xzNqe0nf8ucDN2_6BoCG_8QAvD_BwE&gad_source=1&gad_campaignid=24011657401&gbraid=0AAAAAD7G9KiIEDYT6Lzu9Tz_UgvkiD-E6&gclid=CjwKCAjwpK3SBhASEiwAtV1SPP68kqta3CbezLVeblWVYfhkMQzZxuEa_BvH_xzNqe0nf8ucDN2_6BoCG_8QAvD_BwE
IP
104.21.9.96 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
8992 days
HTTP
200 · 60.0s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Visual Evidence
Zoom
Title: "Airwallex: Open a Business Account In Minutes for Global Businesses"
Registered-domain escalation
Submit mainst.biz as the primary IOC, enriched with evidence from hostile subdomains like www-airwallex.mainst.biz.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Scanner blocked by cloudflare
This scan likely captured a block/challenge page, so the AI analysis may not reflect the real site victims see.
Airwallex
Unknownfinance | technology · 7/19/2026
Summary
The page is branded as Airwallex but is hosted on a suspicious subdomain (www-airwallex.mainst.biz) with a Cloudflare IP and a layout that resembles Airwallex. Static HTML shows no forms, but the page loads numerous scripts and an iframe pointing to a separate domain (web.sakshiinfoway.com) which hosts additional assets, suggesting obfuscated credential collection via a SPA. The presence of an iframe and external script sources, plus a suspicious hosting domain, indicates potential credential harvesting or phishing through a cloaked first-party brand facade, though the page could also be a legitimate marketing page obfuscated by a compromised or malicious host.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://www-airwallex.mainst.biz/cdn-cgi/challenge-platform/h/b/jsd/oneshot/80a697ecdece/0.13776508981884916:1783371919:7xuR3D79WL_L6pLNvOjQxQvNMi_rng-xfp1xqkiuujc/a171e31689f45629, https://www-airwallex.mainst.biz/cdn-cgi/rum?.
▸Distinctive asset clues: v4513226cdae34746b4dedf0b4dfa099e1781791509496, main.js, entry.BnO0UWo9.css, airwallex-common.C32PmmH7.css.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 206
Hosts: 4
Domains: 4
Observed Signals (3)
Suspicious iframe embedding of external domain (web.sakshiinfoway.com) within a page branded as AirwallexSPA-style dynamic credential collection risk (static HTML contains no forms; forms rendered by JavaScript)Redirection/requests to challenge-platform endpoints and oneshot endpoints suggesting anti-bot or credential capture mechanisms
Observed Indicators (1)
▸No static login form in HTML; credential capture likely via SPA JS
Risk AssessmentUsed in abuse reports
The scan indicates the page is attempting to proxy Airwallex branding from a non-official domain (mainst.biz subdomain) and loads an iframe to an external domain, which is a strong signal of impersonation/phishing setup. The absence of static forms but presence of dynamic script loads and an iframe suggests credential collection in a SPA environment. The page is hosted under a domain not affiliated with Airwallex, and there is evidence of anti-bot/anti-scraping mechanisms (challenge platform interactions) and a WAF block scenario, which is typical for sites attempting to evade scans while targeting victims. Given these indicators, this website should be treated as phishing/impersonation with potential credential harvesting, and the hosting domain appears malicious or suspicious.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API