# PhishDestroy domain threat record: ueya.mx

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ueya.mx/
Machine-readable companion: https://phishdestroy.io/domain/ueya.mx/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-11 12:24:24 UTC
- Last availability or vendor check: 2026-10-22 10:38:34 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 8/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: wetransfer

## Stored infrastructure

- Observed IP address: 108.179.194.83
- Registrar in stored WHOIS data: AKKY ONLINE SOLUTIONS, S.A. DE C.V.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2025-02-20 23:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a12aea-0767-777b-a7ff-deb64b8360b2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ueya.mx
- Certificate Transparency search: https://crt.sh/?q=%25.ueya.mx
- Web Archive lookup: https://web.archive.org/web/*/https://ueya.mx/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
ueya.mx is a phishing page that imitates WeTransfer. It targets people who receive what looks like a file-sharing notice and expect to download a document. PhishDestroy first flagged it on 2026-10-11, and it was still online with live content when last checked on 2026-10-19. The page title reads "Not Acceptable!", which looks like a server error message, while our classification is WeTransfer impersonation.

How the scam works
WeTransfer lures usually start with an email or message saying files are waiting. The link opens a page styled like a WeTransfer download screen. Before the "files" can be opened, the visitor is asked to sign in, often with their email or work account password. Whatever is typed goes to the operators. A stolen mailbox can then be used to reset other passwords, read invoices and send the same lure to the victim's contacts.

Evidence
On 2026-10-12, eight of 92 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, G-Data, MalwareURL, SOCRadar, Sophos and URLQuery. That is a modest count, but it comes from vendors with separate detection pipelines. urlscan.io rated the page malicious and recognised WeTransfer branding on it. Spamhaus DBL lists the domain as DBL_ABUSED_PHISH, and it appears in five AlienVault OTX threat pulses. It is also on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2025-02-21 through AKKY ONLINE SOLUTIONS, S.A. DE C.V., about twenty months before PhishDestroy detected the phishing. That long gap fits Spamhaus's "abused" category, which marks domains that existed before phishing content appeared on them. The site resolves to 108.179.194.83 on the Oracle Corporation network (ORACLE-BMC-31898), geolocated to Mexico.

What to do
If you entered a password on this page, change it right away, starting with your email account. Change it anywhere else you reused it. Turn on two-factor authentication and sign out of all active sessions. Check your mailbox for new forwarding rules or filters you did not create, and warn your contacts, since compromised inboxes often send the same lure onward. Do not trust a WeTransfer link unless the sender confirms it through a separate channel. Defenders should block ueya.mx at the mail and web gateway and search logs for clicks or submissions to it. Report the domain to the registrar and hosting provider so the page can be removed.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a12aea-0767-777b-a7ff-deb64b8360b2/
VirusTotal report: https://www.virustotal.com/gui/domain/ueya.mx
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ueya.mx
Archived copy: https://web.archive.org/web/20261011121917/https://ueya.mx/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:37 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a12aea-0767-777b-a7ff-deb64b8360b2.png
  Captured: 2026-10-11 12:24:24 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a12aea-0767-777b-a7ff-deb64b8360b2.png
  Captured: 2026-10-11 12:24:24 UTC
  Source report: https://urlscan.io/result/01a12aea-0767-777b-a7ff-deb64b8360b2/
- URLScan capture 2: https://urlscan.io/screenshots/01a112c0-69c2-747a-b11b-de2bf4db3b56.png
  Captured: 2026-10-11 12:15:56 UTC
  Source report: https://urlscan.io/result/01a12aea-0767-777b-a7ff-deb64b8360b2/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1c9265e3-ed24-4dfa-b089-321ac3d68aaa.png
  Captured: 2026-10-12 09:39:25 UTC
  Source report: https://radar.cloudflare.com/scan/1c9265e3-ed24-4dfa-b089-321ac3d68aaa
  SHA-256: 41c7f42df5b186258242c2ee5ced4f4a659cf8df342e02154a02de8d29bda5c2
- URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0ddcf-26d6-7273-b0e4-4d5063e2c32e.png
  Captured: 2026-09-26 13:02:21 UTC
  Source report: https://urlscan.io/result/01a0ddcf-26d6-7273-b0e4-4d5063e2c32e/
  SHA-256: cc49320f9684b9f5caab8014cac105acb023bb51ff07cabda1705ce3411c8c93
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e311-ea18-706f-a52d-1d28eea44184.png
  Captured: 2026-09-27 13:33:23 UTC
  Source report: https://urlscan.io/result/01a0e311-ea18-706f-a52d-1d28eea44184/
  SHA-256: 603005e4091f632355849ded1e2f016f892395eb53fce16874c9ab992afcc396
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12ae7-faf9-709a-9dbf-5ee135f2b9fd.png
  Captured: 2026-10-11 12:20:23 UTC
  Source report: https://urlscan.io/result/01a12ae7-faf9-709a-9dbf-5ee135f2b9fd/
  SHA-256: 04eda02233ed5cab544925fa75da97a04adba25fa9123e9f6a3e1b323dd7235d
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a149f5-1757-73fc-8ead-a15d79153ed8.png
  Captured: 2026-10-17 13:02:48 UTC
  Source report: https://urlscan.io/result/01a149f5-1757-73fc-8ead-a15d79153ed8/
  SHA-256: c7c23e0ec9e38d6a79caa49b184b40a029b5c474546758388155d0eb2b5a9534
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15474-e52b-70b9-8fac-a6a88a5ea7ac.png
  Captured: 2026-10-19 13:58:43 UTC
  Source report: https://urlscan.io/result/01a15474-e52b-70b9-8fac-a6a88a5ea7ac/
  SHA-256: cdbdd482158ab987400a6d51b00167507a486665e563268585ee9a1f79683b8b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:53:24Z",
        "uuid": "01a12aea-0767-777b-a7ff-deb64b8360b2",
        "scanned_at": "2026-10-11T12:22:29Z",
        "final_url": "https://ueya.mx/tress/4/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://ueya.mx/tress/4",
                "from": "http://ueya.mx/tress/4",
                "status": 307
            },
            {
                "to": "https://ueya.mx/tress/4/",
                "from": "https://ueya.mx/tress/4",
                "status": 301
            }
        ],
        "ip": "108.179.194.83",
        "ptr": "108-179-194-83.unifiedlayer.com",
        "domains": [
            "cdn.wetransfer.net"
        ],
        "ips": [
            "108.138.64.107",
            "108.179.194.83"
        ],
        "asns": [
            "16509",
            "31898"
        ],
        "countries": [
            "US",
            "MX"
        ],
        "doc_hash": "2973b510c57b76c0cff48ab34fbf3ba845594187282869a79bc2e42d08175638",
        "script_hashes": [
            "7a3302c0026d1433f41e4b0d218981000e06fac22528ce7f04fa681d907d96da"
        ],
        "globals": [
            "delayTrans",
            "weTransfer",
            "transCounter"
        ],
        "tls": {
            "san": [
                "*.master.card.grant.ueya.mx",
                "*.ueya.mx",
                "master.card.grant.ueya.mx",
                "master.card.grants.ueya.mx",
                "ueya.mx",
                "www.master.card.grants.ueya.mx"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "ueya.mx",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-23T10:46:30Z",
            "valid_from": "2026-08-25T10:46:31Z"
        },
        "domain_age_days": 306,
        "apex_age_days": 306,
        "tls_age_days": 47,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "wetransfer"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "WeTransfer"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:43:51Z",
        "uuid": "1c9265e3-ed24-4dfa-b089-321ac3d68aaa",
        "scanned_at": "2026-10-12T09:39:25Z",
        "final_url": "https://ueya.mx/",
        "status": 200,
        "history": [
            {
                "url": "https://ueya.mx/",
                "status": 200
            }
        ],
        "dom_hash": "30f057954a5d38e6d9aa0e701298bae16a37769516b43b098b2a2d758706cd77",
        "doc_hash": "24409319851f5b56d7bababd9540276a7fc3501484e72b614dbc810d5be97bbb",
        "domain_risks": [
            "Parked & For Sale Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ueya.mx",
                "type": "A",
                "value": "108.179.194.83"
            }
        ],
        "dnssec_valid": false,
        "ip": "108.179.194.83",
        "whois": {
            "registrar": "AKKY ONLINE SOLUTIONS, S.A. DE C.V.",
            "created": "2025-02-21T00:00:00Z",
            "updated": "2026-02-11T00:00:00Z",
            "expires": "2027-02-21T00:00:00Z",
            "nameservers": [
                "ns20.prodns.mx",
                "ns21.prodns.mx"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:30:29Z",
        "analysis_at": "2026-10-18T16:43:22Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 9,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "AKKY ONLINE SOLUTIONS, S.A. DE C.V.",
        "first_seen": "2025-12-08T15:55:19Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.kcg.mx"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "108.179.194.83"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:108.179.194.80 +include:websitewelcome.com ~all"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "SMTP.GOOGLE.COM",
                "priority": 1
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.kcg.mx"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "google-site-verification=TSlPp2DA-MlN4yrs7D_o7j0VKiWs3saJrwXEU9jf3ZI"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "sistemas.kcg.mx",
                "value": "ns1.kcg.mx"
            }
        ],
        "dns_at": "2026-10-18T16:43:38Z",
        "jarm": "29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1",
        "cert": {
            "san": [
                "*.master.card.grant.ueya.mx",
                "*.ueya.mx",
                "master.card.grant.ueya.mx",
                "master.card.grants.ueya.mx",
                "ueya.mx",
                "www.master.card.grants.ueya.mx"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5574889be9e01221fd4d3977ee8b599fa41",
            "sha256": "f2fabedf2604ead97d2baf1f38d13009b16653be52b3c5e148c31aa3437ea0ec",
            "subject": "ueya.mx",
            "valid_to": "2026-11-23T10:46:30Z",
            "valid_from": "2026-08-25T10:46:31Z"
        },
        "whois": {
            "registrar": "AKKY ONLINE SOLUTIONS, S.A. DE C.V."
        }
    }
}
```