Mark of the Web (MOTW)

The Mark of the Web (MOTW) is a tag that tells Windows a file came from an untrusted location, usually the internet. On NTFS it is stored as an alternate data stream named Zone.Identifier, written by browsers, mail clients and other applications that save downloaded content.

The stream is a small INI-style text block. ZoneId=3 means the Internet zone; other values correspond to the local machine, intranet, trusted and restricted zones. On Windows 10 and later, many browsers also add ReferrerUrl and HostUrl, which can reveal the page a file was downloaded from and the exact download address:

[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://example.com/page
HostUrl=https://example.com/payload.zip

Windows uses the mark to trigger security controls such as SmartScreen checks, execution warnings and Office Protected View. That is why attackers try to evade it, for example by delivering payloads inside containers or archives that did not propagate the mark to extracted files.

For investigators, the stream links a file on disk to its download origin, which pairs well with browser artifacts. See the Zone.Identifier page for collection and parsing. The mark is only present while the file stays on NTFS; copying it to FAT32 or deleting the stream removes it, so its absence does not prove a file was created locally.