www.machado-malcher.pt Open in urlscan Pro
62.28.40.145 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.masousa.com/masousa/Formas/super.htm
Effective URL:
http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html
Submission: On March 22 via manual (March 22nd 2018, 5:59:30 pm UTC) from CA

Summary HTTP 19 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 13 IPs in 7 countries across 12 domains to perform 19 HTTP transactions. The main IP is 62.28.40.145, located in Portugal and belongs to MEO-EMPRESAS, PT. The main domain is www.machado-malcher.pt.

This is the only time www.machado-malcher.pt was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Canadian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1	200.44.121.62 200.44.121.62	8048 (CANTV Ser...) (CANTV Servicios)
7	62.28.40.145 62.28.40.145	15525 (MEO-EMPRESAS) (MEO-EMPRESAS)
1	185.225.208.133 185.225.208.133	13213 (UK2NET-AS) (UK2NET-AS)
1	107.182.233.217 107.182.233.217	29854 (WESTHOST) (WESTHOST - WestHost)
1	67.202.94.94 67.202.94.94	32748 (STEADFAST) (STEADFAST - Steadfast)
1	104.16.88.26 104.16.88.26	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	208.100.17.184 208.100.17.184	32748 (STEADFAST) (STEADFAST - Steadfast)
1	208.100.17.188 208.100.17.188	32748 (STEADFAST) (STEADFAST - Steadfast)
2 2	37.252.172.27 37.252.172.27	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
1	52.210.103.81 52.210.103.81	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2	34.225.200.43 34.225.200.43	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2 3	35.157.74.177 35.157.74.177	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2	172.217.16.162 172.217.16.162	15169 (GOOGLE) (GOOGLE - Google LLC)
2 2	216.52.1.12 216.52.1.12	29791 (VOXEL-DOT...) (VOXEL-DOT-NET - Voxel Dot Net)
1	54.93.149.35 54.93.149.35	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
19	13

1 200.44.121.62 (Caracas, Venezuela, Bolivarian Republic Of)

ASN8048 (CANTV Servicios, Venezuela, VE)
PTR: 200-44-121-62.genericrev.cantv.net

www.masousa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 62.28.40.145 (Portugal)

ASN15525 (MEO-EMPRESAS, PT)
PTR: ptawinweb01.ptasp.com

www.machado-malcher.pt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.225.208.133 (None, )

ASN13213 (UK2NET-AS, GB)

widgets.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.182.233.217 (Providence, United States)

ASN29854 (WESTHOST - WestHost, Inc., US)
PTR: 6bb6e9d9.setaptr.net

t.dtscout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.94.94 (Chicago, United States)

ASN32748 (STEADFAST - Steadfast, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.88.26 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 208.100.17.184 (Chicago, United States)

ASN32748 (STEADFAST - Steadfast, US)
PTR: ip184.208-100-17.static.steadfastdns.net

ic.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 208.100.17.188 (Chicago, United States)

ASN32748 (STEADFAST - Steadfast, US)
PTR: ip188.208-100-17.static.steadfastdns.net

de.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.172.27 (European Union) 2 redirects

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 153.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.103.81 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-210-103-81.eu-west-1.compute.amazonaws.com

s.cpx.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.225.200.43 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-225-200-43.compute-1.amazonaws.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.157.74.177 (Frankfurt, Germany) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-157-74-177.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.162 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f162.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.52.1.12 (United States) 2 redirects

ASN29791 (VOXEL-DOT-NET - Voxel Dot Net, Inc., US)

loadus.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.93.149.35 (Frankfurt, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-93-149-35.eu-central-1.compute.amazonaws.com

sync.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	machado-malcher.pt www.machado-malcher.pt	84 KB
3	eyeota.net 2 redirects ps.eyeota.net	764 B
3	tynt.com cdn.tynt.com ic.tynt.com de.tynt.com	9 KB
2	exelator.com 2 redirects loadus.exelator.com	2 KB
2	doubleclick.net 2 redirects cm.g.doubleclick.net	1 KB
2	rlcdn.com 1 redirects idsync.rlcdn.com	931 B
2	adnxs.com 2 redirects ib.adnxs.com	2 KB
2	amung.us widgets.amung.us whos.amung.us	6 KB
1	sharethis.com sync.sharethis.com	420 B
1	cpx.to s.cpx.to	499 B
1	dtscout.com t.dtscout.com	6 KB
1	masousa.com www.masousa.com	550 B
19	12

	Domain	Requested by
7	www.machado-malcher.pt	www.machado-malcher.pt
3	ps.eyeota.net	2 redirects www.machado-malcher.pt
2	loadus.exelator.com	2 redirects
2	cm.g.doubleclick.net	2 redirects
2	idsync.rlcdn.com	1 redirects www.machado-malcher.pt
2	ib.adnxs.com	2 redirects
1	sync.sharethis.com	www.machado-malcher.pt
1	s.cpx.to	www.machado-malcher.pt
1	de.tynt.com	cdn.tynt.com
1	ic.tynt.com	www.machado-malcher.pt
1	cdn.tynt.com	widgets.amung.us
1	whos.amung.us	widgets.amung.us
1	t.dtscout.com	widgets.amung.us
1	widgets.amung.us	www.machado-malcher.pt
1	www.masousa.com
19	15

This site contains links to these domains. Also see Links.

Domain
apps2.ams-sga.cra-arc.gc.ca
www.cra-arc.gc.ca

Subject Issuer	Validity	Valid

This page contains 3 frames:

Primary Page: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html
Frame ID: E32FE11AFA97CB682006F0C054E8FEE2
Requests: 17 HTTP requests in this frame

Frame: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/wmms.svg
Frame ID: 724EE8B8F02E2DD2949314F28EF4B33
Requests: 1 HTTP requests in this frame

Frame: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/sig-en.svg
Frame ID: 3FDC838E4C43448FF6249438CFA1127D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.masousa.com/masousa/Formas/super.htm Page URL
http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Page URL

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i

Page Statistics

19
Requests

0 %
HTTPS

0 %
IPv6

12
Domains

15
Subdomains

13
IPs

7
Countries

107 kB
Transfer

117 kB
Size

11
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://apps2.ams-sga.cra-arc.gc.ca/gol-ged/awsc/amss/enrol/start?prog=mima&wbdisable=true
Title: Basic HTML version

Search URL Search Domain Scan URL

URL: https://apps2.ams-sga.cra-arc.gc.ca/gol-ged/awsc/amss/enrol/languageToggle
Title: Français

Search URL Search Domain Scan URL

URL: http://www.cra-arc.gc.ca/cpyrght-eng.html
Title: Terms and conditions

Search URL Search Domain Scan URL

URL: http://www.cra-arc.gc.ca/esrvc-srvce/tx/psssrvcs/prsnlnfrmtn-eng.html
Title: Personal Information Collection Statement

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.masousa.com/masousa/Formas/super.htm Page URL
http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15

http://ib.adnxs.com/getuid?http%3A%2F%2Fs.cpx.to%2Fca.png%3Fref%3Dhttp%253A%252F%252Fwww.masousa.com%252Fmasousa%252FFormas%252Fsuper.htm%26pid%3D11254%26adnxs_uid%3D%24UID HTTP 302
http://ib.adnxs.com/bounce?%2Fgetuid%3Fhttp%253A%252F%252Fs.cpx.to%252Fca.png%253Fref%253Dhttp%25253A%25252F%25252Fwww.masousa.com%25252Fmasousa%25252FFormas%25252Fsuper.htm%2526pid%253D11254%2526adnxs_uid%253D%2524UID HTTP 302
http://s.cpx.to/ca.png?ref=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&pid=11254&adnxs_uid=2119029499076652689

Request Chain 16

http://idsync.rlcdn.com/405716.gif?partner_uid= HTTP 302
http://idsync.rlcdn.com/405716.gif?partner_uid=&redirect=1

Request Chain 17

http://ps.eyeota.net/pixel?pid=gdomg51&t=gif&cat=&random=1521741561153 HTTP 302
http://ps.eyeota.net/pixel/bounce/?pid=gdomg51&t=gif&cat=&random=1521741561153 HTTP 302
http://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&bid=gdo9o51&newuser=1 HTTP 302
http://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&bid=gdo9o51&newuser=1&google_tc= HTTP 302
http://ps.eyeota.net/match?bid=gdo9o51&newuser=1&google_gid=CAESEK9-9Ob__y3XUWrKskPtnDw&google_cver=1

Request Chain 18

http://loadus.exelator.com/load/?j=0&p=409&g=600&buid2=&random=1521741561153 HTTP 302
http://loadus.exelator.com/load/?j=0&p=409&g=600&buid2=&random=1521741561153&xl8blockcheck=1 HTTP 302
http://sync.sharethis.com/nlsn?uid=f61bb607529ffcc213b535a7b6fdaef4

19 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	super.htm www.masousa.com/masousa/Formas/	300 B 550 B	347ms 171ms	Document text/html	200.44.121.62 CANTV Servicios
General Check archive.org Show headers Download Go to Full URL http://www.masousa.com/masousa/Formas/super.htm Protocol HTTP/1.1 Server 200.44.121.62 Caracas, Venezuela, Bolivarian Republic Of, ASN8048 (CANTV Servicios, Venezuela, VE), Reverse DNS 200-44-121-62.genericrev.cantv.net Software Microsoft-IIS/6.0 / ASP.NET Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.masousa.com Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 18:01:22 GMT Last-Modified Wed, 21 Mar 2018 23:52:15 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "f8b868a36fc1d31:26d7" Content-Type text/html Accept-Ranges bytes Content-Length 300
GET H/1.1	200 OK	Primary Request start-process.html Show response www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/	13 KB 13 KB	178ms 46ms	Document text/html	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `29bdd0ca6e21151e705c63bfe040eb52ff91faa6a52db56ce4e3e440d78a09b2` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://www.masousa.com/masousa/Formas/super.htm Connection keep-alive Cache-Control no-cache Upgrade-Insecure-Requests 1 Referer http://www.masousa.com/masousa/Formas/super.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:19 GMT Last-Modified Tue, 20 Mar 2018 15:37:10 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "953da4f61c0d31:1e6ff6" Content-Type text/html Accept-Ranges bytes Content-Length 13458
GET H/1.1	200 OK	index.css www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/	44 KB 45 KB	92ms 47ms	Stylesheet text/css	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `e315e56e12e6c35cb5632c7bec947212f912ee872299288aa07e4f5d2c945350` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Connection keep-alive Cache-Control no-cache Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:19 GMT Last-Modified Tue, 20 Mar 2018 15:12:11 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "c9e76d25dc0d31:1e6ff6" Content-Type text/css Accept-Ranges bytes Content-Length 45480
GET H/1.1	404 Not Found	wmms.svg Show response www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/ Frame 724E	2 KB 2 KB	46ms 46ms	Document text/html	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/wmms.svg Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `02c540bf6ee85489fb23d76f1a30ff72601ef5ed047c6f14ba2c6cdfe89fdebe` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Connection keep-alive Cache-Control no-cache Upgrade-Insecure-Requests 1 Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:19 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET Content-Length 1619 Content-Type text/html
GET H/1.1	200 OK	classic.js Show response widgets.amung.us/	10 KB 6 KB	16ms 6ms	Script application/x-javascript	185.225.208.133 UK2NET-AS
General Check archive.org Show headers Download Go to Full URL http://widgets.amung.us/classic.js Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 185.225.208.133 -, , ASN13213 (UK2NET-AS, GB), Reverse DNS Software / Resource Hash `e168eec247c520c44208101903daa05845d07d6d5c9b121742b098d409daa303` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:20 GMT Content-Encoding gzip Last-Modified Fri, 09 Mar 2018 16:25:41 GMT ETag W/"5aa2b585-2833" Transfer-Encoding chunked Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control max-age=86400, private Connection keep-alive Expires Fri, 23 Mar 2018 17:59:20 GMT
GET H/1.1	200 OK	header-leaf.jpg www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/	7 KB 7 KB	46ms 46ms	Image image/jpeg	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Show image Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/header-leaf.jpg Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `585defecffe2aae3c3daf15f7ce9c8b6482dab389bcbeb030d399f24232e6f64` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css Connection keep-alive Cache-Control no-cache Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:19 GMT Last-Modified Tue, 20 Mar 2018 15:12:09 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "a31f6d05dc0d31:1e6ff6" Content-Type image/jpeg Accept-Ranges bytes Content-Length 6962
GET H/1.1	200 OK	header-bg.jpg www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/	15 KB 15 KB	52ms 52ms	Image image/jpeg	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Show image Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/header-bg.jpg Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `52e75f289c865f1608d23ef199d4ddcf6c35a9b1c6596d0b515df7b2ffd5dcb4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css Connection keep-alive Cache-Control no-cache Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:19 GMT Last-Modified Tue, 20 Mar 2018 15:12:07 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "38ecefcf5dc0d31:1e6ff6" Content-Type image/jpeg Accept-Ranges bytes Content-Length 15436
GET H/1.1	200 OK	sft-deco.gif www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/	80 B 331 B	53ms 45ms	Image image/gif	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Show image Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/sft-deco.gif Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `372dbc2821a06ee701e74972f6783b83951fe88459a28913ba425613ff15b909` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css Connection keep-alive Cache-Control no-cache Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:19 GMT Last-Modified Tue, 20 Mar 2018 15:12:18 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "f78734d65dc0d31:1e6ff6" Content-Type image/gif Accept-Ranges bytes Content-Length 80
GET		sig-en.svg www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/ Frame 3FDC	0 0

GET H/1.1	200 OK	/ Show response t.dtscout.com/i/	4 KB 6 KB	292ms 144ms	Script application/javascript	107.182.233.217 WestHost
General Check archive.org Show headers Download Go to Full URL http://t.dtscout.com/i/?l=http%3A%2F%2Fwww.machado-malcher.pt%2Fpromo_mm201102%2Fcms-sgj.cra-arc.gc.ca%2Fcanada%2Ftax.return%2Fstart-process.html&j=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm Requested by Host: widgets.amung.us URL: http://widgets.amung.us/classic.js Protocol HTTP/1.1 Server 107.182.233.217 Providence, United States, ASN29854 (WESTHOST - WestHost, Inc., US), Reverse DNS 6bb6e9d9.setaptr.net Software nginx/1.10.3 (Ubuntu) / Resource Hash `9b04780aae5dbc8eab481e256cde423c8585d2ce5502d70ed2048dad7f805de9` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:20 GMT Server nginx/1.10.3 (Ubuntu) X-Z I Transfer-Encoding chunked Content-Type application/javascript Cache-Control no-cache X-ip 148.251.45.254 Connection close Expires Thu, 22 Mar 2018 17:59:19 GMT
GET H/1.1	200 OK	/ Show response whos.amung.us/pingjs/	30 B 233 B	243ms 116ms	Script text/javascript	67.202.94.94 Steadfast
General Check archive.org Show headers Download Go to Full URL http://whos.amung.us/pingjs/?k=05i9b7w72ikf&t=Canada%20Revenue%20Agency%20-%20Tax%20Return%20Form&c=c&y=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&a=0&d=0.426&v=22&r=2016 Requested by Host: widgets.amung.us URL: http://widgets.amung.us/classic.js Protocol HTTP/1.1 Server 67.202.94.94 Chicago, United States, ASN32748 (STEADFAST - Steadfast, US), Reverse DNS amung.us Software / Resource Hash `ab01ec8ae24fb8a2da0c62f6b7467f87c4fcfb31f885c4a884a1b358edfaf262` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:20 GMT Content-Encoding gzip Connection close Transfer-Encoding chunked Content-Type text/javascript;charset=UTF-8
GET H/1.1	404 Not Found	sig-en.svg Show response www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/ Frame 3FDC	2 KB 2 KB	46ms 46ms	Document text/html	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/sig-en.svg Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `02c540bf6ee85489fb23d76f1a30ff72601ef5ed047c6f14ba2c6cdfe89fdebe` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Connection keep-alive Cache-Control no-cache Upgrade-Insecure-Requests 1 Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:19 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET Content-Length 1619 Content-Type text/html
GET H/1.1	200 OK	tc.js Show response cdn.tynt.com/	15 KB 7 KB	30ms 17ms	Script application/javascript	104.16.88.26 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://cdn.tynt.com/tc.js Requested by Host: widgets.amung.us URL: http://widgets.amung.us/classic.js Protocol HTTP/1.1 Server 104.16.88.26 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `89a9bb21f01e36c5282c9a084c2a915150c15289eb34a94e74f87ecd34021d81` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:20 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Tue, 23 Jan 2018 16:30:28 GMT Server cloudflare ETag W/"5a676324-3ddc" Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=259200 Transfer-Encoding chunked Connection keep-alive CF-RAY 3ffa8d32045263eb-FRA Expires Sun, 25 Mar 2018 17:59:20 GMT
GET DATA	200 OK	truncated /	3 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3a682ad13e1535e4077c573179247c072d7891ad507c73b7466163562f6c2fa8` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/gif
GET H/1.1	200 OK	p ic.tynt.com/b/	35 B 626 B	364ms 211ms	Image image/gif	208.100.17.184 Steadfast
General Check archive.org Show headers Download Go to Show image Full URL http://ic.tynt.com/b/p?id=w!05i9b7w72ikf&lm=0&ts=1521741560678&dn=TC&iso=0&r=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&t=Canada%20Revenue%20Agency%20-%20Tax%20Return%20Form Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 208.100.17.184 Chicago, United States, ASN32748 (STEADFAST - Steadfast, US), Reverse DNS ip184.208-100-17.static.steadfastdns.net Software nginx/1.10.3 / Resource Hash `8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:20 GMT Last-Modified Fri, 16 Apr 2010 15:38:20 GMT Server nginx/1.10.3 ETag "4bc8846c-23" P3P policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID", CP=NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA Cache-Control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" Connection close Accept-Ranges bytes Content-Type image/gif Content-Length 35 Expires "Sat, 26 Jul 1997 05:00:00 GMT"
GET H/1.1	200	v2 Show response de.tynt.com/deb/	876 B 2 KB	233ms 124ms	Script application/javascript	208.100.17.188 Steadfast
General Check archive.org Show headers Download Go to Full URL http://de.tynt.com/deb/v2?id=w!05i9b7w72ikf&dn=TC&cc=1&r=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm Requested by Host: cdn.tynt.com URL: http://cdn.tynt.com/tc.js Protocol HTTP/1.1 Server 208.100.17.188 Chicago, United States, ASN32748 (STEADFAST - Steadfast, US), Reverse DNS ip188.208-100-17.static.steadfastdns.net Software / Resource Hash `99d66254a3b85cc7a87e2a580c6b45a6d0ab211c19fdbffc12dd7e346b838c8a` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:20 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false Content-Type application/javascript Connection close P3P CP=NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA Content-Length 876 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	ca.png s.cpx.to/ Redirect Chain http://ib.adnxs.com/getuid?http%3A%2F%2Fs.cpx.to%2Fca.png%3Fref%3Dhttp%253A%252F%252Fwww.masousa.com%252Fmasousa%252FFormas%252Fsuper.htm%26pid%3D11254%26adnxs_uid%3D%24UID http://ib.adnxs.com/bounce?%2Fgetuid%3Fhttp%253A%252F%252Fs.cpx.to%252Fca.png%253Fref%253Dhttp%25253A%25252F%25252Fwww.masousa.com%25252Fmasousa%25252FFormas%25252Fsuper.htm%2526pid%253D11254%2526a... http://s.cpx.to/ca.png?ref=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&pid=11254&adnxs_uid=2119029499076652689	95 B 499 B	56ms 27ms	Image image/png	52.210.103.81 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL http://s.cpx.to/ca.png?ref=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&pid=11254&adnxs_uid=2119029499076652689 Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 52.210.103.81 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-210-103-81.eu-west-1.compute.amazonaws.com Software akka-http/2.4.17 / Resource Hash `bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Pragma no-cache Date Thu, 22 Mar 2018 17:59:21 GMT Server akka-http/2.4.17 P3P CP="NOI DEV ADM" Cache-Control no-store, must-revalidate, private, max-age=0 Connection keep-alive Content-Type image/png Content-Length 95 Expires Thu, 22 Mar 2018 17:59:21 GMT Redirect headers Pragma no-cache Date Thu, 22 Mar 2018 17:59:23 GMT X-Proxy-Origin 148.251.45.254; 148.251.45.254; 153.bm-nginx-loadbalancer.mgmt.fra1; .adnxs.com; 37.252.172.18:80 AN-X-Request-Uuid* 92d020fe-c7c6-482c-9518-9ea7751ddf62 Server nginx/1.13.4 Access-Control-Allow-Origin * P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location http://s.cpx.to/ca.png?ref=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&pid=11254&adnxs_uid=2119029499076652689 Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	405716.gif idsync.rlcdn.com/ Redirect Chain http://idsync.rlcdn.com/405716.gif?partner_uid= http://idsync.rlcdn.com/405716.gif?partner_uid=&redirect=1	43 B 533 B	127ms 112ms	Image image/gif	34.225.200.43 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL http://idsync.rlcdn.com/405716.gif?partner_uid=&redirect=1 Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 34.225.200.43 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-34-225-200-43.compute-1.amazonaws.com Software / Resource Hash `afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Expires Thu, 01 Jan 1970 00:00:00 GMT Cache-Control no-cache, no-store Connection keep-alive P3P CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE" Content-Length 43 Content-Type image/gif; charset=ISO-8859-1 Redirect headers Location http://idsync.rlcdn.com/405716.gif?partner_uid=&redirect=1 Expires Thu, 01 Jan 1970 00:00:00 GMT Cache-Control no-cache, no-store Connection keep-alive Content-Type image/gif; charset=ISO-8859-1 Content-Length 0 P3P CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"
GET H/1.1	200 OK	match ps.eyeota.net/ Redirect Chain http://ps.eyeota.net/pixel?pid=gdomg51&t=gif&cat=&random=1521741561153 http://ps.eyeota.net/pixel/bounce/?pid=gdomg51&t=gif&cat=&random=1521741561153 http://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&bid=gdo9o51&newuser=1 http://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&bid=gdo9o51&newuser=1&google_tc= http://ps.eyeota.net/match?bid=gdo9o51&newuser=1&google_gid=CAESEK9-9Ob__y3XUWrKskPtnDw&google_cver=1	70 B 171 B	18ms 11ms	Image image/gif	35.157.74.177 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL http://ps.eyeota.net/match?bid=gdo9o51&newuser=1&google_gid=CAESEK9-9Ob__y3XUWrKskPtnDw&google_cver=1 Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 35.157.74.177 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-35-157-74-177.eu-central-1.compute.amazonaws.com Software / Resource Hash `de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:21 GMT Content-Length 70 Content-Type image/gif Redirect headers Pragma no-cache Date Thu, 22 Mar 2018 17:59:21 GMT Server HTTP server (unknown) P3P policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location http://ps.eyeota.net/match?bid=gdo9o51&newuser=1&google_gid=CAESEK9-9Ob__y3XUWrKskPtnDw&google_cver=1 Cache-Control no-cache, must-revalidate Content-Type text/html; charset=UTF-8 Content-Length 310 X-XSS-Protection 1; mode=block Expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	nlsn sync.sharethis.com/ Redirect Chain http://loadus.exelator.com/load/?j=0&p=409&g=600&buid2=&random=1521741561153 http://loadus.exelator.com/load/?j=0&p=409&g=600&buid2=&random=1521741561153&xl8blockcheck=1 http://sync.sharethis.com/nlsn?uid=f61bb607529ffcc213b535a7b6fdaef4	42 B 420 B	32ms 8ms	Image image/gif	54.93.149.35 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL http://sync.sharethis.com/nlsn?uid=f61bb607529ffcc213b535a7b6fdaef4 Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 54.93.149.35 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-93-149-35.eu-central-1.compute.amazonaws.com Software / Resource Hash `ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 22 Mar 2018 17:59:21 GMT P3p policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM" Connection keep-alive Stid CvQBClqz7vkAAAARDeBdAw== Content-Length 42 Content-Type image/gif Redirect headers Date Thu, 22 Mar 2018 17:59:21 GMT Server nginx/1.12.2 X-Powered-By Undertow/1 P3P policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA Location http://sync.sharethis.com/nlsn?uid=f61bb607529ffcc213b535a7b6fdaef4 Cache-Control no-cache Access-Control-Allow-Credentials true Connection keep-alive Content-Type image/gif Content-Length 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.machado-malcher.pt
URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/sig-en.svg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canadian Government (Government)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.dtscout.com/	1970-01-19 08:13:33	Name: df Value: 1521741560
.dtscout.com/	1970-01-18 14:43:47	Name: st Value: 1
.dtscout.com/	1970-01-18 14:43:47	Name: pi Value: 1
.dtscout.com/	1970-01-25 20:05:16	Name: l Value: a7bp2Vqz7viQvkMRBq9fAg==
.dtscout.com/	1970-01-18 14:43:47	Name: ah Value: 1
.dtscout.com/	1970-01-18 14:42:23	Name: m Value: 1
.dtscout.com/	1970-01-18 14:42:35	Name: ey Value: 1
.bluekai.com/	1970-01-18 19:01:33	Name: bkdc Value: iad
.dtscout.com/	1970-01-18 14:42:50	Name: b Value: 1
.bluekai.com/	1970-01-18 19:01:33	Name: bku Value: 4tL99w7rLNoLed5c
.dtscout.com/	1970-01-18 14:42:50	Name: es Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.tynt.com
cm.g.doubleclick.net
de.tynt.com
ib.adnxs.com
ic.tynt.com
idsync.rlcdn.com
loadus.exelator.com
ps.eyeota.net
s.cpx.to
sync.sharethis.com
t.dtscout.com
whos.amung.us
widgets.amung.us
www.machado-malcher.pt
www.masousa.com
www.machado-malcher.pt
104.16.88.26
107.182.233.217
172.217.16.162
185.225.208.133
200.44.121.62
208.100.17.184
208.100.17.188
216.52.1.12
34.225.200.43
35.157.74.177
37.252.172.27
52.210.103.81
54.93.149.35
62.28.40.145
67.202.94.94
02c540bf6ee85489fb23d76f1a30ff72601ef5ed047c6f14ba2c6cdfe89fdebe
29bdd0ca6e21151e705c63bfe040eb52ff91faa6a52db56ce4e3e440d78a09b2
372dbc2821a06ee701e74972f6783b83951fe88459a28913ba425613ff15b909
3a682ad13e1535e4077c573179247c072d7891ad507c73b7466163562f6c2fa8
52e75f289c865f1608d23ef199d4ddcf6c35a9b1c6596d0b515df7b2ffd5dcb4
585defecffe2aae3c3daf15f7ce9c8b6482dab389bcbeb030d399f24232e6f64
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
89a9bb21f01e36c5282c9a084c2a915150c15289eb34a94e74f87ecd34021d81
99d66254a3b85cc7a87e2a580c6b45a6d0ab211c19fdbffc12dd7e346b838c8a
9b04780aae5dbc8eab481e256cde423c8585d2ce5502d70ed2048dad7f805de9
ab01ec8ae24fb8a2da0c62f6b7467f87c4fcfb31f885c4a884a1b358edfaf262
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e168eec247c520c44208101903daa05845d07d6d5c9b121742b098d409daa303
e315e56e12e6c35cb5632c7bec947212f912ee872299288aa07e4f5d2c945350
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

www.machado-malcher.pt Open in urlscan Pro 62.28.40.145 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

0 %HTTPS

0 %IPv6

12 Domains

15 Subdomains

13 IPs

7 Countries

107 kBTransfer

117 kBSize

11 Cookies

4 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

11 Cookies

Indicators

www.machado-malcher.pt Open in urlscan Pro
62.28.40.145 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

0 %
HTTPS

0 %
IPv6

12
Domains

15
Subdomains

13
IPs

7
Countries

107 kB
Transfer

117 kB
Size

11
Cookies

19 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!