www.machado-malcher.pt Open in urlscan Pro
62.28.40.145 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.masousa.com/masousa/Formas/super.htm
Effective URL:
http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html
Submission: On April 05 via manual (April 5th 2018, 6:20:33 pm UTC) from CA

Summary HTTP 17 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 12 IPs in 6 countries across 10 domains to perform 17 HTTP transactions. The main IP is 62.28.40.145, located in Portugal and belongs to MEO-EMPRESAS, PT. The main domain is www.machado-malcher.pt.

This is the only time www.machado-malcher.pt was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Canadian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1	200.44.121.62 200.44.121.62	8048 (CANTV Ser...) (CANTV Servicios)
7	62.28.40.145 62.28.40.145	15525 (MEO-EMPRESAS) (MEO-EMPRESAS)
1	185.225.208.133 185.225.208.133	13213 (UK2NET-AS) (UK2NET-AS)
1	107.182.233.217 107.182.233.217	29854 (WESTHOST) (WESTHOST - WestHost)
1	67.202.94.86 67.202.94.86	32748 (STEADFAST) (STEADFAST - Steadfast)
1	104.16.87.26 104.16.87.26	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	208.100.17.189 208.100.17.189	32748 (STEADFAST) (STEADFAST - Steadfast)
1	208.100.17.185 208.100.17.185	32748 (STEADFAST) (STEADFAST - Steadfast)
2 2	37.252.172.42 37.252.172.42	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
1	54.229.30.172 54.229.30.172	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2	34.203.131.34 34.203.131.34	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2 2	216.52.1.12 216.52.1.12	29791 (VOXEL-DOT...) (VOXEL-DOT-NET - Voxel Dot Net)
1	18.196.106.74 18.196.106.74	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
17	12

1 200.44.121.62 (Caracas, Venezuela, Bolivarian Republic Of)

ASN8048 (CANTV Servicios, Venezuela, VE)
PTR: 200-44-121-62.genericrev.cantv.net

www.masousa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 62.28.40.145 (Portugal)

ASN15525 (MEO-EMPRESAS, PT)
PTR: ptawinweb01.ptasp.com

www.machado-malcher.pt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.225.208.133 (None, )

ASN13213 (UK2NET-AS, GB)

widgets.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.182.233.217 (Providence, United States)

ASN29854 (WESTHOST - WestHost, Inc., US)
PTR: 6bb6e9d9.setaptr.net

t.dtscout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.94.86 (Chicago, United States)

ASN32748 (STEADFAST - Steadfast, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.87.26 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 208.100.17.189 (Chicago, United States)

ASN32748 (STEADFAST - Steadfast, US)
PTR: ip189.208-100-17.static.steadfastdns.net

ic.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 208.100.17.185 (Chicago, United States)

ASN32748 (STEADFAST - Steadfast, US)
PTR: ip185.208-100-17.static.steadfastdns.net

de.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.172.42 (European Union) 2 redirects

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 247.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.229.30.172 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-229-30-172.eu-west-1.compute.amazonaws.com

s.cpx.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.203.131.34 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-203-131-34.compute-1.amazonaws.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.52.1.12 (United States) 2 redirects

ASN29791 (VOXEL-DOT-NET - Voxel Dot Net, Inc., US)

loadus.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.106.74 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-196-106-74.eu-central-1.compute.amazonaws.com

sync.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	machado-malcher.pt www.machado-malcher.pt	84 KB
3	tynt.com cdn.tynt.com ic.tynt.com de.tynt.com	9 KB
2	exelator.com 2 redirects loadus.exelator.com	2 KB
2	rlcdn.com 1 redirects idsync.rlcdn.com	959 B
2	adnxs.com 2 redirects ib.adnxs.com	2 KB
2	amung.us widgets.amung.us whos.amung.us	6 KB
1	sharethis.com sync.sharethis.com	420 B
1	cpx.to s.cpx.to	499 B
1	dtscout.com t.dtscout.com	5 KB
1	masousa.com www.masousa.com	550 B
17	10

	Domain	Requested by
7	www.machado-malcher.pt	www.machado-malcher.pt
2	loadus.exelator.com	2 redirects
2	idsync.rlcdn.com	1 redirects www.machado-malcher.pt
2	ib.adnxs.com	2 redirects
1	sync.sharethis.com	www.machado-malcher.pt
1	s.cpx.to	www.machado-malcher.pt
1	de.tynt.com	cdn.tynt.com
1	ic.tynt.com	www.machado-malcher.pt
1	cdn.tynt.com	widgets.amung.us
1	whos.amung.us	widgets.amung.us
1	t.dtscout.com	widgets.amung.us
1	widgets.amung.us	www.machado-malcher.pt
1	www.masousa.com
17	13

This site contains links to these domains. Also see Links.

Domain
apps2.ams-sga.cra-arc.gc.ca
www.cra-arc.gc.ca

Subject Issuer	Validity	Valid

This page contains 3 frames:

Primary Page: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html
Frame ID: E701DCC3241FB77B1C99F9D478F00558
Requests: 16 HTTP requests in this frame

Frame: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/wmms.svg
Frame ID: D60739D285109F6B5B0C868A4CE496EC
Requests: 1 HTTP requests in this frame

Frame: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/sig-en.svg
Frame ID: C56E9CD7665E2FC2F0C18D5DEFCDA237
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.masousa.com/masousa/Formas/super.htm Page URL
http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Page URL

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i

Page Statistics

17
Requests

0 %
HTTPS

0 %
IPv6

10
Domains

13
Subdomains

12
IPs

6
Countries

106 kB
Transfer

117 kB
Size

2
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://apps2.ams-sga.cra-arc.gc.ca/gol-ged/awsc/amss/enrol/start?prog=mima&wbdisable=true
Title: Basic HTML version

Search URL Search Domain Scan URL

URL: https://apps2.ams-sga.cra-arc.gc.ca/gol-ged/awsc/amss/enrol/languageToggle
Title: Français

Search URL Search Domain Scan URL

URL: http://www.cra-arc.gc.ca/cpyrght-eng.html
Title: Terms and conditions

Search URL Search Domain Scan URL

URL: http://www.cra-arc.gc.ca/esrvc-srvce/tx/psssrvcs/prsnlnfrmtn-eng.html
Title: Personal Information Collection Statement

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.masousa.com/masousa/Formas/super.htm Page URL
http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14

http://ib.adnxs.com/getuid?http%3A%2F%2Fs.cpx.to%2Fca.png%3Fref%3Dhttp%253A%252F%252Fwww.masousa.com%252Fmasousa%252FFormas%252Fsuper.htm%26pid%3D11254%26adnxs_uid%3D%24UID HTTP 302
http://ib.adnxs.com/bounce?%2Fgetuid%3Fhttp%253A%252F%252Fs.cpx.to%252Fca.png%253Fref%253Dhttp%25253A%25252F%25252Fwww.masousa.com%25252Fmasousa%25252FFormas%25252Fsuper.htm%2526pid%253D11254%2526adnxs_uid%253D%2524UID HTTP 302
http://s.cpx.to/ca.png?ref=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&pid=11254&adnxs_uid=6652619966586867963

Request Chain 15

http://idsync.rlcdn.com/405716.gif?partner_uid=CmUMKlrGaOgNUQRrUQRVAg%3D%3D HTTP 302
http://idsync.rlcdn.com/405716.gif?partner_uid=CmUMKlrGaOgNUQRrUQRVAg%3D%3D&redirect=1

Request Chain 16

http://loadus.exelator.com/load/?j=0&p=409&g=600&buid2=CmUMKlrGaOgNUQRrUQRVAg%3D%3D&random=1522952424388 HTTP 302
http://loadus.exelator.com/load/?j=0&p=409&g=600&buid2=CmUMKlrGaOgNUQRrUQRVAg%3D%3D&random=1522952424388&xl8blockcheck=1 HTTP 302
http://sync.sharethis.com/nlsn?uid=571b848065852f9b20cda9fc77189ea7

17 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	super.htm Show response www.masousa.com/masousa/Formas/	300 B 550 B	690ms 350ms	Document text/html	200.44.121.62 CANTV Servicios
General Check archive.org Show headers Download Go to Full URL http://www.masousa.com/masousa/Formas/super.htm Protocol HTTP/1.1 Server 200.44.121.62 Caracas, Venezuela, Bolivarian Republic Of, ASN8048 (CANTV Servicios, Venezuela, VE), Reverse DNS 200-44-121-62.genericrev.cantv.net Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `fba6f97ddcfc3f84a90ef222f588b12ce7957866b3e317ca157a84109374f3ba` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.masousa.com Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:21:50 GMT Last-Modified Wed, 21 Mar 2018 23:52:15 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "f8b868a36fc1d31:26d7" Content-Type text/html Accept-Ranges bytes Content-Length 300
GET H/1.1	200 OK	Primary Request start-process.html Show response www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/	13 KB 13 KB	171ms 52ms	Document text/html	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `29bdd0ca6e21151e705c63bfe040eb52ff91faa6a52db56ce4e3e440d78a09b2` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://www.masousa.com/masousa/Formas/super.htm Connection keep-alive Cache-Control no-cache Upgrade-Insecure-Requests 1 Referer http://www.masousa.com/masousa/Formas/super.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Last-Modified Tue, 20 Mar 2018 15:37:10 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "953da4f61c0d31:1e7f36" Content-Type text/html Accept-Ranges bytes Content-Length 13458
GET H/1.1	200 OK	index.css www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/	44 KB 45 KB	104ms 53ms	Stylesheet text/css	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `e315e56e12e6c35cb5632c7bec947212f912ee872299288aa07e4f5d2c945350` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Connection keep-alive Cache-Control no-cache Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Last-Modified Tue, 20 Mar 2018 15:12:11 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "c9e76d25dc0d31:1e7f36" Content-Type text/css Accept-Ranges bytes Content-Length 45480
GET H/1.1	200 OK	classic.js Show response widgets.amung.us/	10 KB 6 KB	12ms 6ms	Script application/x-javascript	185.225.208.133 UK2NET-AS
General Check archive.org Show headers Download Go to Full URL http://widgets.amung.us/classic.js Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 185.225.208.133 -, , ASN13213 (UK2NET-AS, GB), Reverse DNS Software / Resource Hash `e168eec247c520c44208101903daa05845d07d6d5c9b121742b098d409daa303` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Content-Encoding gzip Last-Modified Fri, 09 Mar 2018 16:25:41 GMT ETag W/"5aa2b585-2833" Transfer-Encoding chunked Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control max-age=86400, private Connection keep-alive Expires Fri, 06 Apr 2018 18:20:23 GMT
GET H/1.1	200 OK	header-leaf.jpg www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/	7 KB 7 KB	52ms 52ms	Image image/jpeg	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Show image Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/header-leaf.jpg Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `585defecffe2aae3c3daf15f7ce9c8b6482dab389bcbeb030d399f24232e6f64` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css Connection keep-alive Cache-Control no-cache Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Last-Modified Tue, 20 Mar 2018 15:12:09 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "a31f6d05dc0d31:1e7f36" Content-Type image/jpeg Accept-Ranges bytes Content-Length 6962
GET H/1.1	200 OK	header-bg.jpg www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/	15 KB 15 KB	46ms 46ms	Image image/jpeg	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Show image Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/header-bg.jpg Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `52e75f289c865f1608d23ef199d4ddcf6c35a9b1c6596d0b515df7b2ffd5dcb4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css Connection keep-alive Cache-Control no-cache Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Last-Modified Tue, 20 Mar 2018 15:12:07 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "38ecefcf5dc0d31:1e7f36" Content-Type image/jpeg Accept-Ranges bytes Content-Length 15436
GET H/1.1	200 OK	sft-deco.gif www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/	80 B 331 B	114ms 49ms	Image image/gif	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Show image Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/sft-deco.gif Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `372dbc2821a06ee701e74972f6783b83951fe88459a28913ba425613ff15b909` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css Connection keep-alive Cache-Control no-cache Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/index.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Last-Modified Tue, 20 Mar 2018 15:12:18 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET ETag "f78734d65dc0d31:1e7f36" Content-Type image/gif Accept-Ranges bytes Content-Length 80
GET H/1.1	200 OK	/ Show response t.dtscout.com/i/	4 KB 5 KB	320ms 160ms	Script application/javascript	107.182.233.217 WestHost
General Check archive.org Show headers Download Go to Full URL http://t.dtscout.com/i/?l=http%3A%2F%2Fwww.machado-malcher.pt%2Fpromo_mm201102%2Fcms-sgj.cra-arc.gc.ca%2Fcanada%2Ftax.return%2Fstart-process.html&j=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm Requested by Host: widgets.amung.us URL: http://widgets.amung.us/classic.js Protocol HTTP/1.1 Server 107.182.233.217 Providence, United States, ASN29854 (WESTHOST - WestHost, Inc., US), Reverse DNS 6bb6e9d9.setaptr.net Software nginx/1.10.3 (Ubuntu) / Resource Hash `e251079ded0040370daa7ed2769bdd5accd7a2a01021827950495d7e4fa86ec5` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Server nginx/1.10.3 (Ubuntu) X-Z I Transfer-Encoding chunked Content-Type application/javascript Cache-Control no-cache X-ip 148.251.45.254 Connection close Expires Thu, 05 Apr 2018 18:20:22 GMT
GET H/1.1	200 OK	/ Show response whos.amung.us/pingjs/	30 B 233 B	220ms 110ms	Script text/javascript	67.202.94.86 Steadfast
General Check archive.org Show headers Download Go to Full URL http://whos.amung.us/pingjs/?k=05i9b7w72ikf&t=Canada%20Revenue%20Agency%20-%20Tax%20Return%20Form&c=c&y=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&a=0&d=0.544&v=22&r=5726 Requested by Host: widgets.amung.us URL: http://widgets.amung.us/classic.js Protocol HTTP/1.1 Server 67.202.94.86 Chicago, United States, ASN32748 (STEADFAST - Steadfast, US), Reverse DNS amung.us Software / Resource Hash `2572cefee026d76f4765574fe4625af9841db94dcee99f844a24b09e1029fda9` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Content-Encoding gzip Connection close Transfer-Encoding chunked Content-Type text/javascript;charset=UTF-8
GET H/1.1	404 Not Found	wmms.svg Show response www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/ Frame D607	2 KB 2 KB	75ms 49ms	Document text/html	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/wmms.svg Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `02c540bf6ee85489fb23d76f1a30ff72601ef5ed047c6f14ba2c6cdfe89fdebe` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Connection keep-alive Cache-Control no-cache Upgrade-Insecure-Requests 1 Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET Content-Length 1619 Content-Type text/html
GET H/1.1	404 Not Found	sig-en.svg Show response www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/ Frame C56E	2 KB 2 KB	83ms 51ms	Document text/html	62.28.40.145 MEO-EMPRESAS
General Check archive.org Show headers Download Go to Full URL http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/sig-en.svg Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 62.28.40.145 , Portugal, ASN15525 (MEO-EMPRESAS, PT), Reverse DNS ptawinweb01.ptasp.com Software Microsoft-IIS/6.0 / ASP.NET Resource Hash `02c540bf6ee85489fb23d76f1a30ff72601ef5ed047c6f14ba2c6cdfe89fdebe` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.machado-malcher.pt Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Connection keep-alive Cache-Control no-cache Upgrade-Insecure-Requests 1 Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Server Microsoft-IIS/6.0 X-Powered-By ASP.NET Content-Length 1619 Content-Type text/html
GET H/1.1	200 OK	tc.js Show response cdn.tynt.com/	15 KB 7 KB	15ms 8ms	Script application/javascript	104.16.87.26 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://cdn.tynt.com/tc.js Requested by Host: widgets.amung.us URL: http://widgets.amung.us/classic.js Protocol HTTP/1.1 Server 104.16.87.26 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `89a9bb21f01e36c5282c9a084c2a915150c15289eb34a94e74f87ecd34021d81` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:23 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Tue, 23 Jan 2018 16:30:20 GMT Server cloudflare ETag W/"5a67631c-3ddc" Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=259200 Transfer-Encoding chunked Connection keep-alive CF-RAY 406e0749d75a6499-FRA Expires Sun, 08 Apr 2018 18:20:23 GMT
GET DATA	200 OK	truncated /	3 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3a682ad13e1535e4077c573179247c072d7891ad507c73b7466163562f6c2fa8` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/gif
GET H/1.1	200 OK	p ic.tynt.com/b/	35 B 626 B	212ms 106ms	Image image/gif	208.100.17.189 Steadfast
General Check archive.org Show headers Download Go to Show image Full URL http://ic.tynt.com/b/p?id=w!05i9b7w72ikf&lm=0&ts=1522952423984&dn=TC&iso=0&r=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&t=Canada%20Revenue%20Agency%20-%20Tax%20Return%20Form Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 208.100.17.189 Chicago, United States, ASN32748 (STEADFAST - Steadfast, US), Reverse DNS ip189.208-100-17.static.steadfastdns.net Software nginx/1.10.3 / Resource Hash `8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:24 GMT Last-Modified Fri, 16 Apr 2010 15:38:20 GMT Server nginx/1.10.3 ETag "4bc8846c-23" P3P policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID", CP=NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA Cache-Control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" Connection close Accept-Ranges bytes Content-Type image/gif Content-Length 35 Expires "Sat, 26 Jul 1997 05:00:00 GMT"
GET H/1.1	200	v2 Show response de.tynt.com/deb/	887 B 2 KB	205ms 103ms	Script application/javascript	208.100.17.185 Steadfast
General Check archive.org Show headers Download Go to Full URL http://de.tynt.com/deb/v2?id=w!05i9b7w72ikf&dn=TC&cc=1&r=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm Requested by Host: cdn.tynt.com URL: http://cdn.tynt.com/tc.js Protocol HTTP/1.1 Server 208.100.17.185 Chicago, United States, ASN32748 (STEADFAST - Steadfast, US), Reverse DNS ip185.208-100-17.static.steadfastdns.net Software / Resource Hash `69379b842c402b1a7185d56bb82e9444bec869fd9dbf600d81c12ce8e3f114ef` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:24 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false Content-Type application/javascript Connection close P3P CP=NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA Content-Length 887 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	ca.png s.cpx.to/ Redirect Chain http://ib.adnxs.com/getuid?http%3A%2F%2Fs.cpx.to%2Fca.png%3Fref%3Dhttp%253A%252F%252Fwww.masousa.com%252Fmasousa%252FFormas%252Fsuper.htm%26pid%3D11254%26adnxs_uid%3D%24UID http://ib.adnxs.com/bounce?%2Fgetuid%3Fhttp%253A%252F%252Fs.cpx.to%252Fca.png%253Fref%253Dhttp%25253A%25252F%25252Fwww.masousa.com%25252Fmasousa%25252FFormas%25252Fsuper.htm%2526pid%253D11254%2526a... http://s.cpx.to/ca.png?ref=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&pid=11254&adnxs_uid=6652619966586867963	95 B 499 B	56ms 27ms	Image image/png	54.229.30.172 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL http://s.cpx.to/ca.png?ref=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&pid=11254&adnxs_uid=6652619966586867963 Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 54.229.30.172 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-229-30-172.eu-west-1.compute.amazonaws.com Software akka-http/2.4.17 / Resource Hash `bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Pragma no-cache Date Thu, 05 Apr 2018 18:20:24 GMT Server akka-http/2.4.17 P3P CP="NOI DEV ADM" Cache-Control no-store, must-revalidate, private, max-age=0 Connection keep-alive Content-Type image/png Content-Length 95 Expires Thu, 05 Apr 2018 18:20:24 GMT Redirect headers Pragma no-cache Date Thu, 05 Apr 2018 18:20:26 GMT X-Proxy-Origin 148.251.45.254; 148.251.45.254; 247.bm-nginx-loadbalancer.mgmt.fra1; .adnxs.com; 37.252.172.73:80 AN-X-Request-Uuid* 079fa5d3-eacd-4aab-a0e2-482b5ceab3de Server nginx/1.13.4 Access-Control-Allow-Origin * P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location http://s.cpx.to/ca.png?ref=http%3A%2F%2Fwww.masousa.com%2Fmasousa%2FFormas%2Fsuper.htm&pid=11254&adnxs_uid=6652619966586867963 Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	405716.gif idsync.rlcdn.com/ Redirect Chain http://idsync.rlcdn.com/405716.gif?partner_uid=CmUMKlrGaOgNUQRrUQRVAg%3D%3D http://idsync.rlcdn.com/405716.gif?partner_uid=CmUMKlrGaOgNUQRrUQRVAg%3D%3D&redirect=1	43 B 533 B	111ms 111ms	Image image/gif	34.203.131.34 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL http://idsync.rlcdn.com/405716.gif?partner_uid=CmUMKlrGaOgNUQRrUQRVAg%3D%3D&redirect=1 Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 34.203.131.34 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-34-203-131-34.compute-1.amazonaws.com Software / Resource Hash `afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Expires Thu, 01 Jan 1970 00:00:00 GMT Cache-Control no-cache, no-store Connection keep-alive P3P CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE" Content-Length 43 Content-Type image/gif; charset=ISO-8859-1 Redirect headers Location http://idsync.rlcdn.com/405716.gif?partner_uid=CmUMKlrGaOgNUQRrUQRVAg%3D%3D&redirect=1 Expires Thu, 01 Jan 1970 00:00:00 GMT Cache-Control no-cache, no-store Connection keep-alive Content-Type image/gif; charset=ISO-8859-1 Content-Length 0 P3P CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"
GET H/1.1	200 OK	nlsn sync.sharethis.com/ Redirect Chain http://loadus.exelator.com/load/?j=0&p=409&g=600&buid2=CmUMKlrGaOgNUQRrUQRVAg%3D%3D&random=1522952424388 http://loadus.exelator.com/load/?j=0&p=409&g=600&buid2=CmUMKlrGaOgNUQRrUQRVAg%3D%3D&random=1522952424388&xl8blockcheck=1 http://sync.sharethis.com/nlsn?uid=571b848065852f9b20cda9fc77189ea7	42 B 420 B	12ms 6ms	Image image/gif	18.196.106.74 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL http://sync.sharethis.com/nlsn?uid=571b848065852f9b20cda9fc77189ea7 Requested by Host: www.machado-malcher.pt URL: http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html Protocol HTTP/1.1 Server 18.196.106.74 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-18-196-106-74.eu-central-1.compute.amazonaws.com Software / Resource Hash `ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629` Request headers Referer http://www.machado-malcher.pt/promo_mm201102/cms-sgj.cra-arc.gc.ca/canada/tax.return/start-process.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 05 Apr 2018 18:20:24 GMT P3p policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM" Connection keep-alive Stid ZGACBVrGaOgAAAATM9fYAw== Content-Length 42 Content-Type image/gif Redirect headers Date Thu, 05 Apr 2018 18:20:24 GMT Server nginx/1.12.2 X-Powered-By Undertow/1 P3P policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA Location http://sync.sharethis.com/nlsn?uid=571b848065852f9b20cda9fc77189ea7 Cache-Control no-cache Access-Control-Allow-Credentials true Connection keep-alive Content-Type image/gif Content-Length 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canadian Government (Government)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bluekai.com/	1970-01-18 19:21:44	Name: bkdc Value: iad
			.bluekai.com/	1970-01-18 19:21:44	Name: bku Value: 4tL99mCGhkG2eDjK

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.tynt.com
de.tynt.com
ib.adnxs.com
ic.tynt.com
idsync.rlcdn.com
loadus.exelator.com
s.cpx.to
sync.sharethis.com
t.dtscout.com
whos.amung.us
widgets.amung.us
www.machado-malcher.pt
www.masousa.com
104.16.87.26
107.182.233.217
18.196.106.74
185.225.208.133
200.44.121.62
208.100.17.185
208.100.17.189
216.52.1.12
34.203.131.34
37.252.172.42
54.229.30.172
62.28.40.145
67.202.94.86
02c540bf6ee85489fb23d76f1a30ff72601ef5ed047c6f14ba2c6cdfe89fdebe
2572cefee026d76f4765574fe4625af9841db94dcee99f844a24b09e1029fda9
29bdd0ca6e21151e705c63bfe040eb52ff91faa6a52db56ce4e3e440d78a09b2
372dbc2821a06ee701e74972f6783b83951fe88459a28913ba425613ff15b909
3a682ad13e1535e4077c573179247c072d7891ad507c73b7466163562f6c2fa8
52e75f289c865f1608d23ef199d4ddcf6c35a9b1c6596d0b515df7b2ffd5dcb4
585defecffe2aae3c3daf15f7ce9c8b6482dab389bcbeb030d399f24232e6f64
69379b842c402b1a7185d56bb82e9444bec869fd9dbf600d81c12ce8e3f114ef
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
89a9bb21f01e36c5282c9a084c2a915150c15289eb34a94e74f87ecd34021d81
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab
e168eec247c520c44208101903daa05845d07d6d5c9b121742b098d409daa303
e251079ded0040370daa7ed2769bdd5accd7a2a01021827950495d7e4fa86ec5
e315e56e12e6c35cb5632c7bec947212f912ee872299288aa07e4f5d2c945350
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fba6f97ddcfc3f84a90ef222f588b12ce7957866b3e317ca157a84109374f3ba

www.machado-malcher.pt Open in urlscan Pro 62.28.40.145 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

0 %HTTPS

0 %IPv6

10 Domains

13 Subdomains

12 IPs

6 Countries

106 kBTransfer

117 kBSize

2 Cookies

4 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

2 Cookies

Indicators

www.machado-malcher.pt Open in urlscan Pro
62.28.40.145 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

0 %
HTTPS

0 %
IPv6

10
Domains

13
Subdomains

12
IPs

6
Countries

106 kB
Transfer

117 kB
Size

2
Cookies

17 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!