gygstudio.com.mx Open in urlscan Pro
146.148.36.234 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://otalent.ch/ando9ww5ando9abbe56e057f20sf883e
Effective URL:
https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBw...
Submission: On May 08 via manual (May 8th 2023, 11:37:45 am UTC) from CA — Scanned from CA

Summary HTTP 5 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 146.148.36.234, located in Council Bluffs, United States and belongs to GOOGLE, US. The main domain is gygstudio.com.mx.
TLS certificate: Issued by R3 on April 28th 2023. Valid for: 3 months.

This is the only time gygstudio.com.mx was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Canada Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2001:1600:4:1... 2001:1600:4:13:d294:66ff:fe1d:f533	29222 (INFOMANIA...) (INFOMANIAK-AS)
1 6	146.148.36.234 146.148.36.234	15169 (GOOGLE) (GOOGLE)
5	2

2 2001:1600:4:13:d294:66ff:fe1d:f533 (Switzerland) 2 redirects

ASN29222 (INFOMANIAK-AS, CH)

otalent.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 146.148.36.234 (Council Bluffs, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 234.36.148.146.bc.googleusercontent.com

gygstudio.com.mx	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	gygstudio.com.mx 1 redirects gygstudio.com.mx	418 KB
2	otalent.ch 2 redirects otalent.ch	550 B
5	2

	Domain	Requested by
6	gygstudio.com.mx	1 redirects gygstudio.com.mx
2	otalent.ch	2 redirects
5	2

This site contains no links.

Subject Issuer	Validity	Valid
gygstudio.com.mx R3	`2023-04-28` - `2023-07-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u
Frame ID: 07A96C500C0C2B488444BC99F0E974F0
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Canada PostCartCartFacebookTwitterInstagramLinkedinYouTubeFacebookTwitterInstagramLinkedinYouTubeFacebookTwitterInstagramLinkedinYouTube

Page URL History Show full URLs

https://otalent.ch/ando9ww5ando9abbe56e057f20sf883e HTTP 301
https://otalent.ch/ando9ww5ando9abbe56e057f20sf883e/ HTTP 302
https://gygstudio.com.mx/chop/canada/ Page URL
https://gygstudio.com.mx/chop/canada/home/ HTTP 302
https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsg... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

504 kB
Transfer

992 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://otalent.ch/ando9ww5ando9abbe56e057f20sf883e HTTP 301
https://otalent.ch/ando9ww5ando9abbe56e057f20sf883e/ HTTP 302
https://gygstudio.com.mx/chop/canada/ Page URL
https://gygstudio.com.mx/chop/canada/home/ HTTP 302
https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://otalent.ch/ando9ww5ando9abbe56e057f20sf883e HTTP 301
https://otalent.ch/ando9ww5ando9abbe56e057f20sf883e/ HTTP 302
https://gygstudio.com.mx/chop/canada/

5 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/
gygstudio.com.mx/chop/canada/
Redirect Chain

https://otalent.ch/ando9ww5ando9abbe56e057f20sf883e
https://otalent.ch/ando9ww5ando9abbe56e057f20sf883e/
https://gygstudio.com.mx/chop/canada/

104 B
336 B

355ms
254ms

Document
text/html

146.148.36.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gygstudio.com.mx/chop/canada/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

146.148.36.234 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

234.36.148.146.bc.googleusercontent.com

Software

nginx / WordOps

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 08 May 2023 11:37:39 GMT
referrer-policy: strict-origin-when-cross-origin
server: nginx
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: WordOps

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 08 May 2023 11:37:38 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://gygstudio.com.mx/chop/canada/
pragma: no-cache
server: Apache
strict-transport-security: max-age=16000000
vary: Accept-Encoding

GET
H2

200

Primary Request cpa-bill.php Show response
gygstudio.com.mx/chop/canada/home/
Redirect Chain

https://gygstudio.com.mx/chop/canada/home/
https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMg...

651 KB
337 KB

252ms
251ms

Document
text/html

146.148.36.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

146.148.36.234 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

234.36.148.146.bc.googleusercontent.com

Software

nginx / WordOps

Resource Hash

0fa2363edda78b67a8c62a856796d3633b6e278db003207ae118d3dfb0ed5823

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://gygstudio.com.mx/chop/canada/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 08 May 2023 11:37:39 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: WordOps

Redirect headers

content-type: text/html; charset=UTF-8
date: Mon, 08 May 2023 11:37:39 GMT
location: cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: WordOps

GET
DATA 200
OK truncated
/ 12 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e467e89a41e68909313eef448847f3446650158fb5d046295fea70fd7d776b87

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 938 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d1f9fbf33db045a86af8a16f01659de9e5fbcce3199edb10a3ac4dc76155c4f9

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 320 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3228f4cd6fd28ef733c3d98079f3478b1c4cb3338dcd7b95658ba731b817e113

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 14 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6a50626ef34e5da6014662089f0775c6187d23e5c22379da71203848eac50ee3

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 jquery.min.js Show response
gygstudio.com.mx/chop/canada/home/cpa_files/ 86 KB
30 KB 39ms
38ms Script
application/javascript 146.148.36.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gygstudio.com.mx/chop/canada/home/cpa_files/jquery.min.js

Requested by

Host: gygstudio.com.mx
URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

146.148.36.234 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

234.36.148.146.bc.googleusercontent.com

Software

nginx / WordOps

Resource Hash

2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Mon, 08 May 2023 11:37:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 07 May 2023 22:51:04 GMT
server: nginx
etag: W/"64582b58-15851"
x-powered-by: WordOps
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
expires: Wed, 07 Jun 2023 11:37:39 GMT

GET
H2 200 imask.min.js Show response
gygstudio.com.mx/chop/canada/home/cpa_files/ 45 KB
13 KB 42ms
41ms Script
application/javascript 146.148.36.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gygstudio.com.mx/chop/canada/home/cpa_files/imask.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

146.148.36.234 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

234.36.148.146.bc.googleusercontent.com

Software

nginx / WordOps

Resource Hash

8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Mon, 08 May 2023 11:37:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 07 May 2023 22:51:04 GMT
server: nginx
etag: W/"64582b58-b217"
x-powered-by: WordOps
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
expires: Wed, 07 Jun 2023 11:37:39 GMT

GET
H2 200 infos.js Show response
gygstudio.com.mx/chop/canada/home/cpa_files/ 95 KB
37 KB 42ms
41ms Script
application/javascript 146.148.36.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gygstudio.com.mx/chop/canada/home/cpa_files/infos.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

146.148.36.234 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

234.36.148.146.bc.googleusercontent.com

Software

nginx / WordOps

Resource Hash

31d6c83c556571fbd4cbac36e0319c9d9b9d275fbe6c8156ce39bb4e878193f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Mon, 08 May 2023 11:37:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 07 May 2023 22:51:04 GMT
server: nginx
etag: W/"64582b58-17a61"
x-powered-by: WordOps
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
expires: Wed, 07 Jun 2023 11:37:39 GMT

GET
DATA 200
OK truncated
/ 185 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3cec1a10482ab62ddd412f5f2711833fa88693526916e6119956d5041960dff3

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 907 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abf1f63a2886e67a68c108a433a64215a46d85737b37e6ad9b1cae1e38318917

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 56 KB
56 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1287b4c6427119cabf899a5ea898f81e831a2742614813a3302f671690b399c2

Request headers

Referer
Origin: https://gygstudio.com.mx
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 219 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3712c17c27414c5a3981a0c1946d831001f5ad4e45b62577c08928c37f6ec8d4

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 724 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: acf56f4833ccd8789f66864deae46f9a6efb8625f15b9e5996a00e5634f094e1

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Request headers

Referer
Origin: https://gygstudio.com.mx
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Request headers

Referer
Origin: https://gygstudio.com.mx
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canada Post (Transportation)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			otalent.ch/	1969-12-31 23:59:59	Name: PHPSESSID Value: 5e24f697e252e6717994d623fc3160f7
			gygstudio.com.mx/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7duiltd1vtrthahevc7oos6si0

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2294) Message: Error: <path> attribute d: Expected number, "…942V3.058C2 2.47wa77zBBugLUChfzb…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2302) Message: Error: <path> attribute d: Expected number, "…a5.12 5.12 0 0 1-1.XMR.28 7.28 0…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2310) Message: Error: <path> attribute d: Expected number, "…7.36 7.36 0 0 1 2.XMR 0 3.05-.06…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2318) Message: Error: <path> attribute d: Expected path command, "… 1.207-1.78 2.47wa77zBBugLUChfzb…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2327) Message: Error: <path> attribute d: Expected number, "…35 10.266V4.274l5.XMR 10.004 0 1…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2396) Message: Error: <path> attribute d: Expected number, "…942V3.058C2 2.47wa77zBBugLUChfzb…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2404) Message: Error: <path> attribute d: Expected number, "…a5.12 5.12 0 0 1-1.XMR.28 7.28 0…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2412) Message: Error: <path> attribute d: Expected number, "…7.36 7.36 0 0 1 2.XMR 0 3.05-.06…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2420) Message: Error: <path> attribute d: Expected path command, "… 1.207-1.78 2.47wa77zBBugLUChfzb…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2429) Message: Error: <path> attribute d: Expected number, "…35 10.266V4.274l5.XMR 10.004 0 1…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2497) Message: Error: <path> attribute d: Expected number, "…942V3.058C2 2.47wa77zBBugLUChfzb…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2505) Message: Error: <path> attribute d: Expected number, "…a5.12 5.12 0 0 1-1.XMR.28 7.28 0…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2513) Message: Error: <path> attribute d: Expected number, "…7.36 7.36 0 0 1 2.XMR 0 3.05-.06…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2521) Message: Error: <path> attribute d: Expected path command, "… 1.207-1.78 2.47wa77zBBugLUChfzb…".
rendering	error	URL: https://gygstudio.com.mx/chop/canada/home/cpa-bill.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMy4wLjU2NzIuNjMgU2FmYXJpLzUzNy4zNjE0OS41Ni4xNTMuMTg2MjAyMzpNYXk6TW9u(Line 2530) Message: Error: <path> attribute d: Expected number, "…35 10.266V4.274l5.XMR 10.004 0 1…".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gygstudio.com.mx
otalent.ch
146.148.36.234
2001:1600:4:13:d294:66ff:fe1d:f533
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0fa2363edda78b67a8c62a856796d3633b6e278db003207ae118d3dfb0ed5823
1287b4c6427119cabf899a5ea898f81e831a2742614813a3302f671690b399c2
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
31d6c83c556571fbd4cbac36e0319c9d9b9d275fbe6c8156ce39bb4e878193f4
3228f4cd6fd28ef733c3d98079f3478b1c4cb3338dcd7b95658ba731b817e113
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
3712c17c27414c5a3981a0c1946d831001f5ad4e45b62577c08928c37f6ec8d4
3cec1a10482ab62ddd412f5f2711833fa88693526916e6119956d5041960dff3
6a50626ef34e5da6014662089f0775c6187d23e5c22379da71203848eac50ee3
8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d
abf1f63a2886e67a68c108a433a64215a46d85737b37e6ad9b1cae1e38318917
acf56f4833ccd8789f66864deae46f9a6efb8625f15b9e5996a00e5634f094e1
d1f9fbf33db045a86af8a16f01659de9e5fbcce3199edb10a3ac4dc76155c4f9
e467e89a41e68909313eef448847f3446650158fb5d046295fea70fd7d776b87

gygstudio.com.mx Open in urlscan Pro 146.148.36.234 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

504 kBTransfer

992 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

2 Cookies

15 Console Messages

Security Headers

Indicators

gygstudio.com.mx Open in urlscan Pro
146.148.36.234 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

504 kB
Transfer

992 kB
Size

2
Cookies

5 HTTP transactions
11 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!