mathieuguay.ca
Open in
urlscan Pro
50.87.135.16
Malicious Activity!
Public Scan
Effective URL: http://mathieuguay.ca/*@lp9/jx3*l/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid...
Submission: On June 13 via manual from US
Summary
This is the only time mathieuguay.ca was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer) Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 172.98.74.243 172.98.74.243 | 46562 (TOTAL-SER...) (TOTAL-SERVER-SOLUTIONS - Total Server Solutions L.L.C.) | |
1 | 172.217.16.194 172.217.16.194 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 172.217.23.174 172.217.23.174 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 91.121.43.227 91.121.43.227 | 16276 (OVH) (OVH) | |
2 | 216.58.205.226 216.58.205.226 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
3 | 172.217.22.2 172.217.22.2 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 172.217.23.161 172.217.23.161 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 10 | 50.87.135.16 50.87.135.16 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
1 | 172.217.22.10 172.217.22.10 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 91.198.174.208 91.198.174.208 | 14907 (WIKIMEDIA) (WIKIMEDIA - Wikimedia Foundation Inc.) | |
4 | 172.217.23.163 172.217.23.163 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
23 | 10 |
ASN46562 (TOTAL-SERVER-SOLUTIONS - Total Server Solutions L.L.C., US)
soo.gd |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s08-in-f2.1e100.net
www.googletagservices.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f174.1e100.net
goo.gl |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s24-in-f2.1e100.net
adservice.google.de | |
adservice.google.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s14-in-f2.1e100.net
securepubads.g.doubleclick.net |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f1.1e100.net
tpc.googlesyndication.com |
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: 50-87-135-16.unifiedlayer.com
mathieuguay.ca |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s14-in-f10.1e100.net
fonts.googleapis.com |
ASN14907 (WIKIMEDIA - Wikimedia Foundation Inc., US)
PTR: upload-lb.esams.wikimedia.org
upload.wikimedia.org |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f163.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
mathieuguay.ca
2 redirects
mathieuguay.ca |
221 KB |
4 |
gstatic.com
fonts.gstatic.com |
114 KB |
3 |
doubleclick.net
securepubads.g.doubleclick.net |
77 KB |
1 |
wikimedia.org
upload.wikimedia.org |
25 KB |
1 |
googleapis.com
fonts.googleapis.com |
725 B |
1 |
googlesyndication.com
tpc.googlesyndication.com |
|
1 |
google.com
adservice.google.com |
171 B |
1 |
google.de
adservice.google.de |
171 B |
1 |
top4top.net
up.top4top.net |
1 KB |
1 |
goo.gl
1 redirects
goo.gl |
337 B |
1 |
googletagservices.com
www.googletagservices.com |
8 KB |
1 |
soo.gd
soo.gd |
2 KB |
23 | 12 |
Domain | Requested by | |
---|---|---|
10 | mathieuguay.ca |
2 redirects
soo.gd
mathieuguay.ca |
4 | fonts.gstatic.com |
mathieuguay.ca
|
3 | securepubads.g.doubleclick.net |
www.googletagservices.com
securepubads.g.doubleclick.net |
1 | upload.wikimedia.org |
mathieuguay.ca
|
1 | fonts.googleapis.com |
mathieuguay.ca
|
1 | tpc.googlesyndication.com |
securepubads.g.doubleclick.net
|
1 | adservice.google.com |
www.googletagservices.com
|
1 | adservice.google.de |
www.googletagservices.com
|
1 | up.top4top.net |
soo.gd
|
1 | goo.gl | 1 redirects |
1 | www.googletagservices.com |
soo.gd
|
1 | soo.gd | |
23 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://mathieuguay.ca/*@lp9/jx3*l/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Frame ID: FD2224EAA8D48A221CC644AF787A92F3
Requests: 23 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://soo.gd/MrwV/ Page URL
-
http://mathieuguay.ca/*@lp9/jx3*l
HTTP 301
http://mathieuguay.ca/*@lp9/jx3*l/ HTTP 302
http://mathieuguay.ca/*@lp9/jx3*l/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.... Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Clipboard.js (Miscellaneous) Expand
Detected patterns
- env /^Clipboard$/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://soo.gd/MrwV/ Page URL
-
http://mathieuguay.ca/*@lp9/jx3*l
HTTP 301
http://mathieuguay.ca/*@lp9/jx3*l/ HTTP 302
http://mathieuguay.ca/*@lp9/jx3*l/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- https://goo.gl/L3AkqG HTTP 301
- https://up.top4top.net/images/spacer.gif
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
soo.gd/MrwV/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
gpt.js
www.googletagservices.com/tag/js/ |
19 KB 8 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
spacer.gif
up.top4top.net/images/ Redirect Chain
|
807 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
integrator.js
adservice.google.de/adsid/ |
109 B 171 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
integrator.js
adservice.google.com/adsid/ |
109 B 171 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
pubads_impl_214.js
securepubads.g.doubleclick.net/gpt/ |
173 KB 60 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
ads
securepubads.g.doubleclick.net/gampad/ |
454 B 509 B |
XHR
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
pubads_impl_rendering_214.js
securepubads.g.doubleclick.net/gpt/ |
44 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
container.html
tpc.googlesyndication.com/safeframe/1-0-28/html/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index2.php
mathieuguay.ca/*@lp9/jx3*l/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theDocs.all.min.css
mathieuguay.ca/*@lp9/jx3*l/assets/css/ |
203 KB 46 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.css
mathieuguay.ca/*@lp9/jx3*l/assets/css/ |
2 KB 922 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
fonts.googleapis.com/ |
1 KB 725 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
mathieuguay.ca/*@lp9/jx3*l/assets/img/ |
21 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
word.png
mathieuguay.ca/*@lp9/jx3*l/assets/img/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
Office_365_logo.png
upload.wikimedia.org/wikipedia/commons/7/74/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theDocs.all.min.js
mathieuguay.ca/*@lp9/jx3*l/assets/js/ |
222 KB 85 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.js
mathieuguay.ca/*@lp9/jx3*l/assets/js/ |
4 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
S6uyw4BMUTPHjx4wWw.ttf
fonts.gstatic.com/s/lato/v14/ |
59 KB 30 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1Ptug8zYS_SKggPNyC0ISg.ttf
fonts.gstatic.com/s/raleway/v12/ |
52 KB 26 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1Ptrg8zYS_SKggPNwIYqWqZPBQ.ttf
fonts.gstatic.com/s/raleway/v12/ |
54 KB 26 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fontawesome-webfont5b62.html
mathieuguay.ca/*@lp9/jx3*l/assets/fonts/ |
70 KB 71 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
S6u9w4BMUTPHh7USSwiPHA.ttf
fonts.gstatic.com/s/lato/v14/ |
62 KB 33 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer) Office 365 (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _self object| Prism object| httpLanguages object| options string| contentType function| $ function| jQuery function| Clipboard function| lity function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adservice.google.com
adservice.google.de
fonts.googleapis.com
fonts.gstatic.com
goo.gl
mathieuguay.ca
securepubads.g.doubleclick.net
soo.gd
tpc.googlesyndication.com
up.top4top.net
upload.wikimedia.org
www.googletagservices.com
172.217.16.194
172.217.22.10
172.217.22.2
172.217.23.161
172.217.23.163
172.217.23.174
172.98.74.243
216.58.205.226
50.87.135.16
91.121.43.227
91.198.174.208
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
2774d5977ed1be78cabb5f13437f2bffa6338cc84746e495b10bc0e979e38e80
2cbcd235e7bd37011920b82ef900a4c2e87a048faa7345a1af59c1f28bce7188
2cc68b94666feb1fdd89122bf25fe10b0089cd51abbeec09913026d20f085dd5
31d2be93f97b808ad3f5816c0f6f031a22e519c5492490d2e97cc96f79de920f
39c5cf88c9572e0a95d3ab571906a3403c614a809f2fc88e22b92bec1e8cba38
3ae10ed925ca3203f6f4907da618fa90061d565b0b38af565b2fc5396477361a
4977f8d8f865c43ee26dc31409cd4fe8945048d5800719133d79ab053527d859
4f68c491b0f93d2f3b61d07bdd87b291eccb2ff3d1ec8a70675730ea1b844b07
58f90daf1bfe504076e2e7760975c80183a0ded6662a2e189ada0e18bfe78aae
679290044ff37088379121c3590f0c580a94c679f97064d6e1739ab2b56ffda5
6bf788214f0920f04146aa23bc2d8588b55a3e81b5c7f25acc4377b895030979
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
8178c795d51417ec3e73ea0be8fcd1d051cfbf684b83e782d7b05644762b968f
8ae79a4d18eea420af0fd562d43879b569bbd2c622da6deba79f6c202e385361
8ff299861c6ab8629f2a9847f5601b04d55793dc700ee8f7acf180e4867fcc44
9c4590446dbf83edae05be4ca28ef789ee50a01ef2cb8f1b51c5937d029cac76
a04d617e96e95a2fc781b68205e1c8ee0f99e07a6e3507653341b4a4d2ea0cae
c9242c9e38a8f38f4a58d73b3fbeeee4737b123bfe0ec8bfc554b340e2310c52
e9acf647c2148eb14d647128abbeb4753d10a2d1ccea821763ac38c4fdd8520d
f81e12f67f4c6f10ed89f3be4a9f7f4685c1e746cae88373f1e5f823980601fb