u31733.s2.radisol.org
Open in
urlscan Pro
82.202.204.197
Malicious Activity!
Public Scan
Effective URL: http://u31733.s2.radisol.org/oauth2/authorize.html?response_type%3Dtoken%2520id_token%26client_id%3DMF_I33468f56-eff7
Submission: On January 05 via manual from CA
Summary
This is the only time u31733.s2.radisol.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Hydro Quebec (Utility)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 20 | 82.202.204.197 82.202.204.197 | 50340 (SELECTEL-MSK) (SELECTEL-MSK) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2008 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:809::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:825::2003 | 15169 (GOOGLE) (GOOGLE) | |
24 | 5 |
ASN50340 (SELECTEL-MSK, RU)
PTR: orangemail.site
u31733.s2.radisol.org |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
radisol.org
2 redirects
u31733.s2.radisol.org |
3 MB |
3 |
google-analytics.com
www.google-analytics.com |
19 KB |
1 |
gstatic.com
fonts.gstatic.com |
9 KB |
1 |
googleapis.com
fonts.googleapis.com |
646 B |
1 |
googletagmanager.com
www.googletagmanager.com |
36 KB |
24 | 5 |
Domain | Requested by | |
---|---|---|
20 | u31733.s2.radisol.org |
2 redirects
u31733.s2.radisol.org
|
3 | www.google-analytics.com |
www.googletagmanager.com
u31733.s2.radisol.org |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
u31733.s2.radisol.org
|
1 | www.googletagmanager.com |
u31733.s2.radisol.org
|
24 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google-analytics.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://u31733.s2.radisol.org/oauth2/authorize.html?response_type%3Dtoken%2520id_token%26client_id%3DMF_I33468f56-eff7
Frame ID: F0F64EC10C1AC4CB54DB88F286E90A3A
Requests: 24 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://u31733.s2.radisol.org/
HTTP 302
http://u31733.s2.radisol.org/oauth2/ HTTP 302
http://u31733.s2.radisol.org/oauth2/authorize.html?response_type%3Dtoken%2520id_token%26client_id%3DMF_I3... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Google Tag Manager (Tag Managers) Expand
Detected patterns
- html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://u31733.s2.radisol.org/
HTTP 302
http://u31733.s2.radisol.org/oauth2/ HTTP 302
http://u31733.s2.radisol.org/oauth2/authorize.html?response_type%3Dtoken%2520id_token%26client_id%3DMF_I33468f56-eff7 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- http://www.google-analytics.com/r/collect?v=1&_v=j79&a=679827328&t=pageview&_s=1&dl=http%3A%2F%2Fu31733.s2.radisol.org%2Foauth2%2Fauthorize.html%3Fresponse_type%253Dtoken%252520id_token%2526client_id%253DMF_I33468f56-eff7&dp=%2Foauth2%2Fauthorize.html%3Fresponse_type%253Dtoken%252520id_token%2526client_id%253DMF_I33468f56-eff7&ul=en-us&de=UTF-8&dt=Acc%C3%A9der%20%C3%A0%20mon%20Espace%20client%20%7C%20Hydro-Qu%C3%A9bec&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAAABE~&jid=768738585&gjid=1687561667&cid=277816212.1609811328&tid=UA-41911837-22&_gid=132160375.1609811328&_r=1>m=2wgbu0M8KMBZS&z=953216494 HTTP 307
- https://www.google-analytics.com/r/collect?v=1&_v=j79&a=679827328&t=pageview&_s=1&dl=http%3A%2F%2Fu31733.s2.radisol.org%2Foauth2%2Fauthorize.html%3Fresponse_type%253Dtoken%252520id_token%2526client_id%253DMF_I33468f56-eff7&dp=%2Foauth2%2Fauthorize.html%3Fresponse_type%253Dtoken%252520id_token%2526client_id%253DMF_I33468f56-eff7&ul=en-us&de=UTF-8&dt=Acc%C3%A9der%20%C3%A0%20mon%20Espace%20client%20%7C%20Hydro-Qu%C3%A9bec&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAAABE~&jid=768738585&gjid=1687561667&cid=277816212.1609811328&tid=UA-41911837-22&_gid=132160375.1609811328&_r=1>m=2wgbu0M8KMBZS&z=953216494
- http://www.google-analytics.com/collect?v=1&_v=j79&a=679827328&t=pageview&_s=1&dl=http%3A%2F%2Fu31733.s2.radisol.org%2Foauth2%2Fauthorize.html%3Fresponse_type%253Dtoken%252520id_token%2526client_id%253DMF_I33468f56-eff7&dp=%2Foauth2%2Fauthorize.html%3Fresponse_type%253Dtoken%252520id_token%2526client_id%253DMF_I33468f56-eff7&ul=en-us&de=UTF-8&dt=Acc%C3%A9der%20%C3%A0%20mon%20Espace%20client%20%7C%20Hydro-Qu%C3%A9bec&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAAABE~&jid=&gjid=&cid=277816212.1609811328&tid=UA-41911837-22&_gid=132160375.1609811328>m=2wgbu0M8KMBZS&z=381780933 HTTP 307
- https://www.google-analytics.com/collect?v=1&_v=j79&a=679827328&t=pageview&_s=1&dl=http%3A%2F%2Fu31733.s2.radisol.org%2Foauth2%2Fauthorize.html%3Fresponse_type%253Dtoken%252520id_token%2526client_id%253DMF_I33468f56-eff7&dp=%2Foauth2%2Fauthorize.html%3Fresponse_type%253Dtoken%252520id_token%2526client_id%253DMF_I33468f56-eff7&ul=en-us&de=UTF-8&dt=Acc%C3%A9der%20%C3%A0%20mon%20Espace%20client%20%7C%20Hydro-Qu%C3%A9bec&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAAABE~&jid=&gjid=&cid=277816212.1609811328&tid=UA-41911837-22&_gid=132160375.1609811328>m=2wgbu0M8KMBZS&z=381780933
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
authorize.html
u31733.s2.radisol.org/oauth2/ Redirect Chain
|
14 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
analytics.js
u31733.s2.radisol.org/oauth2/AtmaCa/ |
43 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtm.js
u31733.s2.radisol.org/oauth2/AtmaCa/ |
76 KB 77 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.js
u31733.s2.radisol.org/oauth2/AtmaCa/ |
95 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ThemeConfiguration.js
u31733.s2.radisol.org/oauth2/AtmaCa/ |
15 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.css
u31733.s2.radisol.org/oauth2/AtmaCa/ |
144 KB 144 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
structure.css
u31733.s2.radisol.org/oauth2/AtmaCa/ |
70 KB 70 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme-hq.css
u31733.s2.radisol.org/oauth2/AtmaCa/ |
8 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-hydro-quebec-couleur.svg
u31733.s2.radisol.org/oauth2/AtmaCa/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-hydro-quebec-coupe.png
u31733.s2.radisol.org/oauth2/AtmaCa/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
u31733.s2.radisol.org/oauth2/AtmaCa/ |
2 MB 2 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
99 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
46 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/r/ Redirect Chain
|
35 B 112 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 646 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background.jpg
u31733.s2.radisol.org/oauth2/AtmaCa/ |
237 KB 237 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
*
u31733.s2.radisol.org/oauth2/json/serverinfo/ |
222 B 407 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
translation.json
u31733.s2.radisol.org/oauth2/locales/en/ |
232 B 415 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
users
u31733.s2.radisol.org/oauth2/json/ |
215 B 403 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
sessions
u31733.s2.radisol.org/oauth2/json/ |
218 B 405 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
collect
www.google-analytics.com/ Redirect Chain
|
35 B 384 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
sessions
u31733.s2.radisol.org/oauth2/json/ |
218 B 405 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
authenticate
u31733.s2.radisol.org/oauth2/json/ |
222 B 408 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Hydro Quebec (Utility)41 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated object| dataLayer function| $ function| jQuery object| webpackJsonp object| google_tag_data function| ga object| gaplugins object| google_tag_manager string| GoogleAnalyticsObject object| gaGlobal object| gaData object| changerLangue function| onShowPasswordBtnClick object| date number| year string| text object| core object| __core-js_shared__ function| setImmediate function| clearImmediate object| regeneratorRuntime function| _ function| BootstrapTable function| TableHeaderColumn function| InsertModalHeader function| InsertModalBody function| InsertModalFooter function| InsertButton function| DeleteButton function| ShowSelectedOnlyButton function| ExportCSVButton function| ClearSearchButton function| SearchField function| ButtonGroup function| SizePerPageDropDown object| QRCodeReader3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.u31733.s2.radisol.org/ | Name: _gat_UA-41911837-22 Value: 1 |
|
.u31733.s2.radisol.org/ | Name: _gid Value: GA1.4.132160375.1609811328 |
|
.u31733.s2.radisol.org/ | Name: _ga Value: GA1.4.277816212.1609811328 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
u31733.s2.radisol.org
www.google-analytics.com
www.googletagmanager.com
2a00:1450:4001:808::2008
2a00:1450:4001:809::200e
2a00:1450:4001:81d::200a
2a00:1450:4001:825::2003
82.202.204.197
0d0b0b91f3c7ab55706832e15dabfff020f7a2a6c10a63a28f2daf2c8b9e5eed
0e977c56b77cdc4ca1e90a282ae292d68324794594d3f4dbee98e468858af8c0
26ea006c5b4845ccbdb550bbe677e6be6e0b9ab4bc7a05a84ba64fb4e9b25913
30617021b354ac7ba30df2c8eefbd72a7d0ed4fa89c037d51f64240cb486dbb0
3369ccb19b6779461710233a9367a51d745b2e51394d11df1bc057a48c7be663
3d81461f2fbea4b935667b055e9033eb1ae6786661dde2588d6333003f1926c6
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf
605c507bba94fce2605d7998713498ab62a144035d899dfbacf4b53110eef415
60a9f0f1069c9d33d1be314decf8b864601458074c5529669375278b06c79767
6be6d858c17568d15adae2d6aa57bb02dfe69d65ce28bcbeee2605a7e09ddd6d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
90752a28cb6028b984893ed96fcde41f454f6f14c95e68e5c412ad90ce3c6c26
9f8614685fb4316a9d7f1afa3ecbb9a55a44d392ec2f1e736627d9f8e6d7dd93
a8e149f31f94a5d06cede038c0d9934f1b244399cf622eda520d1271336591c5
ab11261654ebdb1ad6b1c3e0acd763a0f78a756fb963c72e2c111db9101ce8b8
ab85b5c088d17ba56880b176bc5877a9b9893f8905a9877e7a711a79d15dea9d
cf13b51faeadafff6da68615a6fd56c1802f1428c7091578cdf0a43edd79ea38
cf7a2b3976c3af63dc2bca70cc5625a26341f19b1ccd484feddf076df895ed58
d80ac69f13b6089325fff4f0f223db84a33a6f46c89cf717416e0b7158eb5489
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b