# PhishDestroy domain threat record: equinor-landingpage.my.canva.site

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/equinor-landingpage.my.canva.site/
Machine-readable companion: https://phishdestroy.io/domain/equinor-landingpage.my.canva.site/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-02 16:40:08 UTC
- Last availability or vendor check: 2026-10-22 10:05:36 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 11/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Google

## Stored infrastructure

- Observed IP address: 103.169.142.6
- Registrar in stored WHOIS data: Gandi SAS
- Registrar country in stored WHOIS data: FR
- Last stored HTTP status: 301
- Registration date (registry RDAP, canva.site): 2018-04-03 02:06:47 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a06321-05ae-7280-bb33-51d9b41a6115/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/equinor-landingpage.my.canva.site
- Certificate Transparency search: https://crt.sh/?q=%25.equinor-landingpage.my.canva.site
- Web Archive lookup: https://web.archive.org/web/*/https://equinor-landingpage.my.canva.site/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
This is an impersonation phishing page that borrows the name of Equinor, the Norwegian energy company, and is hosted on Canva's free website builder. It targets people who trust the Equinor brand, typically reached through ads, social media posts or direct messages pointing to an "official" landing page. PhishDestroy first flagged it on 2026-09-02. When checked on 2026-10-19 the site was still alive and its content was reachable through a redirect.

How the scam works
Brand-themed landing pages like this one present a polished, company-looking front and then move visitors toward the real goal. That is usually a form asking for personal or login details, or a pitch for an Equinor-branded investment or crypto opportunity that collects deposits. Victims lose whatever they submit, whether credentials, identity data or money sent to the operators. The page currently shows the title "Not found", while we classify the site as Equinor impersonation phishing.

Evidence
On 2026-09-13, 11 of 89 VirusTotal engines flagged the page. Those engines included alphaMountain.ai, BitDefender, ESET, Fortinet, G-Data, Gridinsoft, Lionic and PhishFort, the last being a vendor that specializes in brand-impersonation takedowns. That is a modest share of engines, but it comes from several independent security firms, which supports the impersonation verdict. Among blocklists, only PhishDestroy lists it so far.

Infrastructure
The 2018-04-03 registration date belongs to the shared Canva site domain held through Gandi SAS, not to this specific page. The operators did not buy a domain at all. They created a free subdomain on a trusted platform, which lends the page borrowed credibility and costs almost nothing to replace. Traffic resolves to 103.169.142.6 on Cloudflare London, LLC infrastructure, geolocated to AU.

What to do
If you entered a username, password or email on this page, change that password and any account that reuses it, and turn on two-factor authentication. If you sent money or crypto for an Equinor "investment", stop all further payments and report the transaction to your bank or exchange and to local police. Ignore anyone who later offers to recover funds for a fee. Equinor does not solicit investments through Canva pages. Defenders should block the subdomain, report it to Canva for removal, and alert Equinor's brand protection team.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a06321-05ae-7280-bb33-51d9b41a6115/
VirusTotal report: https://www.virustotal.com/gui/domain/equinor-landingpage.my.canva.site
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=equinor-landingpage.my.canva.site
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:51:43 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a06321-05ae-7280-bb33-51d9b41a6115.png
  Captured: 2026-09-02 16:40:08 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a06321-05ae-7280-bb33-51d9b41a6115.png
  Captured: 2026-09-22 03:32:49 UTC
  Source report: https://urlscan.io/result/01a06321-05ae-7280-bb33-51d9b41a6115/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b43770d7-eadb-4f81-b958-b97687e3c09e.png
  Captured: 2026-09-13 14:43:42 UTC
  Source report: https://radar.cloudflare.com/scan/b43770d7-eadb-4f81-b958-b97687e3c09e
  SHA-256: a8271a7891c3da2a9621b4981a93d54a8432c6d67cdafc19a301a87fac9c3bbd
- URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a061fd-c6c9-769b-bd32-f75bd595d327.png
  Captured: 2026-09-02 12:00:23 UTC
  Source report: https://urlscan.io/result/01a061fd-c6c9-769b-bd32-f75bd595d327/
  SHA-256: fb64bdbe344a8fec991fe40116319fbcc3fe29799676621c4a758cef33c8ad2e
- URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a06219-69b8-73ce-8b06-39a10fe54e96.png
  Captured: 2026-09-02 12:30:34 UTC
  Source report: https://urlscan.io/result/01a06219-69b8-73ce-8b06-39a10fe54e96/
  SHA-256: fb64bdbe344a8fec991fe40116319fbcc3fe29799676621c4a758cef33c8ad2e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:16:53Z",
        "uuid": "01a06321-05ae-7280-bb33-51d9b41a6115",
        "scanned_at": "2026-09-02T17:18:29Z",
        "final_url": "https://equinor-landingpage.my.canva.site/",
        "status": 404,
        "ip": "103.169.142.250",
        "ips": [
            "103.169.142.250"
        ],
        "asns": [
            "209242"
        ],
        "countries": [
            "AU"
        ],
        "doc_hash": "4ae7de8164074ebd8763d7c98c47a2f780b6ce0936f2110c581dd3b281f21403",
        "tls": {
            "san": [
                "my.canva.site",
                "*.my.canva.site"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "my.canva.site",
            "protocol": "QUIC",
            "valid_to": "2026-10-05T02:03:38Z",
            "valid_from": "2026-07-07T01:03:47Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 57,
        "tls_valid_days": 90,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 17,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:27:15Z",
        "uuid": "b43770d7-eadb-4f81-b958-b97687e3c09e",
        "scanned_at": "2026-09-13T14:43:42Z",
        "final_url": "https://equinor-landingpage.my.canva.site/",
        "status": 404,
        "history": [
            {
                "url": "https://equinor-landingpage.my.canva.site/",
                "status": 404
            }
        ],
        "dom_hash": "b18e14df20cfbd39ccba47d0ab3617d2ff6691f45af83ac53ef9fee7b44fca30",
        "doc_hash": "4ae7de8164074ebd8763d7c98c47a2f780b6ce0936f2110c581dd3b281f21403",
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "equinor-landingpage.my.canva.site",
                "type": "A",
                "value": "103.169.142.250"
            },
            {
                "name": "equinor-landingpage.my.canva.site",
                "type": "A",
                "value": "103.169.142.6"
            }
        ],
        "dnssec_valid": false,
        "ip": "103.169.142.250",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Gandi SAS",
            "created": "2018-04-03T02:06:47Z",
            "updated": "2025-04-14T12:23:37Z",
            "expires": "2033-04-03T23:59:59Z",
            "nameservers": [
                "jean.ns.cloudflare.com",
                "junade.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T13:26:42Z",
        "analysis_at": "2026-09-27T00:06:07Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 12,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "phishing",
            "PhishFort": "malicious",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Gandi SAS",
        "created": "2018-04-03T02:06:47Z",
        "expires": "2033-04-03T23:59:59Z",
        "updated": "2025-04-14T12:23:37Z",
        "first_seen": "2026-09-02T09:26:30Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "103.169.142.250"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "103.169.142.6"
            }
        ],
        "dns_at": "2026-09-27T00:06:21Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "my.canva.site",
                "*.my.canva.site"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "d00610d770ec63013e04eb0240112cf",
            "sha256": "cf74e7cf16b7413c88e6d908ed090d992f5cdb5955a5707eb47bdf9c43f9f787",
            "subject": "my.canva.site",
            "valid_to": "2026-12-03T05:52:17Z",
            "valid_from": "2026-09-04T04:52:23Z"
        },
        "whois": {
            "registrar": "Gandi SAS",
            "registrar_iana_id": "81",
            "registrar_url": "https://www.gandi.net/fr",
            "created": "2018-04-03T02:06:47Z",
            "updated": "2025-04-14T12:23:37Z",
            "expires": "2033-04-03T23:59:59Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "jean.ns.cloudflare.com",
                "junade.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```