test.luxinterest.com

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 198.54.115.88, located in Marlboro, United States and belongs to NAMECHEAP-NET, US. The main domain is test.luxinterest.com.

This is the only time test.luxinterest.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

	IP Address	AS Autonomous System
6	198.54.115.88 198.54.115.88	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2600:1400:d:5... 2600:1400:d:590::f50	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	2

6 198.54.115.88 (Marlboro, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server108-2.web-hosting.com

test.luxinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1400:d:590::f50 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

www.irs.gov	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	luxinterest.com test.luxinterest.com	129 KB
1	irs.gov www.irs.gov — Cisco Umbrella Rank: 20058	2 KB
7	2

	Domain	Requested by
6	test.luxinterest.com	test.luxinterest.com
1	www.irs.gov	test.luxinterest.com
7	2

This site contains no links.

Subject Issuer	Validity	Valid
www.irs.gov Entrust Certification Authority - L1F	`2022-10-04` - `2023-11-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://test.luxinterest.com/form.php
Frame ID: AD242E4ED9899A6F82245D7ACA719FCC
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

IRS

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

14 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

132 kB
Transfer

432 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request form.php Show response
test.luxinterest.com/ 12 KB
4 KB 183ms
81ms Document
text/html 198.54.115.88
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://test.luxinterest.com/form.php
Protocol: HTTP/1.1
Server: 198.54.115.88 Marlboro, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server108-2.web-hosting.com
Software: LiteSpeed / PHP/5.6.40
Resource Hash: 8d445473fbb4f2848058d9251d1887c966a0d90d325ffdb346641d496209196d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-length: 3659
content-type: text/html; charset=UTF-8
date: Mon, 19 Jun 2023 14:01:03 GMT
keep-alive: timeout=5, max=100
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/5.6.40
x-turbo-charged-by: LiteSpeed

GET
H/1.1 200
OK bootstrap.min.css
test.luxinterest.com/cdn.jsdelivr.net/npm/bootstrap%404.0.0/dist/css/ 141 KB
27 KB 77ms
77ms Stylesheet
text/css 198.54.115.88
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://test.luxinterest.com/cdn.jsdelivr.net/npm/bootstrap%404.0.0/dist/css/bootstrap.min.css
Requested by: Host: test.luxinterest.com
URL: http://test.luxinterest.com/form.php
Protocol: HTTP/1.1
Server: 198.54.115.88 Marlboro, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server108-2.web-hosting.com
Software: LiteSpeed /
Resource Hash: 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d

Request headers

Referer: http://test.luxinterest.com/form.php
Origin: http://test.luxinterest.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Jun 2023 14:01:03 GMT
content-encoding: gzip
last-modified: Sat, 17 Jun 2023 08:48:30 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 27473
expires: Mon, 26 Jun 2023 14:01:03 GMT

GET
H/1.1 200
OK bootstrap.min.css
test.luxinterest.com/maxcdn.bootstrapcdn.com/bootstrap/4.5.0/css/ 157 KB
31 KB 157ms
80ms Stylesheet
text/css 198.54.115.88
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://test.luxinterest.com/maxcdn.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Requested by: Host: test.luxinterest.com
URL: http://test.luxinterest.com/form.php
Protocol: HTTP/1.1
Server: 198.54.115.88 Marlboro, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server108-2.web-hosting.com
Software: LiteSpeed /
Resource Hash: 680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

Request headers

accept-language: en-US,en;q=0.9
Referer: http://test.luxinterest.com/form.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Jun 2023 14:01:03 GMT
content-encoding: gzip
last-modified: Mon, 25 Jan 2021 22:04:10 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 31232
expires: Mon, 26 Jun 2023 14:01:03 GMT

GET
H/1.1 200
OK jquery-2.2.4.min.js Show response
test.luxinterest.com/code.jquery.com/ 84 KB
33 KB 156ms
77ms Script
application/javascript 198.54.115.88
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://test.luxinterest.com/code.jquery.com/jquery-2.2.4.min.js
Requested by: Host: test.luxinterest.com
URL: http://test.luxinterest.com/form.php
Protocol: HTTP/1.1
Server: 198.54.115.88 Marlboro, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server108-2.web-hosting.com
Software: LiteSpeed /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

accept-language: en-US,en;q=0.9
Referer: http://test.luxinterest.com/form.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Jun 2023 14:01:03 GMT
content-encoding: gzip
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 33605
expires: Mon, 26 Jun 2023 14:01:03 GMT

GET
H/1.1 200
OK official-site-flag.png
test.luxinterest.com/www.irs.gov/themes/custom/pup_base/images/ 4 KB
4 KB 94ms
94ms Image
image/png 198.54.115.88
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://test.luxinterest.com/www.irs.gov/themes/custom/pup_base/images/official-site-flag.png
Requested by: Host: test.luxinterest.com
URL: http://test.luxinterest.com/form.php
Protocol: HTTP/1.1
Server: 198.54.115.88 Marlboro, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server108-2.web-hosting.com
Software: LiteSpeed /
Resource Hash: 2aed0559ebb58b74e1ae783ef624dbbc9f70390a2648dc1787af6c68122ec510

Request headers

accept-language: en-US,en;q=0.9
Referer: http://test.luxinterest.com/form.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Jun 2023 14:01:04 GMT
last-modified: Sat, 02 Jul 2022 04:50:44 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 4029
expires: Mon, 26 Jun 2023 14:01:04 GMT

GET
H2 200 IRS-Logo.svg
www.irs.gov/pub/image/ 5 KB
2 KB 118ms
24ms Image
image/svg+xml 2600:1400:d:590::f50
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.irs.gov/pub/image/IRS-Logo.svg

Requested by

Host: test.luxinterest.com
URL: http://test.luxinterest.com/form.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2600:1400:d:590::f50 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

/

Resource Hash

0f43618580dd31a8096effd969ca2af7e26ba8555ab8d732e5b32fe2ef8e8cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-US,en;q=0.9
Referer: http://test.luxinterest.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

expires: Tue, 20 Jun 2023 14:01:04 GMT
x-edgeconnect-origin-mex-latency: 10
date: Mon, 19 Jun 2023 14:01:04 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-edgeconnect-midmile-rtt: 1
x-age: 57
x-ah-environment: prod
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="468662_388099621_1396062020_37_12370_4_0_-";dur=1
content-length: 1941
x-request-id: v-be16704e-b6da-11ed-a5fa-d789f7d0c72c
last-modified: Sat, 17 Jun 2023 07:35:47 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=86400
accept-ranges: bytes
x-cache-hits: 6

GET
H/1.1 200
OK hero-1-optimized.jpg
test.luxinterest.com/www.irs.gov/pub/2021-10/ 30 KB
30 KB 78ms
78ms Image
image/jpeg 198.54.115.88
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://test.luxinterest.com/www.irs.gov/pub/2021-10/hero-1-optimized.jpg
Requested by: Host: test.luxinterest.com
URL: http://test.luxinterest.com/form.php
Protocol: HTTP/1.1
Server: 198.54.115.88 Marlboro, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server108-2.web-hosting.com
Software: LiteSpeed /
Resource Hash: 9ee545f8c50031535751e547b30cb89491089e64c05a2ea6db057b767db08ae8

Request headers

accept-language: en-US,en;q=0.9
Referer: http://test.luxinterest.com/form.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Jun 2023 14:01:04 GMT
last-modified: Sat, 30 Oct 2021 01:42:50 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 30267
expires: Mon, 26 Jun 2023 14:01:04 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

test.luxinterest.com
www.irs.gov
198.54.115.88
2600:1400:d:590::f50
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0f43618580dd31a8096effd969ca2af7e26ba8555ab8d732e5b32fe2ef8e8cf6
2aed0559ebb58b74e1ae783ef624dbbc9f70390a2648dc1787af6c68122ec510
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
8d445473fbb4f2848058d9251d1887c966a0d90d325ffdb346641d496209196d
9ee545f8c50031535751e547b30cb89491089e64c05a2ea6db057b767db08ae8

test.luxinterest.com Open in urlscan Pro 198.54.115.88 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

14 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

132 kBTransfer

432 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

test.luxinterest.com Open in urlscan Pro
198.54.115.88 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

14 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

132 kB
Transfer

432 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!