irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com Open in urlscan Pro
2606:4700:3036::ac43:a1ce  Malicious Activity! Public Scan

URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Submission: On September 20 via api from US — Scanned from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3036::ac43:a1ce, located in United States and belongs to CLOUDFLARENET, US. The main domain is irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com.
TLS certificate: Issued by GTS CA 1P5 on August 16th 2023. Valid for: 3 months.
This is the only time irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

IP Address AS Autonomous System
14 2606:4700:303... 13335 (CLOUDFLAR...)
14 1
Domain Requested by
14 irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
14 1

This site contains no links.

Subject Issuer Validity Valid
blottedinq.com
GTS CA 1P5
2023-08-16 -
2023-11-14
3 months crt.sh

This page contains 2 frames:

Primary Page: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Frame ID: BC5B3A9076A22EC5379723D019931AE3
Requests: 13 HTTP requests in this frame

Frame: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/saved_resource.htm
Frame ID: 2E955EC64D4C022927DF1EFB81850DB3
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Get Refund Status

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

55 kB
Transfer

244 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request home.html
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/
12 KB
4 KB
Document
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad2f435f42c01c935af717382851192b5d51ff23b18ca31ee19bf605a01f3446

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
809738c33a98d9f5-MIA
content-encoding
br
content-type
text/html
date
Wed, 20 Sep 2023 04:10:58 GMT
last-modified
Tue, 25 Apr 2023 15:40:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gFXMPXCg%2Fwc4bW1jt60U%2BsBoZzkQ%2BNN9Ygqr%2BrGxfdyrdaRFp2fhKH8vQf7xbOcdLwBDnlvS75z%2F%2BDkv5gkUs%2FV%2BJyytHbB2SvjiAkfQg6BH7jIbrD7W%2Fcq6zvA2q%2FzKsGYqTaIuPiJIhXqcSARQBG8MmB%2FCPc5qkw6Mccp5HKJcMg2wbL6xyzXvA%2Fc%2Fj2KhVPfts1gBXByMp8iUTeILMMjalFcBbgJLtNjf"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
bootstrap.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
152 KB
24 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/bootstrap.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:59 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"2606e-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lLTdYoVWF11mSLT2GG0c%2FaKqn13gCZXeuaeDBzdY%2BYw9dn1pTe004iWVba1ffp8eA6q0dKICX5S8AJVwk0VpGolBaia3liX%2Fmv%2BxpoTkL4lY6rVrnXR9Te%2FyzfDNgtdZoICcUDE2u%2Bv3%2F%2F35mhy2UMptBlHP1%2FjJhzsHjC7%2Fb%2FrbgFGpQqH2ACo9HSbKhcrkE%2FbzI%2FLVn%2BdP7R4f0NO0qtq1iUKL54d7E8aM"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
809738c4ed14d9f5-MIA
alt-svc
h3=":443"; ma=86400
jquery-ui.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
31 KB
8 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/jquery-ui.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca4df2bf400a42d8752e115f03366a90b2b4ed06b2da9ef429d41fda5f15705e

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:58 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"7d52-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g3JHEHjQdVM8ejf%2BkZOMovDBi0MNfvE%2Bhz81%2Btc6RymGzGt3%2F1b3OqukbAw1F5RBEZW%2FMoaIyjv1g7FhEhkeS3cf3Se%2FPUa8akU1VNRFoppTx%2Ba6cKnxUR9KAZKnlXhZKgQ4SMW17Piz41K6TwEczqO6vbwHBKuT6Xr5cafbU7d0otKVaehm%2FQcDj1owz4rA1jrm4Dm2wlCHax9Ib9A7QmG3x3vEZYGRv2%2BF"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
809738c4ed15d9f5-MIA
alt-svc
h3=":443"; ma=86400
irs.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
6 KB
2 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/irs.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c091629a45d384695d3aa0fcea2210eab8edff323d8ecbf81e3a04fda820d7f4

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:58 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"16ae-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8DJFCWicivslOYV63G4gTQq4SDj4s%2FEzPI6C2TWRNlUVk6KZVuf9bhzpsfEyHZxeUK3rumQFXY3FD23zLqknzC0T4u7TyDUdCX0rBad%2FxEwP4i050%2BrI4IHJIr0jdt4VBLJm7gqAo6AXRRyxr9%2F4NtWyToJuJBPO27i71BLcXE5K%2BtcOskbTiig97Qe17jZeouBWJbKGK%2F7%2ByZzeTahiwRJbIXAK7qI7RI5Q"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
809738c4ed17d9f5-MIA
alt-svc
h3=":443"; ma=86400
app.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
9 KB
3 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4b254c69add59c9263fc046268904bcb604aaef26626ad2dd7ba2f9b2965f52

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:58 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"2467-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OoofeoD8pEEsIzwjajWNwatvyjg9tGQIZm%2BmSK9cNEUe9Cvfz4EhkJ34CEWsk9LZTDQiZidrNjo1v2T9ozCSWmZZQnVNi83p3VwgWtNE5yWn8sP2JbgIMA555i3FT%2FRlltQZ5QEF9Hixod%2Fy%2BFuRqIDf8Bfqt7JWrU4Aao%2BRJJbmkhekOBTEv6WTQyAwtHbA5YOhGe9eGtq4xxhGdJJVU0CJM15HmxBUPWJH"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
809738c4ed18d9f5-MIA
alt-svc
h3=":443"; ma=86400
app-error.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
786 B
699 B
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app-error.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4abb35ccb93590308661b4dafacfe380c89aef07e2d94499d23f1637137bd1c

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:58 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"312-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=znRjO25e5Bf3u0c7EGXHEApQZQiT%2BInxIN3AtmmtqvBbs1z4riPJXrKk5J2chv93%2FQI%2F6nAtb03ThSAEEe4lmbcYoQy%2BD3eoB9gclzre99KY0ZjPReqdT4RJkoXKIEtmmZLCcx%2F374ehOxAFLE6pgsvM%2Bf256MFqsvCeRdz2tIvbRE7p6%2BHql9n%2BicaK8Fl8dSKvmcoYRwnQu5949DlEiFE0z8ralkQJNYG7"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
809738c4ed1cd9f5-MIA
alt-svc
h3=":443"; ma=86400
wmsp-shared-secrets.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
3 KB
1 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/wmsp-shared-secrets.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd8245e841b019e192658b02f6d510112f6793dace36c4b29cc44ab2ab6179cd

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:58 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"cb8-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p2lvznAxf05z3TwQFMpRCPLJtjMkxbnXpeYANJCt6gX%2BjDeU5QB0tat7j66z1Xe1AdVYJkfTBBfH9dKdX9JvG7fviOh8Iw6mBs2oDE0G4I1DSIbmC6by%2B%2BTmYfCMeNzEmtcX%2BQ2TOO7VUb71nb7lYVtebbsgvskXg7NAvJ4chKde09i5DTar36cM5WaakWok%2FtH%2F3pQOvwkpYSnEDOjI7NHDLwXOOviCP3uc"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
809738c4ed1dd9f5-MIA
alt-svc
h3=":443"; ma=86400
wmsp-results.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
2 KB
951 B
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/wmsp-results.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c270883773a53da36d154ea13ce8ea8451489c25aabd20e60ef6eb65c4fe439d

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:58 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"673-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y2LNFVgDXFNDPO%2F2vmR%2FWG2SUaQV8XuUeuG3FwFhSJoA%2BjuyV4gmrGoloWucY1b3UqL1oebemsXXpXsWuNbluTaFC%2BwOnYpQRGiG%2BVmJEFStXO%2BOs9WBrRRFnFFXzg4%2BZcbG6yYNzW3nKIsgKY4ifYaSrN6458LbTJh149wQgT8NBtxjYhazvs5GH%2FBHP%2FcQXTZwHiomOPz5BHKzH%2BYco9Qw0jY4SaXpsrx6"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
809738c4ed1ed9f5-MIA
alt-svc
h3=":443"; ma=86400
datepicker.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
21 KB
3 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/datepicker.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2538e625a9042c2cd54e13cf52221fce1831dd12c5ca4cdac23137ac22e3010

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:58 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"52fc-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TY9LGsKa3Lsl68tAM7N5ziwcDhzCv1Col1wcPvelZh7zs%2FMkfJlLHQsWKRJGv1O9JYhUaA5Supu80%2FXDwtL5P%2B4CSVgZPaNmciPAoEfPsEL%2BWnKNBoo3wFhLQsRg2cKXIx%2BKd43n9OH2sAOI8beG9nnXP0POlIyZbUpORT2NuhReEyq2lvgP8h%2Fy34%2FeaBdbQ1MMb23Xzs5DcH8J4P%2BVXa7lUKFu7lfRd1CR"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
809738c4ed1fd9f5-MIA
alt-svc
h3=":443"; ma=86400
logo.png
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
5 KB
5 KB
Image
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/logo.png
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02ceea374fce34ce8272bb17a67fd862c8ff49eeb05938154570701ca7a62ea7

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:59 GMT
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"1220-5e0f61f399f80"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EPvxBcTpPu8HZ0ReA1YggJX3cTYPsKayRSGU5uBm%2BM4YgYW5WYXAa0KjsOlV1xvvs26m7DkgiC8PPOA6haL%2BfFRmtnCynmujRzMJbvvOV5XKJmo4%2F7KXoongsJXhJ1l17NsKiAPws%2Fl7vLaQyiJ2VsVVROGoJa1Xv97f0%2Bjt8txJbmj7RGHv%2F2eCFLZw55yjzA9xsrPKLeNdiJRj%2F5wQ1Gwgn7T95V1Tv5GP"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
809738c7aace9acc-MIA
alt-svc
h3=":443"; ma=86400
content-length
4640
irs_horiz_white.png
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
1 KB
2 KB
Image
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/irs_horiz_white.png
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d3238bdb8ee9440978b31fadb2af34965dca58b179a1225e13316d4c6cfd5e8

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:59 GMT
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"5da-5e0f61f399f80"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vAtMv3HUT34g%2BE%2Fgy0A4H4uC0Ir%2B05vBaOX%2BBle5a6D1GkECDLlGCn9ojmZhUCpzbXHlDUsjG4xNGUuGtzEY5F83c7t9Ir5ENdqdO6esP9re9PQRXBSnX6rPWn3wvReDdxQxc95bUbc%2B5BleGlxkF7EaReS1FzxlN3UCFM%2FW9kQq560HNl%2BfzjUL8geaJ1sXLSxCk8sVpz7p1%2B4XST66HQ931U9pgXeBY8XQ"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
809738c7fb489acc-MIA
alt-svc
h3=":443"; ma=86400
content-length
1498
saved_resource.htm
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/ Frame 2E95
313 B
686 B
Document
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/saved_resource.htm
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6afaa120b93af4f452d55328c8a2e686ab93ef0e4baa5b049a808d471cb7781f

Request headers

Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
809738c80b669acc-MIA
content-encoding
br
content-type
text/html
date
Wed, 20 Sep 2023 04:10:59 GMT
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XAp68wAMK7adEdPP7IAg%2FtO5lL2Gkqfzf5AjYXB6XSVUsC%2FOpmAnwKvMjgwhOLcLRQyoQHca%2Bq%2BuJClsNvkt25GEZVf1TzYxQ1yXQsGznd6KjCnAXBsxfJ1Z457kykOvWcTX3Rb6kv6%2F0ka7sfwzQoCw6tqygvJW07dkfZJv8gV6sdtJDcGm3QH%2Fte%2BlMD%2BX9DAOigJMnG7DseztwtNZ%2FmXlALsTXpl%2BQ7s0"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
swirl_lighter_ca6f4deb.png
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/images/
338 B
338 B
Image
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/images/swirl_lighter_ca6f4deb.png
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7bdeb2cd1a5142121c32d99915831da27b68bfcac5eaee0e58de06e4fdca2f7d

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:59 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hwDOFDU6hOTxKusouh7gb%2FToeToqK44YlURVlPzW7VSVCFxX8LJoCVVJvR68RkA18Rnflw9yc9sxmaZGBDTSDh9NXqzCWIkt8Vv81Zt1hgyF2v67ZDAr6EKg%2FUPpUTpGYy1WJnYY7GVqFyJrMuTokt9XoBaE%2BxwmHot1PgIKwNYzBZ5jWs%2B9LaI8lLZdUhXcsTlu8NwFMNj%2BimNNFUYgfO32eF1epQsjv3cc"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
809738c80b6e9acc-MIA
alt-svc
h3=":443"; ma=86400
us.png
irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/assets/img/
338 B
338 B
Image
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/assets/img/us.png
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7bdeb2cd1a5142121c32d99915831da27b68bfcac5eaee0e58de06e4fdca2f7d

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 04:10:59 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DReSzsVms%2BxFKfjMSMuS%2FjRC499NacFsWhFQOKReh7wtp3FplnbnslWxAlB2COh8gqjM1W4YYvVOhyb8i9awGacoG%2B2iC0HqQgTeeQF52mWD1%2Frvt%2BURMmGCaEPMJEC2QdXl%2BQEBG8snMVVxQgtH2my2ob9zlCHjLE1%2Fv1605j8mdDz%2FLuaBtQG1FSMzaOPg4MYHZwUPsE1M%2FpNakWAA8bhPij6g43UX24rQ"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
809738c80b6f9acc-MIA
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| noBack string| message function| clickIE function| clickNS function| disableCtrlKeyCombination

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/assets/img/us.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-650a3bea9267e.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/images/swirl_lighter_ca6f4deb.png
Message:
Failed to load resource: the server responded with a status of 404 ()