irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com Open in urlscan Pro
2606:4700:3036::ac43:a1ce  Malicious Activity! Public Scan

URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Submission: On September 18 via api from US — Scanned from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3036::ac43:a1ce, located in United States and belongs to CLOUDFLARENET, US. The main domain is irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com.
TLS certificate: Issued by GTS CA 1P5 on August 16th 2023. Valid for: 3 months.
This is the only time irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

IP Address AS Autonomous System
14 2606:4700:303... 13335 (CLOUDFLAR...)
14 1
Domain Requested by
14 irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
14 1

This site contains no links.

Subject Issuer Validity Valid
blottedinq.com
GTS CA 1P5
2023-08-16 -
2023-11-14
3 months crt.sh

This page contains 2 frames:

Primary Page: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Frame ID: 033A3688C375C71DCB124AA792ABFE2E
Requests: 13 HTTP requests in this frame

Frame: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/saved_resource.htm
Frame ID: A76110B2068154D245B2FD287F0D6CEB
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Get Refund Status

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

55 kB
Transfer

244 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request home.html
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/
12 KB
4 KB
Document
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad2f435f42c01c935af717382851192b5d51ff23b18ca31ee19bf605a01f3446

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8088dd94da532593-MIA
content-encoding
br
content-type
text/html
date
Mon, 18 Sep 2023 10:22:03 GMT
last-modified
Tue, 25 Apr 2023 15:40:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NyMaooN7qCH18e%2B%2BVFJ36FysOJAVzuWvVi%2BvqIOcvQXoT3SnzqPLCGrjJPwd4jZFvA0cq3G%2Ff11xKUaMcOQsgGJHAADWFTWxKG1PiWlarLgjdesGlFMzrdmDMDNWxGh4XDmURdc3M7PMfbH36nc1uXdn6IeG0r594pDcz6FB72QrekvVE3ahRpj1MyTl%2FgKUyY%2F%2Bk1UzaXtIoP%2BgDvufT%2BgPSuMe2qCrgWw1"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
bootstrap.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
152 KB
24 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/bootstrap.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"2606e-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F5PzojP3Q%2BB2GCkoVevlEIKDxrM1TL8Cbrk3QX38Bv0vpFa%2F%2FsQlj%2Fy0VWqNO%2BYSXkM06IOW2u52CifDtvvmGh%2BMOR6Vh5zRT%2BPafOZ7XAK8IK2VjWYJHD3EP1Urv0qTp1JalzJxOodhyJu5apEt81pvxDfHWpdH3iR%2FKX%2F8pVKEFaJMLw1rnBm6E6JLLUgtjwfe4jGNvpmZyhwiSAgtMPcbhoDQZSzC2D3n"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088dd969c332593-MIA
alt-svc
h3=":443"; ma=86400
jquery-ui.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
31 KB
8 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/jquery-ui.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca4df2bf400a42d8752e115f03366a90b2b4ed06b2da9ef429d41fda5f15705e

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"7d52-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yYCX0OO7Yrv83Vpdx7LEbqiw6ebESThLdj0XN%2Bs8g176c3S%2BHDapH0Eyn9a0R3V9IbBVM%2FSS7pmsFhSsCFKFW67enxy23o1rTka7rRBMVrIQDX%2FC%2FYKUeFgtWYjAB%2BMiKAyBBk8aUeCbcmQP6U879H5TG8PoSDhGavmO7svbqJsGPowNsK5YclN2FvNXLMelU4qbtbGlI4g%2FjpFy0cCTMu7Is9rDijkI8ALP"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088dd969c362593-MIA
alt-svc
h3=":443"; ma=86400
irs.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
6 KB
2 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/irs.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c091629a45d384695d3aa0fcea2210eab8edff323d8ecbf81e3a04fda820d7f4

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"16ae-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xFD7YxA9syA%2Fn%2BviPB0Z3X05UE23vskUgdD9%2FoxfnEcIl3G051NSRB5VgnE4zErpSr1Ty2A0BpUUopU3GWOaC6LWXXe5Moj%2FMfTUUQ4%2BLw9p2QyzkknSBkO4HJp0HtoNK0H4Q6gjdRrM5OC2gvuKUL1TCo4HBLnNnAbverWwg%2Bp0lqXwflJoUmA4E6zJ983C3BRRVo%2BA%2B0lUYc552B9QfUUX%2BMY3B%2FwQFWLc"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088dd969c392593-MIA
alt-svc
h3=":443"; ma=86400
app.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
9 KB
3 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4b254c69add59c9263fc046268904bcb604aaef26626ad2dd7ba2f9b2965f52

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:04 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"2467-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LiOda%2Fym5LgAYZAunE2kXsgDHFpXrl8u0SkjZOKVTD%2FL9B26dgKueWM%2FGCShQA6Cw4%2FpivyW3mJmLHFUrfteQ4IBgeY2OAx%2B8ha744CsdWvfe1h24v%2Fk%2FyQqqkZFPRAPAFLhHmAvlTQxKh%2BuWDiz3wT7Uh5h%2FtT1YVIcc2kkVSWwWGuqvjRi%2B6%2Bt508k8f%2Br598xYYKcYONRbIjggNZ6mFx4Fn13G%2FRpdOjx"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088dd969c3b2593-MIA
alt-svc
h3=":443"; ma=86400
app-error.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
786 B
658 B
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app-error.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4abb35ccb93590308661b4dafacfe380c89aef07e2d94499d23f1637137bd1c

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"312-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4znaokA6H7GrltVN0cbxNaTajIY%2BjjzZVHvLgn7koo%2BAABzzQ%2BoJVDINTdL%2FESSxeli1PFq41BYKKaqtPzF%2F8fNHNgJDo5IH0a50tYyV9XhHy7FMAyGj44a8lnoZpiC19VhgO00jXdaZN5u4koGebJ0zjObIDj%2FMMF91B7TZWhZ0WVZQvOtLJZKPyF5AXllfUUSlrmTUxJHq2ZweMlrfX%2F%2BIk8nnlGZ%2FYYnM"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088dd969c3c2593-MIA
alt-svc
h3=":443"; ma=86400
wmsp-shared-secrets.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
3 KB
1 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/wmsp-shared-secrets.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd8245e841b019e192658b02f6d510112f6793dace36c4b29cc44ab2ab6179cd

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"cb8-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LCVVyx3TskdBytlgtmd3oBX6ClpZ%2FPTrty3AClSgURRpDysDkS9lO%2FZ4aXLucuO5lxP4wnK3rYjpQ4yR1KUj%2B2Uk%2ByKVW8FnhfZbRtCjKy1y5nRPNy8w2Zk4KOqgyeLGQ%2FEKZ2TsLwvqJGgwq1jWY%2F%2FRp15VyAiHNJf0xCHQRNBgC%2FudzzXhfY0qrLczJ%2B3F6Y%2B5mPEw2LaO81RJ%2BoGiE1P0Vx%2BGYOEvkylo"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088dd969c3e2593-MIA
alt-svc
h3=":443"; ma=86400
wmsp-results.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
2 KB
946 B
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/wmsp-results.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c270883773a53da36d154ea13ce8ea8451489c25aabd20e60ef6eb65c4fe439d

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"673-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3KJBR6OlAORDF%2B6ql4MMSSw%2B1VYNOiOksJX1m6EaM5Ink4TRo5iIQRIG3c6BRqbRckpYeG4DOx8HH1hpKltu2%2FsfJsrDLpWTrNa7Qkq6S2MYmJ3oNNOlOZw1Q2prugtGsK0q6ObU8T9DsAqKaewoYRtqXw%2F6jChT%2F1Xy27WToT5LxS%2FjHKcbqzS8zSmcycDSIRNvKuPxs4Ps2zJaebOd0ZFT%2BSTeYILjO6P4"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088dd969c3f2593-MIA
alt-svc
h3=":443"; ma=86400
datepicker.css
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
21 KB
3 KB
Stylesheet
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/datepicker.css
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2538e625a9042c2cd54e13cf52221fce1831dd12c5ca4cdac23137ac22e3010

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"52fc-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TbFT7OYi%2BBW9p4WUA9RB4UEQlAZGKCY1YphI4PaxHNOCKFPKllEyArltO7I0LRXjqjrZaC7qjUiivcEO3InOi6OasxzpqBBHMrW0faAykh7nJC%2BOjEYdQN5fOlzqbBLqM9W%2Ff0IpIzxkjcM7Bsp5lCc2WuaUJ0Vzwzz8U12ymW0zs26hL8c65nVc%2FitIrACHl%2FclkzwBP8ulMvKmyNhnNmOqDsdkhb3tuMGR"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088dd969c402593-MIA
alt-svc
h3=":443"; ma=86400
logo.png
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
5 KB
5 KB
Image
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/logo.png
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02ceea374fce34ce8272bb17a67fd862c8ff49eeb05938154570701ca7a62ea7

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:03 GMT
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"1220-5e0f61f399f80"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qhU3hwd1kDEuZDKm4Fpcsupoi1i8jYecI3m84TbRglCHy31MfBzxVmAdShsm%2BPqbcHu0Jkxs%2BEpLYupOWuCqtsnzCrSe%2F5JLuLXELOnPlmU808gyS7OWwWIzoOR59eOPQdsqaVKkuk5FHBNo2uRxS3ITZz%2FTKFbSQYUJIVe5L%2FzUguD6pA7I7442wec4p0d8XwmdgoFtCpNW28%2BhQ9s66VWmd%2FgeHWQMMF4t"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8088dd991dc32275-MIA
alt-svc
h3=":443"; ma=86400
content-length
4640
irs_horiz_white.png
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
1 KB
2 KB
Image
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/irs_horiz_white.png
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d3238bdb8ee9440978b31fadb2af34965dca58b179a1225e13316d4c6cfd5e8

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:04 GMT
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"5da-5e0f61f399f80"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cbvMMC3PI99SPaFJasKaKzqz3K1%2BqWjRmBxKg%2B8NBWdfDa4qr7354AWoGagapE%2Fc8qFEOVflOt%2BVMHrKGYuNMT4t36mmkbfpZiSdDn%2BP%2FrSm5Ama7oVkvFJy8f3JiySV%2Bh%2B2Ww6Rur7NGKOLKbMBtYkdt5T9JvHNLOrfN86OC9Xu4DaEW1rDtiD4jfV9Vd3xmenufLTljZ2Y2D7qEehPa9SBgZbY%2FO5LEQyQ"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8088dd9abf002275-MIA
alt-svc
h3=":443"; ma=86400
content-length
1498
saved_resource.htm
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/ Frame A761
313 B
683 B
Document
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/saved_resource.htm
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6afaa120b93af4f452d55328c8a2e686ab93ef0e4baa5b049a808d471cb7781f

Request headers

Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8088dd9f99442275-MIA
content-encoding
br
content-type
text/html
date
Mon, 18 Sep 2023 10:22:04 GMT
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l4rEYJFIcHRuHLrFJZ5KcarFh%2Br3TCCJl1Rse7TOB19lGL0aqNzj3%2B78A%2BGoGw48dW4m1eY%2Fex9Tpc3BGKyWgGp2eID8%2FlXQaw7qwZ4YSENXOr%2FMoQAUIf418%2B7WRnDuyBrlFQeMBrle8lAuiF1NNomz0XbFV%2BloKlcdVmdXW6KqQIhLYx%2FLbUxPF8ZQTUcuWaQm4u7EMui8BD6ghzUMR9IvSL5ES1s5bbRz"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
swirl_lighter_ca6f4deb.png
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/images/
338 B
338 B
Image
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/images/swirl_lighter_ca6f4deb.png
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d09f716f04a85c7266d35d1b3533e239ec979d2a47228d0ac50bab3e693152cd

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:04 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yaDg61crEJOpqo%2FjazPgjVwHLi0DWshQF%2F7TP%2FrYFx8WtWDGMQnsZ44UJZFxOEctcCKRDHUSWu2OqJwwfiXiGKXhDlepWG%2BZudFlTgDhFK%2F8yvkcGO1o7CHE6YBfejHtIWhGHW9qyCQFjsZjwa9VhFl2YcfSOVDQeexiLFsisbjT%2BuSqz5FT7ZSxHsbCLwyoPnCvwowMVCUiS87wkOJf8EsTC4cFpfg0evoM"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
8088dd9eb8cd2275-MIA
alt-svc
h3=":443"; ma=86400
us.png
irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/assets/img/
338 B
338 B
Image
General
Full URL
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/assets/img/us.png
Requested by
Host: irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com
URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d09f716f04a85c7266d35d1b3533e239ec979d2a47228d0ac50bab3e693152cd

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:22:04 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MBL13MoWBpLz2JrMp6k72c9zoA0RblCgGpxPruuhPiblW%2F0J5a4osBdiaB%2BLgawwFc8vxf%2F5CenvZKKo%2B2vjftRJf8uPd4IF4uDmn2KF3YVEYH96zinffxVdaB57J5Ym6YYuFOnkL9%2BDqz3JTUT7HgF6KkgIHznUvQi81ZIP08mUcXpTdlHYAxSpjyUAAqY6F7J8ZXnPg8ssB5AthwEy2VzCi9UQF41W3L4k"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
8088dd9eb8cf2275-MIA
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| noBack string| message function| clickIE function| clickNS function| disableCtrlKeyCombination

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/assets/img/us.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://irs_returns_taxtopics-irfofgetstatus_tc1203help-6503c5549e07f.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/images/swirl_lighter_ca6f4deb.png
Message:
Failed to load resource: the server responded with a status of 404 ()