www.npacnfnccps.eu
Open in
urlscan Pro
79.137.39.96
Malicious Activity!
Public Scan
Submission: On January 08 via automatic, source openphish
Summary
This is the only time www.npacnfnccps.eu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: IRS (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 79.137.39.96 79.137.39.96 | 16276 (OVH) (OVH) | |
9 | 2600:1400:a:1... 2600:1400:a:198::12d8 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
11 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
irs.gov
la2.alt.www4.irs.gov |
|
2 |
npacnfnccps.eu
www.npacnfnccps.eu |
|
11 | 2 |
Domain | Requested by | |
---|---|---|
9 | la2.alt.www4.irs.gov |
www.npacnfnccps.eu
|
2 | www.npacnfnccps.eu |
www.npacnfnccps.eu
|
11 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.irs.gov |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://www.npacnfnccps.eu/irs/
Frame ID: (3129F54DFA78C3A2FC04A465A2360010)
Requests: 11 HTTP requests in this frame
3 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: e-Services Privacy Policy
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
www.npacnfnccps.eu/irs/ |
12 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
irs-gov_dev.css
la2.alt.www4.irs.gov/irs/cda/common/commonStyleSheet/ |
11 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
navigation-gecko.css
la2.alt.www4.irs.gov/irs/cda/common/styleSheets/ |
3 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles-gecko.css
la2.alt.www4.irs.gov/irs/cda/common/styleSheets/ |
10 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_styles.css
la2.alt.www4.irs.gov/irs/cda/common/styleSheets/ |
3 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
la2.alt.www4.irs.gov/irs/cda/common/images/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Error-Icon.gif
la2.alt.www4.irs.gov/irs/cda/common/images/ |
631 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
button_login.jpg
la2.alt.www4.irs.gov/irs/cda/common/images/ |
4 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
button_register.jpg
la2.alt.www4.irs.gov/irs/cda/common/images/ |
5 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blank.gif
www.npacnfnccps.eu/irs/cda/common/images/ |
348 B 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bgBody.png
la2.alt.www4.irs.gov/irs/cda/common/images/ |
361 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: IRS (Government)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onafterprint object| onbeforeprint function| setDivHeight function| getCookieVal function| GetCookie function| returnWin string| eservFrameCookie object| c undefined| selfLocation function| setMyCookie function| checkForm0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
la2.alt.www4.irs.gov
www.npacnfnccps.eu
2600:1400:a:198::12d8
79.137.39.96
2b6212b217be7145dadb4ac68fcb55dbbab40d764e1b8de3ec083c8f758d4bee
61383a504d8be3a57952af03d28ee235c3a4e0732d9c46da6218445e64130b4e
91a7dae545c53af1df87fee0140dfb06d9b57fda7d7d11c381d62d9e5bfd85a7
a8014d94766e633e50aa83c5dd7786763c075a44b6bfb37721be8f42fe100d5b
b831fccf6dfafa26d4eb3d51369ed026b733dbfd7850217b15511e1266d96115
b8b224829e394224cc386f9c3f6e644cefbbce3c774eea683564ab8c050b37cf
bdc0fedc2c6186ea5f706dabce79c4cf936bd64986b46c96693b10cbb872b633
cb3a03e8eaaaee9d33e562213bd2a4dcb6b9fcea3467c1f29ade759a32c48109
f0daae5aaadfc00f3a6fa525ee39b0d047c508bd28d0edfce9a669c57eaadcfa
f744b12f98c587935973a925ebf44557a63a52032bbbf9c79d181d5c63520837
ff79949531fab53a64b533b44933432c0d707402a2e20ca1e3a4ee5b029010f5