irs-g0v.org Open in urlscan Pro
104.37.185.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://irs-g0v.org/coronavirus/notice/pre-qualify.html
Submission: On June 07 via automatic, source phishtank (June 7th 2021, 5:34:49 pm UTC)

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 22 HTTP transactions. The main IP is 104.37.185.188, located in United States and belongs to IS-AS-1, US. The main domain is irs-g0v.org.

This is the only time irs-g0v.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

	IP Address		AS Autonomous System
22	104.37.185.188 104.37.185.188		19318 (IS-AS-1) (IS-AS-1)
22	1

22 104.37.185.188 (United States)

ASN19318 (IS-AS-1, US)
PTR: sagait.se

irs-g0v.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	irs-g0v.org irs-g0v.org	219 KB
22	1

	Domain	Requested by
22	irs-g0v.org	irs-g0v.org
22	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://irs-g0v.org/coronavirus/notice/pre-qualify.html
Frame ID: 98EA57460650F054B45AB63BA2D6AE64
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /([\d.]+)\/jquery-ui(?:\.min)?\.js/i
script /jquery-ui.*\.js/i

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /([\d.]+)\/jquery-ui(?:\.min)?\.js/i
script /jquery-ui.*\.js/i

Page Statistics

22
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

219 kB
Transfer

730 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request pre-qualify.html Show response irs-g0v.org/coronavirus/notice/	34 KB 8 KB	261ms 159ms	Document text/html	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `b827245122962de901ebdd45143d9173e0d4d2cb1d06384542dc89f9953d0c59` Request headers Host irs-g0v.org Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html Last-Modified Mon, 07 Jun 2021 07:31:07 GMT Accept-Ranges bytes Content-Encoding gzip Vary Accept-Encoding Content-Length 7946 Date Mon, 07 Jun 2021 17:34:30 GMT Server LiteSpeed
GET H/1.1	200 OK	bootstrap.min.css irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/bootstrap/4.3.1/css/	152 KB 30 KB	89ms 87ms	Stylesheet text/css	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/bootstrap/4.3.1/css/bootstrap.min.css Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 30576 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	jquery-ui.min.css irs-g0v.org/coronavirus/notice/irfof-wmsp/commons-web/jquery-ui/1.12.1/	31 KB 9 KB	174ms 158ms	Stylesheet text/css	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/commons-web/jquery-ui/1.12.1/jquery-ui.min.css Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `ca4df2bf400a42d8752e115f03366a90b2b4ed06b2da9ef429d41fda5f15705e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 8966 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	irs.css irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/	6 KB 2 KB	176ms 159ms	Stylesheet text/css	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/irs.css Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `c091629a45d384695d3aa0fcea2210eab8edff323d8ecbf81e3a04fda820d7f4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 1377 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	app.css irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/	9 KB 3 KB	175ms 159ms	Stylesheet text/css	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/app.css Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `6a0dbb9485d38d76fbf95da6eaf4ab2a401fce1b133ca1ba25f53d479361636e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 2813 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	app-error.css irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/	786 B 673 B	176ms 160ms	Stylesheet text/css	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/app-error.css Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `c4abb35ccb93590308661b4dafacfe380c89aef07e2d94499d23f1637137bd1c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 335 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	jquery.min.js Show response irs-g0v.org/coronavirus/notice/irfof-wmsp/commons-web/jquery/3.4.1/	86 KB 34 KB	271ms 95ms	Script application/javascript	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/commons-web/jquery/3.4.1/jquery.min.js Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `412b8ff9c5ab32b9019fcd84bcd4a54c0e265a14528474f4ee45b27a20abeaeb` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 34513 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	jquery-ui.min.js Show response irs-g0v.org/coronavirus/notice/irfof-wmsp/commons-web/jquery-ui/1.12.1/	248 KB 79 KB	263ms 87ms	Script application/javascript	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/commons-web/jquery-ui/1.12.1/jquery-ui.min.js Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `21cacca8e9eb98f1f32702b4176685f2f941af51ab5bc7cf88ccb5435a1bb080` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 80944 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	bootstrap.min.js Show response irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/bootstrap/4.3.1/js/	57 KB 18 KB	271ms 95ms	Script application/javascript	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/bootstrap/4.3.1/js/bootstrap.min.js Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 18234 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	wmsp-shared-secrets.css irs-g0v.org/coronavirus/notice/irfof-wmsp/resources/css/	3 KB 1 KB	175ms 159ms	Stylesheet text/css	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/resources/css/wmsp-shared-secrets.css Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `fd8245e841b019e192658b02f6d510112f6793dace36c4b29cc44ab2ab6179cd` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 1070 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	wmsp-results.css irs-g0v.org/coronavirus/notice/irfof-wmsp/resources/css/	2 KB 987 B	252ms 87ms	Stylesheet text/css	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/resources/css/wmsp-results.css Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `c270883773a53da36d154ea13ce8ea8451489c25aabd20e60ef6eb65c4fe439d` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 649 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	datepicker.css irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/	21 KB 3 KB	262ms 87ms	Stylesheet text/css	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/datepicker.css Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `a2538e625a9042c2cd54e13cf52221fce1831dd12c5ca4cdac23137ac22e3010` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 3069 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	datepicker.min.js Show response irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/js/	65 KB 15 KB	273ms 87ms	Script application/javascript	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/js/datepicker.min.js Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `a748fcb2daa203193c8bb7ea224129387050ff6a29948782123d787590ba0dcb` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 15208 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	flag.png irs-g0v.org/coronavirus/	1 KB 1 KB	88ms 87ms	Image image/png	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://irs-g0v.org/coronavirus/flag.png Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `eec824337d7649bfcb3fa2463eb4130ff199531e1ba67d9b9f77ad32d492b950` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 1112 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	logo.png irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/images/	5 KB 5 KB	86ms 86ms	Image image/png	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/images/logo.png Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `02ceea374fce34ce8272bb17a67fd862c8ff49eeb05938154570701ca7a62ea7` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 4640 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	irs_horiz_white.png irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/images/	1 KB 2 KB	87ms 87ms	Image image/png	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/images/irs_horiz_white.png Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `5d3238bdb8ee9440978b31fadb2af34965dca58b179a1225e13316d4c6cfd5e8` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 1498 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	200 OK	expire.js Show response irs-g0v.org/coronavirus/notice/irfof-wmsp/commons-web/expire/2.0.0/	4 KB 2 KB	87ms 87ms	Script application/javascript	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/commons-web/expire/2.0.0/expire.js Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `e4f9a6f70ff0aa55d627a25d309b1248626c7a4432018e8f45f5701f464eb60b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Content-Encoding gzip Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 1445 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	404 Not Found	a05a9dd08no22348569aada632df3ba irs-g0v.org/coronavirus/notice/clientlibs/	0 0	88ms 87ms	Script text/html	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/clientlibs/a05a9dd08no22348569aada632df3ba Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/pre-qualify.html Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/pre-qualify.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Mon, 07 Jun 2021 17:34:30 GMT Cache-Control private, no-cache, no-store, must-revalidate, max-age=0 Server LiteSpeed Connection Keep-Alive Content-Length 1238 Content-Type text/html
GET H/1.1	200 OK	swirl_lighter_ca6f4deb.png irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/images/	3 KB 3 KB	87ms 87ms	Image image/png	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/images/swirl_lighter_ca6f4deb.png Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/app.css Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `38b7fc07e4f8cc1131e71cff42b57c41ffc67e9700f471b38bae701fec8c1810` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/app.css Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/app.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 07 Jun 2021 17:34:30 GMT Last-Modified Mon, 07 Jun 2021 07:31:06 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 2975 Expires Mon, 14 Jun 2021 17:34:30 GMT
GET H/1.1	404 Not Found	us-flag_b22a832d.png irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/images/	1 KB 1 KB	87ms 87ms	Image text/html	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/images/us-flag_b22a832d.png Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/app.css Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash `5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/app.css Connection keep-alive Cache-Control no-cache Referer http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/app.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Mon, 07 Jun 2021 17:34:30 GMT Cache-Control private, no-cache, no-store, must-revalidate, max-age=0 Server LiteSpeed Connection Keep-Alive Content-Length 1238 Content-Type text/html
GET H/1.1	404 Not Found	ac93c75f139d8d6cf03fd24ddcc996ce.woff2 irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/fonts/	0 0	99ms 88ms	Font text/html	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/fonts/ac93c75f139d8d6cf03fd24ddcc996ce.woff2 Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/irs.css Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash Request headers Pragma no-cache Origin http://irs-g0v.org Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/irs.css Connection keep-alive Cache-Control no-cache Origin http://irs-g0v.org Referer http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/irs.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Mon, 07 Jun 2021 17:34:31 GMT Cache-Control private, no-cache, no-store, must-revalidate, max-age=0 Server LiteSpeed Connection Keep-Alive Content-Length 1238 Content-Type text/html
GET H/1.1	404 Not Found	939d9f66e993332d8def74508fe62a33.woff irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/fonts/	0 0	87ms 87ms	Font text/html	104.37.185.188 IS-AS-1
General Check archive.org Show headers Download Go to Full URL http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/fonts/939d9f66e993332d8def74508fe62a33.woff Requested by Host: irs-g0v.org URL: http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/irs.css Protocol HTTP/1.1 Server 104.37.185.188 , United States, ASN19318 (IS-AS-1, US), Reverse DNS sagait.se Software LiteSpeed / Resource Hash Request headers Pragma no-cache Origin http://irs-g0v.org Accept-Encoding gzip, deflate Host irs-g0v.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/irs.css Connection keep-alive Cache-Control no-cache Origin http://irs-g0v.org Referer http://irs-g0v.org/coronavirus/notice/irfof-wmsp/webjars/css/irs.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Mon, 07 Jun 2021 17:34:31 GMT Cache-Control private, no-cache, no-store, must-revalidate, max-age=0 Server LiteSpeed Connection Keep-Alive Content-Length 1238 Content-Type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

irs-g0v.org
104.37.185.188
02ceea374fce34ce8272bb17a67fd862c8ff49eeb05938154570701ca7a62ea7
0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
21cacca8e9eb98f1f32702b4176685f2f941af51ab5bc7cf88ccb5435a1bb080
38b7fc07e4f8cc1131e71cff42b57c41ffc67e9700f471b38bae701fec8c1810
412b8ff9c5ab32b9019fcd84bcd4a54c0e265a14528474f4ee45b27a20abeaeb
5d3238bdb8ee9440978b31fadb2af34965dca58b179a1225e13316d4c6cfd5e8
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
6a0dbb9485d38d76fbf95da6eaf4ab2a401fce1b133ca1ba25f53d479361636e
a2538e625a9042c2cd54e13cf52221fce1831dd12c5ca4cdac23137ac22e3010
a748fcb2daa203193c8bb7ea224129387050ff6a29948782123d787590ba0dcb
b827245122962de901ebdd45143d9173e0d4d2cb1d06384542dc89f9953d0c59
c091629a45d384695d3aa0fcea2210eab8edff323d8ecbf81e3a04fda820d7f4
c270883773a53da36d154ea13ce8ea8451489c25aabd20e60ef6eb65c4fe439d
c4abb35ccb93590308661b4dafacfe380c89aef07e2d94499d23f1637137bd1c
ca4df2bf400a42d8752e115f03366a90b2b4ed06b2da9ef429d41fda5f15705e
e4f9a6f70ff0aa55d627a25d309b1248626c7a4432018e8f45f5701f464eb60b
eec824337d7649bfcb3fa2463eb4130ff199531e1ba67d9b9f77ad32d492b950
fd8245e841b019e192658b02f6d510112f6793dace36c4b29cc44ab2ab6179cd

irs-g0v.org Open in urlscan Pro 104.37.185.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

22 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

219 kBTransfer

730 kBSize

0 Cookies

0 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

0 Cookies

Indicators

irs-g0v.org Open in urlscan Pro
104.37.185.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

219 kB
Transfer

730 kB
Size

0
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!