sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com
Open in
urlscan Pro
81.17.132.132
Malicious Activity!
Public Scan
Submission: On July 16 via automatic, source phishtank
Summary
This is the only time sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) IRS (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 81.17.132.132 81.17.132.132 | 21437 (AVITI-AS ...) (AVITI-AS Kharkov) | |
10 | 1 |
ASN21437 (AVITI-AS Kharkov, Ukraine, UA)
PTR: cross.bigline.net
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
jayashritravels.com
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com |
54 KB |
10 | 1 |
Domain | Requested by | |
---|---|---|
10 | sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com |
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com
|
10 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.irs.gov |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/step1.html
Frame ID: 3B54E7CCAF68C1F3394357AF5A390EE4
Requests: 10 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- headers server /php\/?([\d.]+)?/i
UNIX (Operating Systems) Expand
Detected patterns
- headers server /Unix/i
OpenSSL (Web Server Extensions) Expand
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
step1.html
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/ |
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
c.js
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/ |
12 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
navigation-gecko.css
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/c/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles-gecko.css
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/c/ |
12 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icce-gecko.css
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/c/ |
14 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
irslogo.gif
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/c/ |
2 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1x1-transparent.gif
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/c/ |
43 B 372 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1x1-grey.gif
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/c/ |
43 B 372 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
red-arrow.gif
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/c/ |
184 B 514 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
top-transparent.gif
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com/IRS/images/en/ |
349 B 349 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) IRS (Government)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| Validator function| set_addnl_vfunction function| clear_all_validations function| form_submit_handler function| add_validation function| ValidationDesc function| vdesc_validate function| ValidationSet function| add_validationdesc function| vset_validate function| validateEmailv2 function| mod10 function| V2validateData object| frmvalidator0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
sa.www4.irs.gov.us.5061364415.revenue.service.jayashritravels.com
81.17.132.132
112b4d6249381eee495c7d298379c1e5516754e3608300c8ad343566bad5d172
1dff87ece820271c8983e1f861098c5344d0742b05ecba108a7ae9d5a6b8a0fa
344ce7ae9a0179e949d1daf2b1811828294ec092ebdd622a7d8f2f379e801823
3754ac8cbcec1a68eb87213d27ff04d2768beb4b9e11b934f1ca333d6a796620
66542a133de9a0b879c90265a584c5405eb8d7532c3639d696801dcf1c924e4b
984f0a18749fb1ecb93ac942a469036db3ab53bc67b5ddd05b674f2844dbdff2
b54a4ec9cf01b24a58a05122bbfb1b3a7dace9d27ee1e5de2f251e87327e868d
b7e3f5fe3264de4a77fdeddcb4d9c51b00d2f4c7b938d397c82540eedc450b37
c3c2be650f8b26f1440136df0eb1d3f7c37dfa69c77dd86cc42d8cd9013d4640
db5d64a9ea32ed3abb874f295003ef2465cecc2f669efe951930e182c34a5013