irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com Open in urlscan Pro
2606:4700:3036::ac43:a1ce  Malicious Activity! Public Scan

URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Submission: On September 18 via api from US — Scanned from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3036::ac43:a1ce, located in United States and belongs to CLOUDFLARENET, US. The main domain is irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com.
TLS certificate: Issued by GTS CA 1P5 on August 16th 2023. Valid for: 3 months.
This is the only time irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

IP Address AS Autonomous System
14 2606:4700:303... 13335 (CLOUDFLAR...)
14 1
Domain Requested by
14 irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
14 1

This site contains no links.

Subject Issuer Validity Valid
blottedinq.com
GTS CA 1P5
2023-08-16 -
2023-11-14
3 months crt.sh

This page contains 2 frames:

Primary Page: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Frame ID: B714508B034FCDB22D699ADA90D0CFE2
Requests: 13 HTTP requests in this frame

Frame: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/saved_resource.htm
Frame ID: 65B78E33B662276BFEEFE5D599128206
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Get Refund Status

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

55 kB
Transfer

244 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request home.html
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/
12 KB
4 KB
Document
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad2f435f42c01c935af717382851192b5d51ff23b18ca31ee19bf605a01f3446

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8088d7cdeeda4bcf-BUF
content-encoding
br
content-type
text/html
date
Mon, 18 Sep 2023 10:18:06 GMT
last-modified
Tue, 25 Apr 2023 15:40:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2ZL1S4rGBv9NWsTcUOhCdbOfjG7MpALCUZAFIRY%2FdPRSVZ%2FKaPkkmhEhSvju1uhcMxna5D%2FM8aMavkOcigrH0Vn%2FYL9Klyf%2BxA29iZ7qtmMqyOT08ihJ7Wiap1AsNh42frZmssODBeV5FYi4dZvuglRAFSfb1dn8t8d4K3G9sqqpv9p1Ws%2FWkCBf6zUTr1zOhBUxFNR3s6kcbg7ldLdMpueLb%2FhB0NdCaHw%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
bootstrap.css
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
152 KB
24 KB
Stylesheet
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/bootstrap.css
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"2606e-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=he6hCv1YrqzZulqoXyQLyCr1Xf9LbvuSZ%2F3iGFOqsKNnVe4MN5fS2Iz0kh4ApkZeOXd6V%2BNXeRXfMfrbIzIcRtdq9wsb1%2FSWn70Fv8OKGevUDoltdgYjl%2BuX0wIYW2yL00g8sFIujmevbw96MJkuRMe48n1Irgq%2BTtq2%2FZLJ3YJlGM4M9k7EuLUdgxDMLhSTzqbH%2FgabhZeGBUBJiB8cR%2BAJ%2FcYEylRfbBg%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088d7cebee14bcf-BUF
alt-svc
h3=":443"; ma=86400
jquery-ui.css
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
31 KB
8 KB
Stylesheet
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/jquery-ui.css
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca4df2bf400a42d8752e115f03366a90b2b4ed06b2da9ef429d41fda5f15705e

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:07 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"7d52-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TFYNHWFNGgznkZcTZW6h%2B%2BK861eBGz753FW3ZyerxLzDeYQKAVh0NmVuYC4%2F9Ta7tP7vUJsudt7G9YDko%2B5Vxo1Hwsh847VkYCTzSg9oPbifJ3eyJfI9SoEhRGboB%2BLenni2lqIMROhdSLngOg15CCqoDn7moIz3MTPze3ENeiwFW6VPTrL7kE%2BCRayigo%2B%2Fs1xEtG6SKt3gcNnrNHSW9NvRKZG6rEXCMVM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088d7cebee24bcf-BUF
alt-svc
h3=":443"; ma=86400
irs.css
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
6 KB
2 KB
Stylesheet
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/irs.css
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c091629a45d384695d3aa0fcea2210eab8edff323d8ecbf81e3a04fda820d7f4

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"16ae-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ysZ2bd0PvpR86FuNnkAurc6r92DrFWHkV7ZbPSeokgv4LpxpnECDcFcgzvnLnkWMeITA6%2FhR%2Bot6QzwaeWkNyhutOuh64ZXW1Gl0idtmGQM2gS24Y29%2Bmai0q7Sb7MGaAAzMlZzuOm%2Fo%2Bgf6OEoVkXVN2pWb%2FOklEKModoaC2NP41Vo49HWgnjTFsC3xETsQ1RwNLm7TZEQBQd1bIVoABKgfjjDM89J0CCE%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088d7cebee34bcf-BUF
alt-svc
h3=":443"; ma=86400
app.css
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
9 KB
3 KB
Stylesheet
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4b254c69add59c9263fc046268904bcb604aaef26626ad2dd7ba2f9b2965f52

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"2467-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5IQjo3N%2B0dP6Z%2BXXFIxrTYdmIXFjSTKMBYyuVE%2FgZgdURE%2F9%2BfUkh%2FRUK9Jy8SiW4fpAzqJmmXhpiVz2kRqMf46BBZuDwGEQFKXmv2f%2BGpSwLtHrwrNEpbm9M4%2FBau7gz45arMU7rTIMSs6JNpU4Agshv6MWNEAtuZ8RFIY75f7jvAc5a3ActY8AuE2tOWSfbnAZc8tycz3VosZ%2B67%2B7z1LOytmXre7w17E%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088d7cebee44bcf-BUF
alt-svc
h3=":443"; ma=86400
app-error.css
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
786 B
658 B
Stylesheet
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app-error.css
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4abb35ccb93590308661b4dafacfe380c89aef07e2d94499d23f1637137bd1c

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"312-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tFtrsrtrNP%2B7AO6Qj5Sl28PDy7QSRPT5%2BkyEPyenBP4AamLQt3ICXFwSTqruYfiEkZelhT8SV6wcKzp8GOvyvEjfkl8n%2FLl0rn2UD9%2FDcwVFDK4IPc6W%2B6AEjVW9DB63JbdJc3SoeVJ2%2BFHkwaTSuJNPZThxPfYMIZjj%2B0dwCbLl6ugnobyrd0Ssf3M6iprXhM%2BYt4mx9Espr4MZl%2Fx9xbr3q915rkdCxg8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088d7cebee54bcf-BUF
alt-svc
h3=":443"; ma=86400
wmsp-shared-secrets.css
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
3 KB
1 KB
Stylesheet
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/wmsp-shared-secrets.css
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd8245e841b019e192658b02f6d510112f6793dace36c4b29cc44ab2ab6179cd

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:07 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"cb8-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TfsbWYrV1JES90qYZN%2FHttQJT8DV6z9WRL1EiaCFWo76C3%2FJ8eiCFFZ0Uy%2BxSb6R0YSPRfchZTxSGfpzovQUnHwdAFXEoqPOe1govX3LmfSA2hBhQpDo7YE%2FgFUGqp0B1zSIAFmnFcKF%2Bb7vel5xPV2YVfKhYXFG8Bytnc%2BsNLkObgB07I7ZSwZ5LyNLYTXAR%2Bm6HxOyQ%2FgvQNIKC%2FBrQZjf4yt2yfNo1y0%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088d7cebee64bcf-BUF
alt-svc
h3=":443"; ma=86400
wmsp-results.css
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
2 KB
992 B
Stylesheet
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/wmsp-results.css
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c270883773a53da36d154ea13ce8ea8451489c25aabd20e60ef6eb65c4fe439d

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"673-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lMNPW60FUnMSmIn1bX9VUz3cx4TD8yzh%2FLn2vYYT1Hoavvihx1BOpp5J7Q%2F9fCt29KtnXbvSKZv%2BK8J4%2FBTlE4LbA0wALEEGiTxUarBhac9P7Kiasn9sf42lb%2FkG6oryJ5mkyh8by7HDlh4wKlTZhFoDGvyDqFZhIMs%2BjVqpfuTOJYKwhwCDFqaBoQfi9G4lVENF0n1csjqClqRj4tPqBoO10CGcZdh7ME%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088d7cebee74bcf-BUF
alt-svc
h3=":443"; ma=86400
datepicker.css
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
21 KB
3 KB
Stylesheet
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/datepicker.css
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2538e625a9042c2cd54e13cf52221fce1831dd12c5ca4cdac23137ac22e3010

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"52fc-5e0f61f399f80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6dKBkUEgd9W%2F4kXk0cTZYfDaV7LjN6R1lybA7B5wmlL%2FP71nYIXl5MOeKPB29rYgz%2FtZEQD8BjzpDaUqSQwXQKKcXktfa5epbaL4gMEte0XE%2BckyzBjEFXiIoZ8yNxDibU8FSvXWvHgGNrWI5OJtvtdc3wajplODLl76bO6K4%2BrugJIuTVPghHKDr2e7dnyGeMqfhEUPBgW%2FQSAOBZaWu9LXTjyQDkkQ7Ys%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8088d7cebee84bcf-BUF
alt-svc
h3=":443"; ma=86400
logo.png
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
5 KB
5 KB
Image
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/logo.png
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02ceea374fce34ce8272bb17a67fd862c8ff49eeb05938154570701ca7a62ea7

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:07 GMT
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"1220-5e0f61f399f80"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RIzZ6J%2B%2BUur2zFI2ELdEBnUYUyTcah2wcbeTIMKI1YKTnVPvRdL%2F4HbkrEWxHQ8tkKxUBAMwmOmLe%2BkVaMp%2BwyBnmqi2J6lGlLSzUgb2O5XCOyygQB37p89%2Bz7xH02a7Nvmhr8kmJN0EaADRw%2BkgFYJUmSIKmxbFlovBYpGDyZl9IH6babDey8q%2BEliB8EhbDW1jdTyCj7NvJSocBoGpN7%2BxCyBow51Afy8%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8088d7d37aab4bd2-BUF
alt-svc
h3=":443"; ma=86400
content-length
4640
irs_horiz_white.png
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/
1 KB
2 KB
Image
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/irs_horiz_white.png
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d3238bdb8ee9440978b31fadb2af34965dca58b179a1225e13316d4c6cfd5e8

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:07 GMT
cf-cache-status
MISS
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"5da-5e0f61f399f80"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K72kZUca2hQUws8IU2LVBS9copmMQcDBvKIo6WSIQEdgqfAmcqkRTvQY%2FcXe6Cj5xZxL0tM3p0SQgiAU8XDWaQDMM%2Bw%2FPu9BTUFkET2IyGNkQHnNngUvble4UpOmeqmi3weaJxDsAqq%2F8AtrANYOxGscTqwA4sDuBkUugG872Fecl7eUgXg6IV%2Fzo2pPQ6bEoTN5PbCiF1i8CNG9fQQzufqpuy2flW4T4xk%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8088d7d44aae4bd2-BUF
alt-svc
h3=":443"; ma=86400
content-length
1498
saved_resource.htm
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/ Frame 65B7
313 B
675 B
Document
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/saved_resource.htm
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6afaa120b93af4f452d55328c8a2e686ab93ef0e4baa5b049a808d471cb7781f

Request headers

Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home.html?resource_url=https
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8088d7d62abe4bd2-BUF
content-encoding
br
content-type
text/html
date
Mon, 18 Sep 2023 10:18:07 GMT
last-modified
Wed, 08 Jun 2022 21:09:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e5UDaFioSj2VEhEGVjTqcfwwfyriuzsl4xo3agw1idExaJEvHsUxXA%2FisBAMB77XuYErfX67508Yo0FHiEdeQyxnvV6rjNVtW7baXuLnkXtnEA1NvO9zRglQZWgvcxq9VZAdRnKOf3PECgfIW5oM0mkCZ1ZRXPr6qkSCCInmvtAezqGTshMVqHfHn1NULnKidYfkZjsnwMecZKL0wvBlfdV%2BA1yB8PgIVw0%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
swirl_lighter_ca6f4deb.png
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/images/
337 B
337 B
Image
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/images/swirl_lighter_ca6f4deb.png
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96c6e836859834c77051e3301f3e05884e64cbce5139ca4a6c841072bb255065

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:07 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h%2Bv0PfPy%2BeSqVWBlDqr%2FrjRV593JVIBKJBhKCJwhnfTNlv2Vg2VRLg%2FwtsWa5Z1ZzQeoC4p795n%2FgHMfOv466jOM0gwa3mefc%2FRdM0UKjpJLqGVPP1tATQUJoIRm7nkJFxQJYarFALiAJyqVdYhTZQmp%2FWshrDF9M0z52fKAATxR3%2Ff9LRSEg%2B9YR3sq084LoRTIl2NJuJI9%2FHcqaE3ICUQigWiBzobtRqE%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
8088d7d63ac04bd2-BUF
alt-svc
h3=":443"; ma=86400
us.png
irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/assets/img/
337 B
337 B
Image
General
Full URL
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/assets/img/us.png
Requested by
Host: irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com
URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:a1ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96c6e836859834c77051e3301f3e05884e64cbce5139ca4a6c841072bb255065

Request headers

accept-language
en-US,en;q=0.9
Referer
https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/home_files/app.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Mon, 18 Sep 2023 10:18:07 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fcsJ9nSsGsid5IbfIt4P2aJBu414Sn5fFNgCr36joXy0iAOWtw5WdrbjRX0KMXhqenFF6wi9AP2gdZzb8PisHtApP8NF0ENMdVk9ZdF%2F91ij7nR2B1vXZLUlKDli%2BiIdbCpL5xg4u7FwYp1Z%2BRCO6ffq6ZXyCdECk%2FIMisj7%2B58%2BZF83uV4tAGJzcfyCvbBYLrVip7%2BG813lh1wnSigzDbetGLQV2XaXeAQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
8088d7d63ac14bd2-BUF
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| noBack string| message function| clickIE function| clickNS function| disableCtrlKeyCombination

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/refunds-getstatus_form2_irfof-IRServlet-en_lang/images/swirl_lighter_ca6f4deb.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://irs-returns_tc1203help-taxtopic-irfofgetstatus-65036b1f7cb81.blottedinq.com/assets/img/us.png
Message:
Failed to load resource: the server responded with a status of 404 ()