covid-stimulus.org
Open in
urlscan Pro
2606:4700:3033::ac43:a868
Malicious Activity!
Public Scan
Effective URL: https://covid-stimulus.org/
Submission: On August 07 via manual from US
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 6th 2020. Valid for: a year.
This is the only time covid-stimulus.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: IRS (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 25 | 2606:4700:303... 2606:4700:3033::ac43:a868 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:1400:d:3... 2600:1400:d:397::1301 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2a00:1450:400... 2a00:1450:4001:814::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:9000:214... 2600:9000:214f:9600:5:83ea:ba80:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
28 | 4 |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
covid-stimulus.org
1 redirects
covid-stimulus.org |
218 KB |
2 |
google-analytics.com
www.google-analytics.com |
18 KB |
1 |
digitalgov.gov
dap.digitalgov.gov |
5 KB |
1 |
irs.gov
sa.www4.irs.gov |
19 KB |
28 | 4 |
Domain | Requested by | |
---|---|---|
25 | covid-stimulus.org |
1 redirects
covid-stimulus.org
|
2 | www.google-analytics.com |
covid-stimulus.org
www.google-analytics.com |
1 | dap.digitalgov.gov |
covid-stimulus.org
|
1 | sa.www4.irs.gov |
covid-stimulus.org
|
28 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.irs.gov |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-06 - 2021-08-06 |
a year | crt.sh |
sa.www4.irs.gov Entrust Certification Authority - L1K |
2019-12-04 - 2022-03-03 |
2 years | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-07-15 - 2020-10-07 |
3 months | crt.sh |
dap.digitalgov.gov Amazon |
2019-10-30 - 2020-11-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://covid-stimulus.org/
Frame ID: 694A44E942D740C1A7AD38AA421DABB7
Requests: 28 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://covid-stimulus.org/
HTTP 301
https://covid-stimulus.org/ Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Frequently Asked Questions
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://covid-stimulus.org/
HTTP 301
https://covid-stimulus.org/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
covid-stimulus.org/ Redirect Chain
|
19 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
covid-stimulus.org/sources/ |
138 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.css
covid-stimulus.org/sources/ |
31 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
irs.css
covid-stimulus.org/sources/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
covid-stimulus.org/sources/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wmsp-shared-secrets.css
covid-stimulus.org/sources/ |
2 KB 756 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wmsp-error.css
covid-stimulus.org/sources/ |
514 B 302 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wmsp-results.css
covid-stimulus.org/sources/ |
1 KB 586 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
covid-stimulus.org/sources/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.js
covid-stimulus.org/sources/ |
248 KB 63 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
covid-stimulus.org/sources/ |
50 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
covid-stimulus.org/sources/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
calendar.svg
covid-stimulus.org/sources/ |
900 B 477 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
irs_horiz_white.png
covid-stimulus.org/sources/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-analytics.js
covid-stimulus.org/sources/ |
845 B 539 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
expire.js
covid-stimulus.org/sources/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fluidDialog.js
covid-stimulus.org/sources/ |
841 B 492 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
43aaa3011no213cdddaee5001f6afee
covid-stimulus.org/sources/ |
66 KB 66 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
swirl_lighter_ca6f4deb.png
covid-stimulus.org/images/ |
280 B 280 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
us-flag_b22a832d.png
sa.www4.irs.gov/irfof-wmsp/webjars/images/ |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
help-tip.svg
covid-stimulus.org/images/ |
280 B 280 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
45 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Universal-Federated-Analytics-Min.js
dap.digitalgov.gov/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/r/ |
35 B 146 B |
XHR
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ac93c75f139d8d6cf03fd24ddcc996ce.woff2
covid-stimulus.org/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
43aaa3011no213cdddaee5001f6afee
covid-stimulus.org/public/ |
280 B 407 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
939d9f66e993332d8def74508fe62a33.woff
covid-stimulus.org/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
43aaa3011no213cdddaee5001f6afee
covid-stimulus.org/public/ |
280 B 304 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: IRS (Government)66 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| bootstrap function| openIrsPage function| openIrsAccessibility function| openIrsPrivacyPolicy function| switchLanguage string| ga_id string| GoogleAnalyticsObject function| ga object| expireManager object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| oCONFIG function| _onEveryPage function| _defineCookieDomain function| _defineAgencyCDsValues function| _cleanBooleanParam function| _isValidUANum function| _cleanDimensionValue function| _updateConfig function| _sendCustomDimensions function| _sendCustomMetrics function| _sendEvent function| _sendPageview function| gas function| _URIHandler function| _isExcludedReferrer string| tObjectCheck function| createTracker function| _initAutoTracker undefined| videoArray_fed undefined| playerArray_fed undefined| _f33 undefined| _f66 undefined| _f90 undefined| tag undefined| firstScriptTag undefined| youtube_parser_fed undefined| IsYouTube_fed undefined| YTUrlHandler_fed undefined| _initYouTubeTracker undefined| onYouTubePlayerAPIReady undefined| onFedPlayerReady undefined| onFedPlayerStateChange function| _initIdAssigner function| _tagClicks function| _setUpTrackers function| _setUpTrackersIfReady string| _fullParams string| _keyValuePair string| _key string| _value function| logout function| sessionTimeout boolean| timeoutView boolean| logoutView function| onCollapsibleClicked function| onThereAreValidationErrors object| _cf object| _ac object| bmak string| _sd_trace function| op1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.covid-stimulus.org/ | Name: __cfduid Value: d49e77154d91a517be2dd6893463b9c731596819193 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
covid-stimulus.org
dap.digitalgov.gov
sa.www4.irs.gov
www.google-analytics.com
2600:1400:d:397::1301
2600:9000:214f:9600:5:83ea:ba80:93a1
2606:4700:3033::ac43:a868
2a00:1450:4001:814::200e
02ceea374fce34ce8272bb17a67fd862c8ff49eeb05938154570701ca7a62ea7
21cacca8e9eb98f1f32702b4176685f2f941af51ab5bc7cf88ccb5435a1bb080
24f4acaf9beb720f6614b57b0062a672b2ab7920698a3bb3149861d3d8dd8d95
31df1e69ea3aece8a8bae5c08bcb7f5e977cb76f886897b301355359b66a48ec
3fcf51d6a45af49fcf867f9e7cfd7d0f98f05b0d4274df4f98f8e0876f5f468c
456e60679a0853b3c885219ac1b8ffa4becb397615e2af7c5b3d8051241f569f
5d3238bdb8ee9440978b31fadb2af34965dca58b179a1225e13316d4c6cfd5e8
5ec362c159f8322ca6f2843906d48ede643b81d7d682f65589672bcd7dd7b03f
70f0b8f85b6734495c48e6dd53b13a3458e650efac5a1bc79df5aa7b1df53298
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8507e248337417e787344af2e38cdb06d3820724793a7a8b172a919d326e5300
94b34f21012c802823955c3e9b2c8eaf0cd5730c7268ec92bf72cd1a9b7ddac9
9551a6fca7a5633b5d8c174b6402878a5fade1c090086f2256d10393e4ed8e15
9dd8c855600c0441a4ab67c11453935f195b0a2e48c930ec54ad327f6906635b
b393399496c96983723466f13b624f70da2d432c1493826e87e6cec3a949dc5d
c091629a45d384695d3aa0fcea2210eab8edff323d8ecbf81e3a04fda820d7f4
c5a17d46976d471cf060c5a0e25749a323d6ab20cf0910f40afed81047ba21ef
ca4df2bf400a42d8752e115f03366a90b2b4ed06b2da9ef429d41fda5f15705e
d04c075fe8f4ac3391f6ac1e6068314cc3abcb67c2c82f12c7c66bb427b1002b
d84d96dee8f47b0682ff6aea04bcb80d792d47d836af6cc0a5489fc24511c935
e2a82173e0e65eefeb0ad04c62d3c8fe8d6d2ddd8cf7d40bb4fafeeaa6be7631
f62b2c4ee9eb30c84447d84c767f9ade9558bcc74e1460ba9e82168f2a195acf
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955