signup.scaife.us Open in urlscan Pro
2606:4700:30::681b:a121  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set validate.html Show response signup.scaife.us/auth/	32 KB 11 KB	63ms 57ms	Document text/html	2606:4700:30::681b:a121 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://signup.scaife.us/auth/validate.html Protocol HTTP/1.1 Server 2606:4700:30::681b:a121 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 3529d06f3f76b5773f9302748d5d8bf2de8f4c86ba103d4045a935aeffe8984a Request headers Host signup.scaife.us Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 24 Oct 2018 12:22:17 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d9dcf65fab9617b825dd8e6a6ea57db1f1540383737; expires=Thu, 24-Oct-19 12:22:17 GMT; path=/; domain=.scaife.us; HttpOnly Last-Modified Mon, 22 Oct 2018 20:28:55 GMT Vary Accept-Encoding Server cloudflare CF-RAY 46ec687975c09780-FRA Content-Encoding gzip
GET S	200	styles-nonie-1024.css sa.www4.irs.gov/eauth/pub/common/styleSheets/	34 KB 8 KB	665ms 217ms	Stylesheet text/css	2600:1400:d:397::1301 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://sa.www4.irs.gov/eauth/pub/common/styleSheets/styles-nonie-1024.css Requested by Host: signup.scaife.us URL: http://signup.scaife.us/auth/validate.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1400:d:397::1301 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash a1521341a1a9c557668e7a36146670002f0cb6dab27827102c823cc27094a7e9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Wed, 24 Oct 2018 12:22:18 GMT content-encoding gzip x-content-type-options nosniff status 200 vary Accept-Encoding content-length 7778 x-xss-protection 1; mode=block last-modified Fri, 06 Jul 2018 12:17:36 GMT server Apache x-frame-options SAMEORIGIN etag "8883-57053a62b3800" strict-transport-security max-age=31536000 content-type text/css; charset=UTF-8 cache-control max-age=21600 accept-ranges bytes expires Wed, 24 Oct 2018 18:22:18 GMT
GET S	200	password-feedback-styles-nonie-1024.css sa.www4.irs.gov/eauth/pub/common/styleSheets/	5 KB 1 KB	588ms 140ms	Stylesheet text/css	2600:1400:d:397::1301 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://sa.www4.irs.gov/eauth/pub/common/styleSheets/password-feedback-styles-nonie-1024.css Requested by Host: signup.scaife.us URL: http://signup.scaife.us/auth/validate.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1400:d:397::1301 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash c77d375c70510317c2a2de5de00704aab0e55a4a5a84dc9c9f5ec54450640755 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Wed, 24 Oct 2018 12:22:18 GMT content-encoding gzip x-content-type-options nosniff status 200 vary Accept-Encoding content-length 909 x-xss-protection 1; mode=block last-modified Fri, 01 Jun 2018 14:34:04 GMT server Apache x-frame-options SAMEORIGIN etag "12be-56d9579c40f00" strict-transport-security max-age=31536000 content-type text/css; charset=UTF-8 cache-control max-age=21600 accept-ranges bytes expires Wed, 24 Oct 2018 18:22:18 GMT
GET S	200	table.css sa.www4.irs.gov/eauth/pub/common/styleSheets/	9 KB 2 KB	652ms 204ms	Stylesheet text/css	2600:1400:d:397::1301 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://sa.www4.irs.gov/eauth/pub/common/styleSheets/table.css Requested by Host: signup.scaife.us URL: http://signup.scaife.us/auth/validate.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1400:d:397::1301 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash 27ad5be4102ef88add12d3ed9fcd75d69102343ed22f9538ea6d7b19ad9f7f5d Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Wed, 24 Oct 2018 12:22:18 GMT content-encoding gzip x-content-type-options nosniff status 200 vary Accept-Encoding content-length 1336 x-xss-protection 1; mode=block last-modified Fri, 01 Jun 2018 14:34:20 GMT server Apache x-frame-options SAMEORIGIN etag "236d-56d957ab83300" strict-transport-security max-age=31536000 content-type text/css; charset=UTF-8 cache-control max-age=21600 accept-ranges bytes expires Wed, 24 Oct 2018 18:22:18 GMT
GET S	200	rocket-loader.min.js Show response ajax.cloudflare.com/cdn-cgi/scripts/2448a7bd/cloudflare-static/	11 KB 4 KB	11ms 7ms	Script application/javascript	2400:cb00:2048:1::6813:c597 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://ajax.cloudflare.com/cdn-cgi/scripts/2448a7bd/cloudflare-static/rocket-loader.min.js Requested by Host: signup.scaife.us URL: http://signup.scaife.us/auth/validate.html Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2400:cb00:2048:1::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash 3493abbdef3202f502f59b11be045f3b4df6d94f047d882da751dc36087a31b0 Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains X-Frame-Options SAMEORIGIN Request headers Referer http://signup.scaife.us/auth/validate.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Wed, 24 Oct 2018 12:22:17 GMT content-encoding gzip vary Accept-Encoding last-modified Tue, 23 Oct 2018 12:00:28 GMT server cloudflare-nginx etag W/"5bcf0d5c-2ba8" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-frame-options SAMEORIGIN content-type application/javascript status 200 cache-control max-age=172800, public strict-transport-security max-age=15780000; includeSubDomains cf-ray 46ec687a0e5b63a3-FRA expires Fri, 26 Oct 2018 12:22:17 GMT
GET S	200	logo.png sa.www4.irs.gov/eauth/pub/common/images/	3 KB 3 KB	602ms 155ms	Image image/png	2600:1400:d:397::1301 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sa.www4.irs.gov/eauth/pub/common/images/logo.png Requested by Host: signup.scaife.us URL: http://signup.scaife.us/auth/validate.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1400:d:397::1301 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash b831fccf6dfafa26d4eb3d51369ed026b733dbfd7850217b15511e1266d96115 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://signup.scaife.us/auth/validate.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Wed, 24 Oct 2018 12:22:18 GMT x-content-type-options nosniff last-modified Mon, 17 Feb 2014 14:39:16 GMT server Apache etag "a9c-4f29b1eb6ed00" x-frame-options SAMEORIGIN content-type image/png status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 2716 x-xss-protection 1; mode=block expires Wed, 24 Oct 2018 18:22:18 GMT
GET S	200	button_cancel.jpg sa.www4.irs.gov/eauth/pub/common/images/	3 KB 3 KB	585ms 138ms	Image image/jpeg	2600:1400:d:397::1301 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sa.www4.irs.gov/eauth/pub/common/images/button_cancel.jpg Requested by Host: signup.scaife.us URL: http://signup.scaife.us/auth/validate.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1400:d:397::1301 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash 6f7e69c219478b0beeb4f21cab4877327b7b11d1a62edad40711a1dd7a79ad81 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://signup.scaife.us/auth/validate.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Wed, 24 Oct 2018 12:22:18 GMT x-content-type-options nosniff last-modified Tue, 03 May 2016 19:02:36 GMT server Apache etag "b82-531f4c0900b00" x-frame-options SAMEORIGIN content-type image/jpeg status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 2946 x-xss-protection 1; mode=block expires Wed, 24 Oct 2018 18:22:18 GMT
GET S	200	button_continue.jpg sa.www4.irs.gov/eauth/pub/common/images/	4 KB 4 KB	103ms 102ms	Image image/jpeg	2600:1400:d:397::1301 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sa.www4.irs.gov/eauth/pub/common/images/button_continue.jpg Requested by Host: signup.scaife.us URL: http://signup.scaife.us/auth/validate.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1400:d:397::1301 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash bdc4582b3b46dc5aae384af5959b1a7ba77e8deb7197ea0f3758c1be31eed4a1 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://signup.scaife.us/auth/validate.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Wed, 24 Oct 2018 12:22:18 GMT x-content-type-options nosniff last-modified Tue, 03 May 2016 19:02:34 GMT server Apache etag "ebc-531f4c0718680" x-frame-options SAMEORIGIN content-type image/jpeg status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 3772 x-xss-protection 1; mode=block expires Wed, 24 Oct 2018 18:22:18 GMT
GET H/1.1	404 Not Found	bd-1-30 signup.scaife.us/_bm/	0 0	31ms 31ms	Script text/html	2606:4700:30::681b:a121 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://signup.scaife.us/_bm/bd-1-30 Requested by Host: ajax.cloudflare.com URL: https://ajax.cloudflare.com/cdn-cgi/scripts/2448a7bd/cloudflare-static/rocket-loader.min.js Protocol HTTP/1.1 Server 2606:4700:30::681b:a121 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host signup.scaife.us User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept */* Referer http://signup.scaife.us/auth/validate.html Cookie __cfduid=d9dcf65fab9617b825dd8e6a6ea57db1f1540383737 Connection keep-alive Cache-Control no-cache Referer http://signup.scaife.us/auth/validate.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 24 Oct 2018 12:22:18 GMT Content-Encoding gzip Server cloudflare Connection keep-alive CF-RAY 46ec687ea79e9780-FRA Transfer-Encoding chunked Content-Type text/html; charset=iso-8859-1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| LoginErrors number| maxPasswordLength function| InputUtil object| __cfQR object| _cf

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.scaife.us/	1970-01-19 04:38:39	Name: __cfduid Value: d9dcf65fab9617b825dd8e6a6ea57db1f1540383737

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
sa.www4.irs.gov
signup.scaife.us
2400:cb00:2048:1::6813:c597
2600:1400:d:397::1301
2606:4700:30::681b:a121
27ad5be4102ef88add12d3ed9fcd75d69102343ed22f9538ea6d7b19ad9f7f5d
3493abbdef3202f502f59b11be045f3b4df6d94f047d882da751dc36087a31b0
3529d06f3f76b5773f9302748d5d8bf2de8f4c86ba103d4045a935aeffe8984a
6f7e69c219478b0beeb4f21cab4877327b7b11d1a62edad40711a1dd7a79ad81
a1521341a1a9c557668e7a36146670002f0cb6dab27827102c823cc27094a7e9
b831fccf6dfafa26d4eb3d51369ed026b733dbfd7850217b15511e1266d96115
bdc4582b3b46dc5aae384af5959b1a7ba77e8deb7197ea0f3758c1be31eed4a1
c77d375c70510317c2a2de5de00704aab0e55a4a5a84dc9c9f5ec54450640755