Submitted URL: https://goo-gl.me/6uddJ
Effective URL: https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
Submission: On November 27 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 52.165.208.70, located in Des Moines, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is ssosecurepayment-irs.x24hr.com.
TLS certificate: Issued by whm97.by-krezz.com on November 22nd 2021. Valid for: a year.
This is the only time ssosecurepayment-irs.x24hr.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 54.83.52.76 14618 (AMAZON-AES)
7 52.165.208.70 8075 (MICROSOFT...)
8 2
Apex Domain
Subdomains
Transfer
7 x24hr.com
ssosecurepayment-irs.x24hr.com
31 KB
1 bit.do
bit.do
239 B
1 google.com
www.google.com
543 B
1 goo-gl.me
goo-gl.me
1 KB
8 4
Domain Requested by
7 ssosecurepayment-irs.x24hr.com www.google.com
ssosecurepayment-irs.x24hr.com
1 bit.do 1 redirects
1 www.google.com
1 goo-gl.me 1 redirects
8 4

This site contains links to these domains. Also see Links.

Domain
go.cpanel.net
cpanel.com
Subject Issuer Validity Valid
whm97.by-krezz.com
whm97.by-krezz.com
2021-11-22 -
2022-11-22
a year crt.sh

This page contains 1 frames:

Primary Page: https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
Frame ID: F13CC54ADB35691661C6A3915BA6E439
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Default Web Site Page

Page URL History Show full URLs

  1. https://goo-gl.me/6uddJ HTTP 301
    http://www.google.com/url?q=http%3A%2F%2Fbit.do%2FfSGjq&sa=D&sntz=1&usg=AFQjCNGvQC30Z-4HiaIzV03gPW... Page URL
  2. http://bit.do/fSGjq HTTP 301
    https://ssosecurepayment-irs.x24hr.com/?_uht Page URL
  3. https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi Page URL

Page Statistics

8
Requests

0 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

32 kB
Transfer

30 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://goo-gl.me/6uddJ HTTP 301
    http://www.google.com/url?q=http%3A%2F%2Fbit.do%2FfSGjq&sa=D&sntz=1&usg=AFQjCNGvQC30Z-4HiaIzV03gPWBlWU3Vnw Page URL
  2. http://bit.do/fSGjq HTTP 301
    https://ssosecurepayment-irs.x24hr.com/?_uht Page URL
  3. https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://goo-gl.me/6uddJ HTTP 301
  • http://www.google.com/url?q=http%3A%2F%2Fbit.do%2FfSGjq&sa=D&sntz=1&usg=AFQjCNGvQC30Z-4HiaIzV03gPWBlWU3Vnw
Request Chain 1
  • http://bit.do/fSGjq HTTP 301
  • https://ssosecurepayment-irs.x24hr.com/?_uht

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
url
www.google.com/
Redirect Chain
  • https://goo-gl.me/6uddJ
  • http://www.google.com/url?q=http%3A%2F%2Fbit.do%2FfSGjq&sa=D&sntz=1&usg=AFQjCNGvQC30Z-4HiaIzV03gPWBlWU3Vnw
313 B
543 B
Document
General
Full URL
http://www.google.com/url?q=http%3A%2F%2Fbit.do%2FfSGjq&sa=D&sntz=1&usg=AFQjCNGvQC30Z-4HiaIzV03gPWBlWU3Vnw
Protocol
HTTP/1.1
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Location
http://bit.do/fSGjq
Cache-Control
private
Content-Type
text/html; charset=UTF-8
BFCache-Opt-In
unload
Date
Sat, 27 Nov 2021 02:20:18 GMT
Server
gws
Content-Length
313
X-XSS-Protection
0

Redirect headers

date
Sat, 27 Nov 2021 02:20:18 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/7.4.14
cache-control
no-cache, no-store, private
expires
-1
pragma
no-cache
location
http://www.google.com/url?q=http%3A%2F%2Fbit.do%2FfSGjq&sa=D&sntz=1&usg=AFQjCNGvQC30Z-4HiaIzV03gPWBlWU3Vnw
strict-transport-security
max-age=31536000;
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IsGQ0eT6C%2Bk2ZZy14bge1qkv0ciZphX8y%2BYdii6bXpNAmvYRi6Yl6Hq%2BtlzfU6tf74ayjS3nG21NFp8E9rfuS7kEGJlDMbyIIhCZAq5a5fMAYHrJJ1NFVGZVopcltCHTRQUvWHFePps%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6b47e067cd235c8c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
/
ssosecurepayment-irs.x24hr.com/
Redirect Chain
  • http://bit.do/fSGjq
  • https://ssosecurepayment-irs.x24hr.com/?_uht
163 B
487 B
Document
General
Full URL
https://ssosecurepayment-irs.x24hr.com/?_uht
Requested by
Host: www.google.com
URL: http://www.google.com/url?q=http%3A%2F%2Fbit.do%2FfSGjq&sa=D&sntz=1&usg=AFQjCNGvQC30Z-4HiaIzV03gPWBlWU3Vnw
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.165.208.70 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
9278d16ed2fdcd5dc651615b0b8adc6b55fb667a9d106a9891b861d4561d9a24

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://www.google.com/url?q=http%3A%2F%2Fbit.do%2FfSGjq&sa=D&sntz=1&usg=AFQjCNGvQC30Z-4HiaIzV03gPWBlWU3Vnw

Response headers

Date
Sat, 27 Nov 2021 02:20:19 GMT
Server
Apache
Last-Modified
Thu, 28 Oct 2021 14:25:30 GMT
Accept-Ranges
bytes
Content-Length
163
Cache-Control
no-cache, no-store, must-revalidate
Pragma
no-cache
Expires
0
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html

Redirect headers

Server
nginx/1.18.0
Date
Sat, 27 Nov 2021 02:20:19 GMT
Content-Type
text/html; charset=iso-8859-1
Content-Length
324
Connection
keep-alive
Location
https://ssosecurepayment-irs.x24hr.com/?_uht
Primary Request defaultwebpage.cgi
ssosecurepayment-irs.x24hr.com/cgi-sys/
7 KB
7 KB
Document
General
Full URL
https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.165.208.70 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
204cfef6d6dc61c66aafd854f6642a4cefa99dd05dc9f9fc06508d68f1b5b198

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://ssosecurepayment-irs.x24hr.com/?_uht

Response headers

Date
Sat, 27 Nov 2021 02:20:19 GMT
Server
Apache
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html
IP_changed.png
ssosecurepayment-irs.x24hr.com/img-sys/
3 KB
3 KB
Image
General
Full URL
https://ssosecurepayment-irs.x24hr.com/img-sys/IP_changed.png
Requested by
Host: ssosecurepayment-irs.x24hr.com
URL: https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.165.208.70 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
b19da51b5e9c9b29cd8523d85d92e99e4812c891c394929c9bf67557f560672c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sat, 27 Nov 2021 02:20:19 GMT
Last-Modified
Mon, 15 Nov 2021 18:45:52 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
2939
server_misconfigured.png
ssosecurepayment-irs.x24hr.com/img-sys/
3 KB
3 KB
Image
General
Full URL
https://ssosecurepayment-irs.x24hr.com/img-sys/server_misconfigured.png
Requested by
Host: ssosecurepayment-irs.x24hr.com
URL: https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.165.208.70 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
944120fb6962c7484d769d645e6d830850eead9394f6a84090aed489cfc0c41f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sat, 27 Nov 2021 02:20:19 GMT
Last-Modified
Mon, 15 Nov 2021 18:45:52 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
3164
server_moved.png
ssosecurepayment-irs.x24hr.com/img-sys/
3 KB
3 KB
Image
General
Full URL
https://ssosecurepayment-irs.x24hr.com/img-sys/server_moved.png
Requested by
Host: ssosecurepayment-irs.x24hr.com
URL: https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.165.208.70 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
3a22057583d3e17bc94990d92a3425d5510dc5bdb60fe40fafeb405a38f8ed28

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sat, 27 Nov 2021 02:20:19 GMT
Last-Modified
Mon, 15 Nov 2021 18:45:52 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3327
powered_by_cpanel.svg
ssosecurepayment-irs.x24hr.com/img-sys/
5 KB
6 KB
Image
General
Full URL
https://ssosecurepayment-irs.x24hr.com/img-sys/powered_by_cpanel.svg
Requested by
Host: ssosecurepayment-irs.x24hr.com
URL: https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.165.208.70 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
179a9aa9fff4c52850d9ce34a4c435404ddfd4fefa8aab9a6eb4f47b83f922d9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sat, 27 Nov 2021 02:20:19 GMT
Last-Modified
Mon, 15 Nov 2021 18:45:52 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
5617
error-bg-left.png
ssosecurepayment-irs.x24hr.com/img-sys/
8 KB
8 KB
Image
General
Full URL
https://ssosecurepayment-irs.x24hr.com/img-sys/error-bg-left.png
Requested by
Host: ssosecurepayment-irs.x24hr.com
URL: https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.165.208.70 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
862885b79bef22ad5716b2dbfa714d52f628a439f2921bb9520a4630bbea5d4e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssosecurepayment-irs.x24hr.com/cgi-sys/defaultwebpage.cgi
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sat, 27 Nov 2021 02:20:19 GMT
Last-Modified
Mon, 15 Nov 2021 18:45:52 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
8072

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

2 Cookies

Domain/Path Name / Value
goo-gl.me/ Name: XSRF-TOKEN
Value: eyJpdiI6ImZ0dGhWWVFUSEc4VHYvNDB6UHZHN1E9PSIsInZhbHVlIjoienZOOXRHc2RPcm14eXA0QzRjZE91ZDZ2TXRYWjZVdUdzbndBUGVxL0NVcllqY25OOG9INWRvRHV2L25xaHNQYXdJb0tPVnltSVNlVVpDaTFNRzd6YzVZZ0pOem5MR29GZ0p1WUl4VXZIODQ0TXozRCtXMG1vRjhHZ0pSY09YWkoiLCJtYWMiOiJlZmQ4NDAwMjMxMzZkM2IwNDNiYjdiN2ZlMDcxMzQyMjU5MjRiMzVjZDM5MGRhNWVlYzZmMzdiMjdhMGNiZjdiIn0%3D
goo-gl.me/ Name: url_shortener_goo_glme_session
Value: eyJpdiI6IlFaUVhjdkRqaHdhL0Q2cFpSM3lvRFE9PSIsInZhbHVlIjoiakhFSnQ2WDJNMWpHcEUweldWV2VscDd1WmZuN1NWTHczaXVjOGkyWW5FVFhZNUFFTEJZMGdnRTV5YTJJbHkrSW9BZE50YUJSZlVqTXIrR2RJTjdjcG56aG0yR1lUdVJvRDJNNkVBaXhNZ2hqYUNuS0V1UVVVNmJrTzM5cGk4ZHEiLCJtYWMiOiI0MWYzNjgyOWRmMjExYjBlZjkwYjE0MDcyZjI2MDM5MjRkNWVmNmY3OWZlNTBmY2E5MWY5NGViZWJkNDhkM2YxIn0%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Xss-Protection 0