urlscan.io logo urlscan.io
SecurityTrails logo

vayya.pk Open in urlscan Pro
195.201.12.44  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://vayya.pk/vnjfd2/
Submission Tags: 7179898
Submission: On June 16 via api from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 2 countries across 8 domains to perform 31 HTTP transactions. The main IP is 195.201.12.44, located in Germany and belongs to HETZNER-AS, DE. The main domain is vayya.pk.
TLS certificate: Issued by R3 on June 14th 2021. Valid for: 3 months.
This is the only time vayya.pk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

IP Address AS Autonomous System
1 2 195.201.12.44 24940 (HETZNER-AS)
1 162.247.243.146 23467 (NEWRELIC-...)
1 151.101.114.110 54113 (FASTLY)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
5 2600:1400:d:3... 20940 (AKAMAI-ASN1)
3 13.224.195.83 16509 (AMAZON-02)
31 9
2    195.201.12.44 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: hydra.vrack.pk
vayya.pk
1    162.247.243.146 (United States)

ASN23467 (NEWRELIC-AS-1, US)
bam-cell.nr-data.net
1    151.101.114.110 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
js-agent.newrelic.com
2    2606:4700:10::6816:46c5 (United States)

ASN13335 (CLOUDFLARENET, US)
static.addtoany.com
2    2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
3    2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
5    2600:1400:d:39c::f50 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)
www.irs.gov
3    13.224.195.83 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-195-83.fra2.r.cloudfront.net
gateway.foresee.com
Domain Requested by
5 www.irs.gov vayya.pk
3 gateway.foresee.com vayya.pk
3 www.youtube.com vayya.pk
www.youtube.com
2 www.google-analytics.com vayya.pk
2 static.addtoany.com vayya.pk
2 vayya.pk 1 redirects vayya.pk
1 js-agent.newrelic.com vayya.pk
1 bam-cell.nr-data.net vayya.pk
31 8

This site contains no links.

Subject Issuer Validity Valid
vayya.pk
R3		 2021-06-14 -
2021-09-12		 3 months crt.sh
*.nr-data.net
DigiCert SHA2 Secure Server CA		 2020-02-05 -
2022-02-08		 2 years crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2021-05-21 -
2022-04-10		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-05 -
2021-08-05		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-05-17 -
2021-08-09		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-05-24 -
2021-08-16		 3 months crt.sh
www.irs.gov
Entrust Certification Authority - L1K		 2020-08-14 -
2022-11-13		 2 years crt.sh
foresee.com
Amazon		 2020-07-25 -
2021-08-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://vayya.pk/vnjfd2/
Frame ID: 504ECF44FEC9F596A5B25051E914B9F3
Requests: 31 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://vayya.pk/vnjfd2 HTTP 301
    https://vayya.pk/vnjfd2/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

31
Requests

58 %
HTTPS

50 %
IPv6

8
Domains

8
Subdomains

9
IPs

2
Countries

329 kB
Transfer

1528 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://vayya.pk/vnjfd2 HTTP 301
    https://vayya.pk/vnjfd2/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

31 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
vayya.pk/vnjfd2/
Redirect Chain
  • https://vayya.pk/vnjfd2
  • https://vayya.pk/vnjfd2/
158 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vayya.pk/vnjfd2/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
195.201.12.44 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hydra.vrack.pk
Software
/
Resource Hash
e2c28d52aff0a4753e6ee560417b61d4d7806c622bbad048fbded6ea0824d5a1

Request headers

:method
GET
:authority
vayya.pk
:scheme
https
:path
/vnjfd2/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type
text/html
last-modified
Sun, 13 Jun 2021 14:57:38 GMT
accept-ranges
bytes
content-encoding
br
vary
Accept-Encoding
content-length
27313
date
Wed, 16 Jun 2021 16:58:24 GMT

Redirect headers

content-type
text/html
content-length
707
date
Wed, 16 Jun 2021 16:58:24 GMT
location
https://vayya.pk/vnjfd2/
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
b67fc6a152
bam-cell.nr-data.net/1/ 		49 B
911 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam-cell.nr-data.net/1/b67fc6a152?a=70700070&v=1209.f04e2b9&to=blMHY0AHDUcDUEZQWFcZJFRGDwxaTUNTXlJmVQRUWgM%3D&rst=8197&ck=1&ref=https://www.irs.gov/coronavirus/get-my-payment&ap=35&be=2460&fe=7352&dc=5157&perf=%7B%22timing%22:%7B%22of%22:1623006008893,%22n%22:0,%22f%22:-182,%22dn%22:96,%22dne%22:934,%22c%22:935,%22s%22:1192,%22ce%22:1646,%22rq%22:1647,%22rp%22:2153,%22rpe%22:2153,%22dl%22:2372,%22di%22:4938,%22ds%22:5155,%22de%22:5497,%22dc%22:7349,%22l%22:7350,%22le%22:7366%7D,%22navigation%22:%7B%7D%7D&fcp=4975&at=QhQEFQgdHkk%3D&jsonp=NREUM.setToken
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.146 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 16 Jun 2021 16:58:24 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
X-NewRelic-App-Data
PxQGQlRUAAoHUFRbFR0VMQFTYkEDCBADUxZRDVZkG3xWEU0YdQhAEgVCVAkDEWQcfgEVFk51XhUUUEJQCgMRQBxSFlIUChoBB1wAWXRMB05WAhtDXgZZCgNSBVADBgZXVFQCUUBKBQNcEV0/
Server
cloudflare
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Transfer-Encoding
chunked
Connection
keep-alive
access-control-allow-credentials
true
CF-Ray
66059530dbfd00c9-AMS
cf-request-id
0ab75b9284000000c9eb26c000000001
nr-1209.min.js
js-agent.newrelic.com/ 		31 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1209.min.js
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1676a8158867ca736ff0a960b9300b8e0e8c016faa2b3211d54d1317213be669

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
Ilyf2heqjbcb6UZHMuleD6bz44kdIrhk
content-encoding
gzip
etag
"ceffb14d16467e17c5360bf7880099fa"
x-amz-request-id
9YTDKWS1KTJXVYR4
x-cache
HIT
content-length
11738
x-amz-id-2
63K0lT5syZe/JXm2RFqz3WvEIKlzAnzZaX0a32Ic9IwKZ+jnpxTdn4e7D+ymi1CMhPNPcBqN3b0=
x-served-by
cache-hhn4021-HHN
last-modified
Thu, 20 May 2021 23:21:18 GMT
server
AmazonS3
x-timer
S1623862705.768884,VS0,VE0
date
Wed, 16 Jun 2021 16:58:24 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
1648
icons.29.svg.js
static.addtoany.com/menu/svg/ 		78 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.addtoany.com/menu/svg/icons.29.svg.js
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e30f848c353b8ab801c18d2109527cb32a27f145262dccb3cd4db9f309cc53bb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 16:58:24 GMT
via
e1s
x-content-type-options
nosniff
cf-cache-status
HIT
age
7416151
p3p
CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0ab75b9276000016f2c6937000000001
last-modified
Mon, 31 Dec 2018 23:29:11 GMT
server
cloudflare
etag
W/"13937-57e59c7b88bd6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cache-control
max-age=315360000, immutable
cf-ray
66059530bc2216f2-FRA
cf-bgj
minify
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
1011 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 16:56:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
138
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Wed, 16 Jun 2021 17:56:06 GMT
www-widgetapi.js
www.youtube.com/s/player/5d56cf74/www-widgetapi.vflset/ 		122 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/5d56cf74/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a42a1122f6628a0b4221b2f66f72c4d216870ca5f8ce5e125f75a81aa00eeea3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 17:08:52 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Fri, 04 Jun 2021 00:03:57 GMT
server
sffe
age
344972
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41218
x-xss-protection
0
expires
Sun, 12 Jun 2022 17:08:52 GMT
analytics.js
www.google-analytics.com/ 		48 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 09 Apr 2021 23:59:54 GMT
server
Golfe2
age
2024
date
Wed, 16 Jun 2021 16:24:40 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19569
expires
Wed, 16 Jun 2021 18:24:40 GMT
iframe_api
www.youtube.com/ 		980 B
825 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
805c978b06b771610476faf71921cff8d013c59d45423b70dc0328e753a90baf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 16:58:24 GMT
content-encoding
br
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
cache-control
private, max-age=0
permissions-policy
ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000
content-type
text/javascript; charset=utf-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
expires
Wed, 16 Jun 2021 16:58:24 GMT
google_tag.script.js
vayya.pk/pub/google_tag/ 		0
0
css_hsAPjLX-mpRCXiSbHpHBq0wU8_NeP4-nfbMOmsVlqBM.css
www.irs.gov/pub/css/ 		33 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.irs.gov/pub/css/css_hsAPjLX-mpRCXiSbHpHBq0wU8_NeP4-nfbMOmsVlqBM.css
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:d:39c::f50 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
86c00f8cb5fe9a94425e249b1e91c1ab4c14f3f35e3f8fa77db30e9ac565a813
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 16:58:25 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Sun, 16 May 2021 16:39:04 GMT
strict-transport-security
max-age=31536000
content-type
text/css
x-ah-environment
prod
cache-control
max-age=86400
x-cache-hits
2
server-timing
cdn-cache; desc=HIT, edge; dur=1
accept-ranges
bytes
x-age
91392
content-length
5282
x-request-id
v-55c81646-47dd-11eb-9915-cbcb71ce85f2
expires
Thu, 17 Jun 2021 16:58:25 GMT
css_YiKoomumvkf5F2gYstPVwI9VbTpxwJfjcR3hWjD_xOw.css
www.irs.gov/pub/css/ 		326 KB
39 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.irs.gov/pub/css/css_YiKoomumvkf5F2gYstPVwI9VbTpxwJfjcR3hWjD_xOw.css
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:d:39c::f50 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
6222a8a26ba6be47f9176818b2d3d5c08f556d3a71c097e3711de15a30ffc4ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 16:58:25 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Sat, 12 Jun 2021 05:57:05 GMT
strict-transport-security
max-age=31536000
content-type
text/css
x-ah-environment
prod
cache-control
max-age=86400
x-cache-hits
19
server-timing
cdn-cache; desc=HIT, edge; dur=1
accept-ranges
bytes
x-age
166633
content-length
39412
x-request-id
v-f5efd830-4bbf-11eb-ac97-cb5b4e141cd9
expires
Thu, 17 Jun 2021 16:58:25 GMT
css_TPMs-A75V-DLtMvJGynwCucQqlu318W9uQct2FBqdmA.css
www.irs.gov/pub/css/ 		192 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.irs.gov/pub/css/css_TPMs-A75V-DLtMvJGynwCucQqlu318W9uQct2FBqdmA.css
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:d:39c::f50 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4cf32cf80ef957e0cbb4cbc91b29f00ae710aa5bb7d7c5bdb9072dd8506a7660
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 16:58:25 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Sat, 08 May 2021 21:46:24 GMT
strict-transport-security
max-age=31536000
content-type
text/css
x-ah-environment
prod
cache-control
max-age=86400
x-cache-hits
28
server-timing
cdn-cache; desc=HIT, edge; dur=1
accept-ranges
bytes
x-age
744178
content-length
12959
x-request-id
v-ae37eee8-3cbe-11eb-8565-ab97b831c504
expires
Thu, 17 Jun 2021 16:58:25 GMT
js_JL5-xpD24I600Ahcw5Q4vP2Cfa69VcdR4zEsiFjClFY.js
vayya.pk/pub/js/ 		0
0
google-analytics.js
vayya.pk/static_assets/js/reporting/ 		0
0
height.js
vayya.pk/static_assets/js/leftnav/ 		0
0
https.js
vayya.pk/static_assets/js/ 		0
0
federated-analytics.js
vayya.pk/static_assets/js/reporting/ 		0
0
gateway.min.js
gateway.foresee.com/sites/irs-gov/production/ 		159 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gateway.foresee.com/sites/irs-gov/production/gateway.min.js
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-83.fra2.r.cloudfront.net
Software
nginx/1.12.1 /
Resource Hash
11d27fbc83822e6b6f0685b1816c5432105e7c6bcd488566e2427d7c8e7ee4cd

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 16:52:51 GMT
content-encoding
gzip
age
333
x-cache
Hit from cloudfront
status
200
content-length
26752
access-control-allow-origin
*
last-modified
Wed, 16 Jun 2021 16:52:27 GMT
server
nginx/1.12.1
etag
W/"0f386526b53384beddce54a6d58ec0a5"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
via
1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
cache-control
public, max-age=14400
x-amz-cf-pop
FRA2-C1
access-control-allow-headers
X-Requested-With
x-amz-cf-id
AZd-nINZAf5gVm1SFYDpKq9-EoveuJWd_PU-QLwKP4Q7JYQOfKKtow==
expires
Wed, 16 Jun 2021 20:52:51 GMT
mpathy-modern.js
gateway.foresee.com/code/5.5.5-mp/ 		75 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gateway.foresee.com/code/5.5.5-mp/mpathy-modern.js
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-83.fra2.r.cloudfront.net
Software
nginx/1.12.1 /
Resource Hash
090c538bb629082bd4f229876075c6702039af99f331947f4488cf8ebb8f1c11

Request headers

Origin
https://vayya.pk
Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 06 Jun 2021 19:23:16 GMT
content-encoding
gzip
age
855308
x-cache
Hit from cloudfront
status
200
content-length
25085
access-control-allow-origin
*
last-modified
Fri, 19 Feb 2021 16:09:04 GMT
server
nginx/1.12.1
etag
W/"e244e48d6d6a603a04b88afd28d64c80"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
cache-control
public, max-age=2419200
x-amz-cf-pop
FRA2-C1
access-control-allow-headers
X-Requested-With
x-amz-cf-id
IsbnFFKB_CFtUlnYowVExJKe8R7wTbjWstZjkZcMTwkw5xVJqs0XDw==
expires
Sun, 04 Jul 2021 19:23:16 GMT
main.css
gateway.foresee.com/code/19.14.6-fs/templates/feedback/default/ 		76 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gateway.foresee.com/code/19.14.6-fs/templates/feedback/default/main.css
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-83.fra2.r.cloudfront.net
Software
nginx/1.12.1 /
Resource Hash
03e19a9670313aa9e3bc07bece0eebd1893095e327a90363ba21231aaf065faf

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 08:13:29 GMT
content-encoding
gzip
age
31495
x-cache
Hit from cloudfront
status
200
content-length
8739
access-control-allow-origin
*
last-modified
Thu, 22 Apr 2021 18:17:14 GMT
server
nginx/1.12.1
etag
W/"d9a8341fac0281518dbb74547b3a0540"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
text/css; charset=utf-8
via
1.1 29051585a13addd312c8ac9d527433c6.cloudfront.net (CloudFront)
cache-control
public, max-age=2419200
x-amz-cf-pop
FRA2-C1
access-control-allow-headers
X-Requested-With
x-amz-cf-id
PnlVLPhYrskQT0T0fHqbULI9V-5iGPTpdowQQEXlVAPgGQGbCxNmrQ==
expires
Wed, 14 Jul 2021 08:13:29 GMT
IRS-Logo.svg
www.irs.gov/themes/custom/pup_base/ 		14 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.irs.gov/themes/custom/pup_base/IRS-Logo.svg
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:d:39c::f50 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
3536108234988f9febfce80ca86c2fd44acc995593240c0e9e30399f46b27087
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 16:58:25 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Sat, 12 Jun 2021 05:57:26 GMT
strict-transport-security
max-age=31536000
content-type
image/svg+xml
x-ah-environment
prod
cache-control
max-age=86400
x-cache-hits
38
server-timing
cdn-cache; desc=HIT, edge; dur=1
accept-ranges
bytes
x-age
1366
content-length
5582
x-request-id
v-82dde78e-1b3f-11eb-a7d7-3328eebae941
expires
Thu, 17 Jun 2021 16:58:25 GMT
logo-print.svg
www.irs.gov/themes/custom/pup_irs/images/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.irs.gov/themes/custom/pup_irs/images/logo-print.svg
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:d:39c::f50 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
66466573e4c2cffdc636e13e76758dcf83f0ce235083c2098ad471cf419481d8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 16:58:25 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Fri, 11 Jun 2021 19:26:36 GMT
strict-transport-security
max-age=31536000
content-type
image/svg+xml
x-ah-environment
prod
cache-control
max-age=86400
x-cache-hits
29
server-timing
cdn-cache; desc=HIT, edge; dur=1
accept-ranges
bytes
x-age
795903
content-length
1822
x-request-id
v-cf692902-9b90-11eb-ae25-bfcd9cc3769a
expires
Thu, 17 Jun 2021 16:58:25 GMT
IRS-Logo.svg
vayya.pk/themes/custom/pup_base/ 		0
0
logo-print.svg
vayya.pk/themes/custom/pup_irs/images/ 		0
0
irs_horiz_logo.svg
vayya.pk/pub/ 		0
0
jquery.min.js
vayya.pk/static_assets/js/libs/ 		0
0
autotracker.js
vayya.pk/static_assets/js/reporting/ 		0
0
js_Uz25YiAagN6XBVUpi6MBmWorQT5RN0WPySSZbvrY1fE.js
vayya.pk/pub/js/ 		0
0
page.js
static.addtoany.com/menu/ 		84 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.addtoany.com/menu/page.js
Requested by
Host: vayya.pk
URL: https://vayya.pk/vnjfd2/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f909a31bfd7a13b9dd53e98b5652f13f4782fdfd1653dc4befade7386c087371
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 16:58:24 GMT
via
e1s
x-content-type-options
nosniff
cf-cache-status
HIT
age
123336
p3p
CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0ab75b9277000016f2b2ab3000000001
last-modified
Fri, 14 May 2021 06:41:59 GMT
server
cloudflare
etag
W/"14f2c-5c2448a7281f2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=172800
cf-ray
66059530bc2516f2-FRA
cf-bgj
minify
js_G6kd2scOaOndZAas-NRCZsMfAcQ69yp0Jiahp8afv5g.js
vayya.pk/pub/js/ 		0
0
www-widgetapi.js
www.youtube.com/s/player/997fe684/www-widgetapi.vflset/ 		126 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/997fe684/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6216350f8f0b2a5db239a96a6df67af9ac4db6fcbbd468f00fa41bfeb0f2249b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://vayya.pk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 16 Jun 2021 13:47:30 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Tue, 15 Jun 2021 01:01:25 GMT
server
sffe
age
11454
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42891
x-xss-protection
0
expires
Thu, 16 Jun 2022 13:47:30 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
vayya.pk
URL
https://vayya.pk/pub/google_tag/google_tag.script.js?ql3l8s
Domain
vayya.pk
URL
https://vayya.pk/pub/js/js_JL5-xpD24I600Ahcw5Q4vP2Cfa69VcdR4zEsiFjClFY.js
Domain
vayya.pk
URL
https://vayya.pk/static_assets/js/reporting/google-analytics.js
Domain
vayya.pk
URL
https://vayya.pk/static_assets/js/leftnav/height.js
Domain
vayya.pk
URL
https://vayya.pk/static_assets/js/https.js
Domain
vayya.pk
URL
https://vayya.pk/static_assets/js/reporting/federated-analytics.js?agency=Treasury&subagency=IRS&sdor=true
Domain
vayya.pk
URL
https://vayya.pk/themes/custom/pup_base/IRS-Logo.svg
Domain
vayya.pk
URL
https://vayya.pk/themes/custom/pup_irs/images/logo-print.svg
Domain
vayya.pk
URL
https://vayya.pk/pub/irs_horiz_logo.svg
Domain
vayya.pk
URL
https://vayya.pk/static_assets/js/libs/jquery.min.js
Domain
vayya.pk
URL
https://vayya.pk/static_assets/js/reporting/autotracker.js
Domain
vayya.pk
URL
https://vayya.pk/pub/js/js_Uz25YiAagN6XBVUpi6MBmWorQT5RN0WPySSZbvrY1fE.js
Domain
vayya.pk
URL
https://vayya.pk/pub/js/js_G6kd2scOaOndZAas-NRCZsMfAcQ69yp0Jiahp8afv5g.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

41 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady object| NREUM object| newrelic function| __nr_require object| dataLayer object| gaplugins function| ga object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportGELQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| google_tag_data

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam-cell.nr-data.net
gateway.foresee.com
js-agent.newrelic.com
static.addtoany.com
vayya.pk
www.google-analytics.com
www.irs.gov
www.youtube.com
vayya.pk
13.224.195.83
151.101.114.110
162.247.243.146
195.201.12.44
2600:1400:d:39c::f50
2606:4700:10::6816:46c5
2a00:1450:4001:80e::200e
2a00:1450:4001:812::200e
03e19a9670313aa9e3bc07bece0eebd1893095e327a90363ba21231aaf065faf
090c538bb629082bd4f229876075c6702039af99f331947f4488cf8ebb8f1c11
11d27fbc83822e6b6f0685b1816c5432105e7c6bcd488566e2427d7c8e7ee4cd
1676a8158867ca736ff0a960b9300b8e0e8c016faa2b3211d54d1317213be669
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
3536108234988f9febfce80ca86c2fd44acc995593240c0e9e30399f46b27087
4cf32cf80ef957e0cbb4cbc91b29f00ae710aa5bb7d7c5bdb9072dd8506a7660
6216350f8f0b2a5db239a96a6df67af9ac4db6fcbbd468f00fa41bfeb0f2249b
6222a8a26ba6be47f9176818b2d3d5c08f556d3a71c097e3711de15a30ffc4ec
66466573e4c2cffdc636e13e76758dcf83f0ce235083c2098ad471cf419481d8
805c978b06b771610476faf71921cff8d013c59d45423b70dc0328e753a90baf
86c00f8cb5fe9a94425e249b1e91c1ab4c14f3f35e3f8fa77db30e9ac565a813
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
a42a1122f6628a0b4221b2f66f72c4d216870ca5f8ce5e125f75a81aa00eeea3
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c
e2c28d52aff0a4753e6ee560417b61d4d7806c622bbad048fbded6ea0824d5a1
e30f848c353b8ab801c18d2109527cb32a27f145262dccb3cd4db9f309cc53bb
f909a31bfd7a13b9dd53e98b5652f13f4782fdfd1653dc4befade7386c087371