urlscan.io logo urlscan.io
SecurityTrails logo

irs.com-input.info Open in urlscan Pro
130.198.88.73  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2e...
Effective URL: http://irs.com-input.info/?rid=Rgi79Sv
Submission: On January 24 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 24 HTTP transactions. The main IP is 130.198.88.73, located in United States and belongs to SOFTLAYER - SoftLayer Technologies Inc., US. The main domain is irs.com-input.info.
This is the only time irs.com-input.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

IP Address AS Autonomous System
3 204.13.202.92 3561 (CENTURYLI...)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 167.89.115.54 11377 (SENDGRID)
1 130.198.88.73 36351 (SOFTLAYER)
15 2600:141b:13:... 20940 (AKAMAI-ASN1)
4 2a00:1450:400... 15169 (GOOGLE)
24 6
3    204.13.202.92 (Wilmington, United States)

ASN3561 (CENTURYLINK-LEGACY-SAVVIS - CenturyLink Communications, LLC, US)
PTR: aip-92.trustwave.com
scanmail.trustwave.com
1    2a00:1450:4001:806::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
1    167.89.115.54 (Denver, United States)

ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789115x54.outbound-mail.sendgrid.net
u7623503.ct.sendgrid.net
1    130.198.88.73 (United States)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: 49.58.c682.ip4.static.sl-reverse.com
irs.com-input.info
15    2600:141b:13:29b::12d4 (United States)

ASN20940 (AKAMAI-ASN1, US)
la1.www4.irs.gov
4    2a00:1450:4001:816::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
Domain Requested by
15 la1.www4.irs.gov irs.com-input.info
4 www.google-analytics.com la1.www4.irs.gov
www.google-analytics.com
irs.com-input.info
3 scanmail.trustwave.com scanmail.trustwave.com
1 irs.com-input.info scanmail.trustwave.com
1 u7623503.ct.sendgrid.net 1 redirects
1 ajax.googleapis.com scanmail.trustwave.com
24 6

This site contains links to these domains. Also see Links.

Domain
la1.www4.irs.gov
www.irs.gov
Subject Issuer Validity Valid
scanmail.trustwave.com
Trustwave Organization Validation SHA256 CA, Level 1		 2016-10-19 -
2019-10-23		 3 years crt.sh
*.googleapis.com
Google Internet Authority G3		 2019-01-08 -
2019-04-02		 3 months crt.sh
la.www4.irs.gov
Entrust Certification Authority - L1K		 2016-11-22 -
2020-02-21		 3 years crt.sh
*.google-analytics.com
Google Internet Authority G3		 2018-12-19 -
2019-03-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://irs.com-input.info/?rid=Rgi79Sv
Frame ID: E482C9DD1A07974403F4DB15A012AF27
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu762350... Page URL
  2. https://u7623503.ct.sendgrid.net/wf/click?upn=9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzR... HTTP 302
    http://irs.com-input.info/?rid=Rgi79Sv Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i

Page Statistics

24
Requests

96 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

362 kB
Transfer

583 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D Page URL
  2. https://u7623503.ct.sendgrid.net/wf/click?upn=9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy_iuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D HTTP 302
    http://irs.com-input.info/?rid=Rgi79Sv Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set /
scanmail.trustwave.com/ 		23 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
204.13.202.92 Wilmington, United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS - CenturyLink Communications, LLC, US),
Reverse DNS
aip-92.trustwave.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
63355007311fdb2c2490f4f6246e2ec16c422a4b287529bdc01d887546e4ec70

Request headers

Host
scanmail.trustwave.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Cache-Control
no-cache
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Expires
-1
Server
Microsoft-IIS/7.5
Set-Cookie
ASP.NET_SessionId=0pcqhhu1dhtkiai542xtu1fu; path=/; HttpOnly
X-AspNetMvc-Version
3.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Date
Thu, 24 Jan 2019 18:05:02 GMT
Content-Length
23563
bootstrap.min.css
scanmail.trustwave.com/Content/ 		37 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://scanmail.trustwave.com/Content/bootstrap.min.css
Requested by
Host: scanmail.trustwave.com
URL: https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
204.13.202.92 Wilmington, United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS - CenturyLink Communications, LLC, US),
Reverse DNS
aip-92.trustwave.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
87f52190c59e613c444d92701e48d255e5934e263039600f6196c84f4a460f88

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
scanmail.trustwave.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D
Cookie
ASP.NET_SessionId=0pcqhhu1dhtkiai542xtu1fu
Connection
keep-alive
Cache-Control
no-cache
Referer
https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 18:05:02 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Feb 2016 19:12:08 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"0b4ef19065d11:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
6724
bootstrap-theme.css
scanmail.trustwave.com/Content/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://scanmail.trustwave.com/Content/bootstrap-theme.css
Requested by
Host: scanmail.trustwave.com
URL: https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
204.13.202.92 Wilmington, United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS - CenturyLink Communications, LLC, US),
Reverse DNS
aip-92.trustwave.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
3d172d1dd730178065f27fa97c080e4e04a8dfa11633866540380067d8feef6f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
scanmail.trustwave.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D
Cookie
ASP.NET_SessionId=0pcqhhu1dhtkiai542xtu1fu
Connection
keep-alive
Cache-Control
no-cache
Referer
https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 18:05:03 GMT
Last-Modified
Thu, 11 Feb 2016 19:12:08 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"0b4ef19065d11:0"
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
1691
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.7.1/ 		92 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
Requested by
Host: scanmail.trustwave.com
URL: https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:806::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 14 Jan 2019 18:36:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
862086
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
33333
x-xss-protection
1; mode=block
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 14 Jan 2020 18:36:57 GMT
truncated
/ 		14 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0c68e7d1f292f085cb7ee5cb50f09a3a50293c6c1a0c1df57752f29aa6403e8d

Request headers

Response headers

Content-Type
image/png
Primary Request /
irs.com-input.info/
Redirect Chain
  • https://u7623503.ct.sendgrid.net/wf/click?upn=9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy_iuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lq...
  • http://irs.com-input.info/?rid=Rgi79Sv
152 KB
76 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://irs.com-input.info/?rid=Rgi79Sv
Requested by
Host: scanmail.trustwave.com
URL: https://scanmail.trustwave.com/?c=5398&d=94jJ3L3jL9KAuy_pJkEUATauUv9GE-BHmFKZZZNjFw&u=https%3a%2f%2fu7623503%2ect%2esendgrid%2enet%2fwf%2fclick%3fupn%3d9sgMGDOhqHCffZstg2XNp6zaQbSxgDVaSKGA82kaz9eVowWv2yR-2Fjo0zfaIzRMNy%5fiuWMrNMHugUHvUZjLeFMroSyrUfC9pqT08Qm-2FNSldj95WPcla4YQ41ulkgR-2BBXj7Pd56rvIgPuMHV5Lqkd8L0baA-2Bv8PoPHAxbVneMVDFsC1XemeGehLqkhwaDfKJEMF1GNt1hhs0Xcntn2QTSRvufQtaiy-2B2Ivndw3-2BSSdgpKQH-2FzzccG0BRaoplPWsjyNjf-2BVTyLHH-2FDAkI1nLt-2BUnqeb364pGogcBV4y5k9jIDqk-3D
Protocol
HTTP/1.1
Server
130.198.88.73 , United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
49.58.c682.ip4.static.sl-reverse.com
Software
/
Resource Hash
95e0518b21e13a5348acca1be379a50196a6173720d4f75c6242e7b7ea9a2fad

Request headers

Host
irs.com-input.info
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Vary
Accept-Encoding
Date
Thu, 24 Jan 2019 18:05:06 GMT
Transfer-Encoding
chunked

Redirect headers

Server
nginx
Date
Thu, 24 Jan 2019 18:05:05 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Location
http://irs.com-input.info?rid=Rgi79Sv
X-Robots-Tag
noindex, nofollow
styles-ie-1024.css
la1.www4.irs.gov/eauth/pub/common/styleSheets/ 		31 KB
32 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/styleSheets/styles-ie-1024.css
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
21fc56479fe469cc7d0eba9220f897fc4aa8e58ddc0730bd98a4d07263488c44
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://la1.www4.irs.gov/eauth/pub/login.jsp?Data=VGFyZ2V0TG9BPUY%253D&TYPE=33554433&REALMOID=06-000e8ffa-9958-1a23-9952-163b0acf4007&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=UOkC7yx4eMTO24FGxPfBRb5q3Mj3Xh3pyXfBEjYyHJ97nGCXu16wx5MzFHjfZmlG&TARGET=-SM-https%3a%2f%2fla%2ewww4%2eirs%2egov%2fae_rup_atcc%2f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:38 GMT
server
Apache
etag
"7da9-57cd90b024980"
x-frame-options
SAMEORIGIN
content-type
text/css; charset=UTF-8
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
32169
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:06 GMT
password-feedback-styles-ie-1024.css
la1.www4.irs.gov/eauth/pub/common/styleSheets/ 		5 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/styleSheets/password-feedback-styles-ie-1024.css
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
330c133a5d4fd1e7b99ef6331804fceaa46831e7bcc20e405210ca81ed3c5cb4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://la1.www4.irs.gov/eauth/pub/login.jsp?Data=VGFyZ2V0TG9BPUY%253D&TYPE=33554433&REALMOID=06-000e8ffa-9958-1a23-9952-163b0acf4007&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=UOkC7yx4eMTO24FGxPfBRb5q3Mj3Xh3pyXfBEjYyHJ97nGCXu16wx5MzFHjfZmlG&TARGET=-SM-https%3a%2f%2fla%2ewww4%2eirs%2egov%2fae_rup_atcc%2f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:38 GMT
server
Apache
etag
"12e5-57cd90b024980"
x-frame-options
SAMEORIGIN
content-type
text/css
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
4837
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:06 GMT
styles-ie-1024-x-ua-compatible.css
la1.www4.irs.gov/eauth/pub/common/styleSheets/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/styleSheets/styles-ie-1024-x-ua-compatible.css
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
1976f06a5dacded27bd50e14d2140e5fce0eb66a7b97a71c3b74b0aeb2dd97da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://la1.www4.irs.gov/eauth/pub/login.jsp?Data=VGFyZ2V0TG9BPUY%253D&TYPE=33554433&REALMOID=06-000e8ffa-9958-1a23-9952-163b0acf4007&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=UOkC7yx4eMTO24FGxPfBRb5q3Mj3Xh3pyXfBEjYyHJ97nGCXu16wx5MzFHjfZmlG&TARGET=-SM-https%3a%2f%2fla%2ewww4%2eirs%2egov%2fae_rup_atcc%2f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:38 GMT
server
Apache
etag
"ad4-57cd90b024980"
x-frame-options
SAMEORIGIN
content-type
text/css; charset=UTF-8
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
2772
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:06 GMT
password-feedback-styles-ie-1024-x-ua-compatible.css
la1.www4.irs.gov/eauth/pub/common/styleSheets/ 		5 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/styleSheets/password-feedback-styles-ie-1024-x-ua-compatible.css
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
dae52af51368787c9364aad63d9aa6c648e50c9f6524693faf1c669e7ede7bc0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://la1.www4.irs.gov/eauth/pub/login.jsp?Data=VGFyZ2V0TG9BPUY%253D&TYPE=33554433&REALMOID=06-000e8ffa-9958-1a23-9952-163b0acf4007&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=UOkC7yx4eMTO24FGxPfBRb5q3Mj3Xh3pyXfBEjYyHJ97nGCXu16wx5MzFHjfZmlG&TARGET=-SM-https%3a%2f%2fla%2ewww4%2eirs%2egov%2fae_rup_atcc%2f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:38 GMT
server
Apache
etag
"1392-57cd90b024980"
x-frame-options
SAMEORIGIN
content-type
text/css; charset=UTF-8
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
5010
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:06 GMT
table.css
la1.www4.irs.gov/eauth/pub/common/styleSheets/ 		9 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/styleSheets/table.css
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
27ad5be4102ef88add12d3ed9fcd75d69102343ed22f9538ea6d7b19ad9f7f5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://la1.www4.irs.gov/eauth/pub/login.jsp?Data=VGFyZ2V0TG9BPUY%253D&TYPE=33554433&REALMOID=06-000e8ffa-9958-1a23-9952-163b0acf4007&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=UOkC7yx4eMTO24FGxPfBRb5q3Mj3Xh3pyXfBEjYyHJ97nGCXu16wx5MzFHjfZmlG&TARGET=-SM-https%3a%2f%2fla%2ewww4%2eirs%2egov%2fae_rup_atcc%2f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:38 GMT
server
Apache
etag
"236d-57cd90b024980"
x-frame-options
SAMEORIGIN
content-type
text/css; charset=UTF-8
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
9069
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:06 GMT
ga6.js
la1.www4.irs.gov/eauth/pub/common/scripts/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/scripts/ga6.js
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
82c54fc0f123e80a4791ea2a8348812e073cbda81f8f45ea4ebcd4c381fe2827
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:36 GMT
server
Apache
etag
"500-57cd90ae3c500"
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
1280
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:06 GMT
alerts.jsp
la1.www4.irs.gov/eauth/pub/common/scripts/ 		26 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/scripts/alerts.jsp
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
none /
Resource Hash
6ca2a95f111dba03b6892d316620c72cd40d2fc446774a814b8510c3ff2b24de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
none
x-frame-options
SAMEORIGIN
content-language
en
status
200
strict-transport-security
max-age=31536000
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-length
5458
x-xss-protection
1; mode=block
constants.js
la1.www4.irs.gov/eauth/pub/common/scripts/ 		27 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/scripts/constants.js
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
d99384f6c916d6a5eb83aae16019d3e7bba34e4c9cda779937972056d0375a39
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:36 GMT
server
Apache
etag
"6deb-57cd90ae3c500"
x-frame-options
SAMEORIGIN
content-type
text/javascript
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
28139
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:06 GMT
tools.js
la1.www4.irs.gov/eauth/pub/common/scripts/ 		96 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/scripts/tools.js
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
e9261fd72c1748eb456841f5aff5af9e87d153a465dc38f99b1136f3ee8a4223
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:36 GMT
server
Apache
etag
"181fd-57cd90ae3c500"
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
98813
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:06 GMT
login_display.js
la1.www4.irs.gov/eauth/pub/common/scripts/ 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/scripts/login_display.js
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
6b59c582971919822043793373b145bb3e30ac05ff7e9c369e732085013e45e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:07 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:36 GMT
server
Apache
etag
"918-57cd90ae3c500"
x-frame-options
SAMEORIGIN
content-type
text/javascript
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
2328
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:07 GMT
login_validation.js
la1.www4.irs.gov/eauth/pub/common/scripts/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/scripts/login_validation.js
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
4bb869815ae1769db30845928b106809b8f2b3af05b862810adeafee9796a92c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:07 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:36 GMT
server
Apache
etag
"621-57cd90ae3c500"
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
1569
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:07 GMT
cookies.js
la1.www4.irs.gov/eauth/pub/common/scripts/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://la1.www4.irs.gov/eauth/pub/common/scripts/cookies.js
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
fc469373428729fb31a143825bf37f5a27ac655aef497f58eb428de45e637789
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:07 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:36 GMT
server
Apache
etag
"45f-57cd90ae3c500"
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
1119
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:07 GMT
logo.png
la1.www4.irs.gov/eauth/pub/common/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://la1.www4.irs.gov/eauth/pub/common/images/logo.png
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
b831fccf6dfafa26d4eb3d51369ed026b733dbfd7850217b15511e1266d96115
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:07 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:34 GMT
server
Apache
etag
"a9c-57cd90ac54080"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
2716
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:07 GMT
button_create_account.jpg
la1.www4.irs.gov/eauth/pub/common/images/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://la1.www4.irs.gov/eauth/pub/common/images/button_create_account.jpg
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
da21673d43c3753aa0e7a1ba3240c041362a1a7a954ac54edbbf283422088023
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:07 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:34 GMT
server
Apache
etag
"16f1-57cd90ac54080"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
5873
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:07 GMT
button_login.jpg
la1.www4.irs.gov/eauth/pub/common/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://la1.www4.irs.gov/eauth/pub/common/images/button_login.jpg
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:141b:13:29b::12d4 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
78b674690cd6985d972b94c4abf3dda60fe59f1a80b343977036b17aca1d074e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 18:05:07 GMT
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 20:28:36 GMT
server
Apache
etag
"7de-57cd90ae3c500"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
status
200
cache-control
max-age=21600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
2014
x-xss-protection
1; mode=block
expires
Fri, 25 Jan 2019 00:05:07 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: la1.www4.irs.gov
URL: https://la1.www4.irs.gov/eauth/pub/common/scripts/ga6.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 05 Nov 2018 21:10:09 GMT
server
Golfe2
age
960
date
Thu, 24 Jan 2019 17:49:07 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
17404
expires
Thu, 24 Jan 2019 19:49:07 GMT
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
997 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 24 Jan 2019 17:51:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 21 Apr 2016 03:17:22 GMT
server
sffe
age
817
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
856
x-xss-protection
1; mode=block
expires
Thu, 24 Jan 2019 18:51:30 GMT
collect
www.google-analytics.com/r/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j72&a=2145138926&t=pageview&_s=1&dl=http%3A%2F%2Firs.com-input.info%2F%3Frid%3DRgi79Sv&ul=en-us&de=UTF-8&dt=Log%20In&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KGBACEAjB~&jid=1706229997&gjid=1722275065&cid=1683177250.1548353107&tid=UA-22588183-6&_gid=1813794279.1548353107&_r=1&z=1258913755
Requested by
Host: irs.com-input.info
URL: http://irs.com-input.info/?rid=Rgi79Sv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 24 Jan 2019 18:05:07 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
98 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j72&a=2145138926&t=timing&_s=2&dl=http%3A%2F%2Firs.com-input.info%2F%3Frid%3DRgi79Sv&ul=en-us&de=UTF-8&dt=Log%20In&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=2138&pdt=607&dns=23&rrt=468&srt=358&tcp=302&dit=2037&clt=2037&_gst=1897&_gbt=2024&_u=KGBACEAjB~&jid=&gjid=&cid=1683177250.1548353107&tid=UA-22588183-6&_gid=1813794279.1548353107&z=120288811
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://irs.com-input.info/?rid=Rgi79Sv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Jan 2019 20:18:09 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
78418
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

224 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask string| url undefined| search_url_path function| gaError string| GoogleAnalyticsObject function| ga object| alerts boolean| canSubmit boolean| hasSuccessfullyEnteredPassword1 boolean| hasAttemptedValidateMatchingPassword boolean| hasVisitedSSN1 boolean| hasVisitedSSN2 number| sharedSecretCount string| actDefault string| emailAddr object| emailPattern object| sitePhrasePattern object| passwordPattern object| illegalPasswordPattern object| ssnFormatPattern object| nonDigitPattern object| confCodePattern object| confCodeSplitPattern object| actCodePattern object| secCodePattern string| noCookieMsg string| warningMsg string| warningMsg2 object| confCodeLens object| browsers string| userAgent boolean| isIE boolean| isIE11Plus boolean| isOpera boolean| isFirefox boolean| isSafari boolean| isChrome string| pathURL string| pathPubURL string| pathScriptsURL string| pathStylesURL string| pathJSPFURL string| pathRegURL string| pathErrorURL string| pathHelpURL string| pathSecureURL string| pathBlockURL string| pathHomeURL string| pathLandingURL string| pathProfileURL string| validateURLFailURL string| id_proofingImg01HTML string| id_proofingImg02HTML string| pfAriaDescribedByAttrVal object| passwordRulesLineItemImgHTMLArray boolean| hasCheckedSiteKey number| site_key boolean| isProfileURL number| page boolean| hasDisabledIndChecked object| siteKeyIndexTable object| randomSiteImgArray object| hiddenSiteImageSequenceNumberArray object| numericalLanguageArray object| cc_type object| countries object| days object| filing_statuses object| months object| states object| google_tag_data object| gaplugins object| gaGlobal function| load function| openExternalLink function| getFormElementArray function| getFormElementObject function| getInputTextObject function| getNameRegex function| getNextFormElement function| getPageNumber function| getPasswordRules function| getQueryStringDictionary function| getQueryStringVal function| getVersionMatches function| setIsIE function| setIsIE11Plus function| randomize function| containsIllegalCharacter function| containsSpace function| containsSpecialCharacter function| containsSSN function| hasCSS function| hasDetectedBackspaceKey function| hasDetectedBackspaceKeySSN function| hasNonQuirksMeta function| isNotDeleteKey function| isNullOrEmpty function| isValidActCode function| disableElementName function| disableElement function| enableElementName function| enableElement function| isElementNameEnabled function| isElementEnabled function| isValidated function| isValidBankAccount function| isValidCode function| isValidConfirmationCode function| isValidFullConfirmationCode function| isValidConfirmPassword function| isValidCreditCard function| isValidEmailPhrase function| isValidMobile function| isValidName function| isValidPassword function| isValidRouting function| isValidSecCode function| isValidSecondaryEmail function| isValidSitePhrase function| isValidSSN function| isValidSSNLast4 function| isValidTOTPSecCode function| isValidURL function| isValidUserID function| willAddFocusIndicator function| addCCDash function| addCCDashLast8 function| addConfirmationCodeDash function| addEvent function| addEventSelectivelyToTextFields function| addEventToTextFields function| addListener function| addPhoneChars function| addSSNDash function| addVisualFocusIndicator function| adjustErrorMessage function| autoWidth function| adjustHeight function| backButtonOverride function| backButtonOverrideBody function| changeInputType function| changeTitle function| combineSSN function| createHiddenElement function| disableRequired function| displayArrayAsHTMLDropdown function| displayDaysArrayAsHTMLDropdown function| displayNextFieldId function| displaySuccessWindow function| displaySuccessWindowChangePassword function| doMask function| doMaskSSN function| emptySSNFields function| emptySSNHiddenFields function| eventHandler function| eventRadioHandler function| formatCode function| formatPhoneNumeric function| handleEnter function| handleHTML5InputTypes function| handleRadioEnter function| handleWillRememberDevice function| hideLabel function| initializeSSNForm function| keys function| linkStyleChanger function| makeEditable function| parsePhone function| performAllMasking function| performMasking function| populateDaysArray function| populateFormObject function| produceSharedSecretsDropdownHTML function| redirectFromChangePasswordSuccessPopup function| redirectFromChangePasswordSuccessPopup1 function| redirectFromResetPasswordSuccessPopup function| reformatSSN function| replaceNumericalSSN function| replaceSSN function| rePopulate function| retrieveHasReturned function| ssnChange function| ssnJump function| ssnRemoveNonDigits function| successWindowDisplayAction function| toggleYearFieldDisplay function| validateFullConfirmationCode function| validateRegEx function| validateNonEmpty function| validateURLAction function| vanishGhosted function| getPhoneRegex function| validatePhone function| formatPhone function| moveToNextElemIfFull function| isElementFull function| isUserEditing function| toggle_visibility function| backClicked function| clearSSN function| cancelClicked function| cnclClicked function| isInt function| wait function| adjustDivs function| centerPage function| displayEmbeddedUNAX function| doBlurAction function| doFocusAction function| doLoginPopup function| joinActCodes function| skipAC function| isValidPasswordWithSitePhrase function| isValidActivationCode function| isValidLoginID function| createCookie function| readCookie function| eraseCookie function| areCookiesEnabled object| gaData function| concat

3 Cookies

Domain/Path Name / Value
.com-input.info/ Name: _gat
Value: 1
.com-input.info/ Name: _gid
Value: GA1.2.1813794279.1548353107
.com-input.info/ Name: _ga
Value: GA1.2.1683177250.1548353107

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
irs.com-input.info
la1.www4.irs.gov
scanmail.trustwave.com
u7623503.ct.sendgrid.net
www.google-analytics.com
130.198.88.73
167.89.115.54
204.13.202.92
2600:141b:13:29b::12d4
2a00:1450:4001:806::200a
2a00:1450:4001:816::200e
0c68e7d1f292f085cb7ee5cb50f09a3a50293c6c1a0c1df57752f29aa6403e8d
1976f06a5dacded27bd50e14d2140e5fce0eb66a7b97a71c3b74b0aeb2dd97da
21fc56479fe469cc7d0eba9220f897fc4aa8e58ddc0730bd98a4d07263488c44
27ad5be4102ef88add12d3ed9fcd75d69102343ed22f9538ea6d7b19ad9f7f5d
330c133a5d4fd1e7b99ef6331804fceaa46831e7bcc20e405210ca81ed3c5cb4
3d172d1dd730178065f27fa97c080e4e04a8dfa11633866540380067d8feef6f
4bb869815ae1769db30845928b106809b8f2b3af05b862810adeafee9796a92c
63355007311fdb2c2490f4f6246e2ec16c422a4b287529bdc01d887546e4ec70
6b59c582971919822043793373b145bb3e30ac05ff7e9c369e732085013e45e9
6ca2a95f111dba03b6892d316620c72cd40d2fc446774a814b8510c3ff2b24de
78b674690cd6985d972b94c4abf3dda60fe59f1a80b343977036b17aca1d074e
82c54fc0f123e80a4791ea2a8348812e073cbda81f8f45ea4ebcd4c381fe2827
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87f52190c59e613c444d92701e48d255e5934e263039600f6196c84f4a460f88
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
95e0518b21e13a5348acca1be379a50196a6173720d4f75c6242e7b7ea9a2fad
b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255
b831fccf6dfafa26d4eb3d51369ed026b733dbfd7850217b15511e1266d96115
d99384f6c916d6a5eb83aae16019d3e7bba34e4c9cda779937972056d0375a39
da21673d43c3753aa0e7a1ba3240c041362a1a7a954ac54edbbf283422088023
dae52af51368787c9364aad63d9aa6c648e50c9f6524693faf1c669e7ede7bc0
e9261fd72c1748eb456841f5aff5af9e87d153a465dc38f99b1136f3ee8a4223
fc469373428729fb31a143825bf37f5a27ac655aef497f58eb428de45e637789