Submitted URL: https://www.cutt.ly/OLk0s4S?1010
Effective URL: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874...
Submission Tags: 7588449
Submission: On July 11 via api from NL — Scanned from NL

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 209.182.213.214, located in United States and belongs to IMH-IAD, US. The main domain is masalik.ae.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 9th 2021. Valid for: a year.
This is the only time masalik.ae was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 1 169.47.130.86 36351 (SOFTLAYER)
1 11 209.182.213.214 54641 (IMH-IAD)
12 2
Apex Domain
Subdomains
Transfer
11 masalik.ae
masalik.ae
200 KB
1 69.mu
gto.69.mu
347 B
1 cutt.ly
www.cutt.ly — Cisco Umbrella Rank: 390099
432 B
12 3
Domain Requested by
11 masalik.ae 1 redirects masalik.ae
1 gto.69.mu 1 redirects
1 www.cutt.ly 1 redirects
12 3

This site contains no links.

Subject Issuer Validity Valid
masalik.ae
Sectigo RSA Domain Validation Secure Server CA
2021-12-09 -
2022-12-09
a year crt.sh

This page contains 1 frames:

Primary Page: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Frame ID: F612861D9B4A3D7977F69AB0F445ABBF
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Welcome

Page URL History Show full URLs

  1. https://www.cutt.ly/OLk0s4S?1010 HTTP 301
    http://gto.69.mu/ HTTP 301
    https://masalik.ae/temp/ HTTP 302
    https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGA... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

12
Requests

83 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

200 kB
Transfer

198 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.cutt.ly/OLk0s4S?1010 HTTP 301
    http://gto.69.mu/ HTTP 301
    https://masalik.ae/temp/ HTTP 302
    https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request GetMyPayment.html
masalik.ae/temp/
Redirect Chain
  • https://www.cutt.ly/OLk0s4S?1010
  • http://gto.69.mu/
  • https://masalik.ae/temp/
  • https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
4 KB
5 KB
Document
General
Full URL
https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.213.214 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
Software
Apache /
Resource Hash
63bf5a3c4b57aca69ee6a4d7a941d1722a217a581e33e2e189575f68ce8ab9a5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

accept-ranges
bytes
content-length
4520
content-type
text/html
date
Mon, 11 Jul 2022 19:11:51 GMT
last-modified
Sun, 10 Jul 2022 14:27:49 GMT
server
Apache

Redirect headers

content-type
text/html; charset=UTF-8
date
Mon, 11 Jul 2022 19:11:47 GMT
location
./GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
server
Apache
bootstrap.min.css
masalik.ae/temp/Get%20My%20Payment_files/
138 KB
139 KB
Stylesheet
General
Full URL
https://masalik.ae/temp/Get%20My%20Payment_files/bootstrap.min.css
Requested by
Host: masalik.ae
URL: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.213.214 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
Software
Apache /
Resource Hash
31df1e69ea3aece8a8bae5c08bcb7f5e977cb76f886897b301355359b66a48ec

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 11 Jul 2022 19:11:51 GMT
last-modified
Thu, 23 Apr 2020 23:07:56 GMT
server
Apache
accept-ranges
bytes
content-length
140930
content-type
text/css
jquery-ui.min.css
masalik.ae/temp/Get%20My%20Payment_files/
31 KB
32 KB
Stylesheet
General
Full URL
https://masalik.ae/temp/Get%20My%20Payment_files/jquery-ui.min.css
Requested by
Host: masalik.ae
URL: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.213.214 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
Software
Apache /
Resource Hash
ca4df2bf400a42d8752e115f03366a90b2b4ed06b2da9ef429d41fda5f15705e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 11 Jul 2022 19:11:51 GMT
last-modified
Thu, 23 Apr 2020 23:07:56 GMT
server
Apache
accept-ranges
bytes
content-length
32082
content-type
text/css
irs.css
masalik.ae/temp/Get%20My%20Payment_files/
6 KB
6 KB
Stylesheet
General
Full URL
https://masalik.ae/temp/Get%20My%20Payment_files/irs.css
Requested by
Host: masalik.ae
URL: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.213.214 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
Software
Apache /
Resource Hash
c091629a45d384695d3aa0fcea2210eab8edff323d8ecbf81e3a04fda820d7f4

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 11 Jul 2022 19:11:51 GMT
last-modified
Thu, 23 Apr 2020 23:07:56 GMT
server
Apache
accept-ranges
bytes
content-length
5806
content-type
text/css
app.css
masalik.ae/temp/Get%20My%20Payment_files/
9 KB
9 KB
Stylesheet
General
Full URL
https://masalik.ae/temp/Get%20My%20Payment_files/app.css
Requested by
Host: masalik.ae
URL: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.213.214 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
Software
Apache /
Resource Hash
c9e635a08a918f7902f54feaefc48f33b41b70d05b1af398528c29bbe179b84d

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 11 Jul 2022 19:11:51 GMT
last-modified
Thu, 23 Apr 2020 23:07:56 GMT
server
Apache
accept-ranges
bytes
content-length
9280
content-type
text/css
wmsp-shared-secrets.css
masalik.ae/temp/Get%20My%20Payment_files/
2 KB
2 KB
Stylesheet
General
Full URL
https://masalik.ae/temp/Get%20My%20Payment_files/wmsp-shared-secrets.css
Requested by
Host: masalik.ae
URL: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.213.214 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
Software
Apache /
Resource Hash
70f0b8f85b6734495c48e6dd53b13a3458e650efac5a1bc79df5aa7b1df53298

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 11 Jul 2022 19:11:51 GMT
last-modified
Thu, 23 Apr 2020 23:07:56 GMT
server
Apache
accept-ranges
bytes
content-length
2302
content-type
text/css
wmsp-error.css
masalik.ae/temp/Get%20My%20Payment_files/
514 B
544 B
Stylesheet
General
Full URL
https://masalik.ae/temp/Get%20My%20Payment_files/wmsp-error.css
Requested by
Host: masalik.ae
URL: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.213.214 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
Software
Apache /
Resource Hash
24f4acaf9beb720f6614b57b0062a672b2ab7920698a3bb3149861d3d8dd8d95

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 11 Jul 2022 19:11:51 GMT
last-modified
Thu, 23 Apr 2020 23:07:56 GMT
server
Apache
accept-ranges
bytes
content-length
514
content-type
text/css
wmsp-results.css
masalik.ae/temp/Get%20My%20Payment_files/
1 KB
1 KB
Stylesheet
General
Full URL
https://masalik.ae/temp/Get%20My%20Payment_files/wmsp-results.css
Requested by
Host: masalik.ae
URL: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.213.214 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
Software
Apache /
Resource Hash
8507e248337417e787344af2e38cdb06d3820724793a7a8b172a919d326e5300

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 11 Jul 2022 19:11:51 GMT
last-modified
Thu, 23 Apr 2020 23:07:56 GMT
server
Apache
accept-ranges
bytes
content-length
1359
content-type
text/css
logo.png
masalik.ae/temp/Get%20My%20Payment_files/
5 KB
5 KB
Image
General
Full URL
https://masalik.ae/temp/Get%20My%20Payment_files/logo.png
Requested by
Host: masalik.ae
URL: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.213.214 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
Software
Apache /
Resource Hash
02ceea374fce34ce8272bb17a67fd862c8ff49eeb05938154570701ca7a62ea7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 11 Jul 2022 19:11:51 GMT
last-modified
Thu, 23 Apr 2020 23:07:56 GMT
server
Apache
accept-ranges
bytes
content-length
4640
content-type
image/png
irs_horiz_white.png
masalik.ae/temp/Get%20My%20Payment_files/
1 KB
2 KB
Image
General
Full URL
https://masalik.ae/temp/Get%20My%20Payment_files/irs_horiz_white.png
Requested by
Host: masalik.ae
URL: https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.213.214 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
Software
Apache /
Resource Hash
5d3238bdb8ee9440978b31fadb2af34965dca58b179a1225e13316d4c6cfd5e8

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://masalik.ae/temp/GetMyPayment.html?IRSStimulusOnline&bn=3a87f6b7JKASHGD871236871KAJSJHGAJKjhsghdgsjkc2088874&burlid=d001a6eajs9823mym2s3289ai0,0b9cbe16-ID=162608
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 11 Jul 2022 19:11:51 GMT
last-modified
Thu, 23 Apr 2020 23:07:56 GMT
server
Apache
accept-ranges
bytes
content-length
1498
content-type
image/png
swirl_lighter_ca6f4deb.png
masalik.ae/temp/images/
0
0

help-tip.svg
masalik.ae/temp/images/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
masalik.ae
URL
https://masalik.ae/temp/images/swirl_lighter_ca6f4deb.png
Domain
masalik.ae
URL
https://masalik.ae/temp/images/help-tip.svg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

1 Cookies

Domain/Path Name / Value
www.cutt.ly/ Name: PHPSESSID
Value: 8sfg1lbhtg3c7uce1ggf8c1b9t