URL: http://karavanyarns.com/irs/
Submission: On January 17 via automatic, source phishtank

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 132.148.91.6, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is karavanyarns.com.
This is the only time karavanyarns.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

IP Address AS Autonomous System
2 132.148.91.6 26496 (AS-26496-...)
9 104.88.19.215 2914 (NTT-COMMU...)
11 2
Apex Domain
Subdomains
Transfer
9 irs.gov
la2.alt.www4.irs.gov
2 karavanyarns.com
karavanyarns.com
11 2
Domain Requested by
9 la2.alt.www4.irs.gov karavanyarns.com
2 karavanyarns.com karavanyarns.com
11 2

This site contains links to these domains. Also see Links.

Domain
www.irs.gov
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://karavanyarns.com/irs/
Frame ID: (1F4637E34BD5F7F7E2E5B5ACC361A444)
Requests: 11 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

11
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

0 kB
Transfer

51 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
karavanyarns.com/irs/
12 KB
0
Document
General
Full URL
http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
132.148.91.6 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-132-148-91-6.ip.secureserver.net
Software
Apache / PHP/5.5.38
Resource Hash
b8b224829e394224cc386f9c3f6e644cefbbce3c774eea683564ab8c050b37cf

Request headers

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection
keep-alive
Accept-Encoding
gzip, deflate
Host
karavanyarns.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:34 GMT
Server
Apache
Connection
Keep-Alive
X-Powered-By
PHP/5.5.38
Transfer-Encoding
chunked
Keep-Alive
timeout=5, max=100
Content-Type
text/html
irs-gov_dev.css
la2.alt.www4.irs.gov/irs/cda/common/commonStyleSheet/
11 KB
0
Stylesheet
General
Full URL
https://la2.alt.www4.irs.gov/irs/cda/common/commonStyleSheet/irs-gov_dev.css
Requested by
Host: karavanyarns.com
URL: http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
104.88.19.215 Cambridge, United States, ASN2914 (NTT-COMMUNICATIONS-2914 - NTT America, Inc., US),
Reverse DNS
a104-88-19-215.deploy.static.akamaitechnologies.com
Software
none /
Resource Hash
a8014d94766e633e50aa83c5dd7786763c075a44b6bfb37721be8f42fe100d5b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://karavanyarns.com/irs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:35 GMT
Last-Modified
Tue, 14 Oct 2014 19:27:42 GMT
Server
none
X-Frame-Options
SAMEORIGIN
ETag
W/"11416-1413314862000"
Strict-Transport-Security
max-age=31536000
Content-Type
text/css
Cache-Control
max-age=21600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
11416
Expires
Wed, 17 Jan 2018 08:08:35 GMT
navigation-gecko.css
la2.alt.www4.irs.gov/irs/cda/common/styleSheets/
3 KB
0
Stylesheet
General
Full URL
https://la2.alt.www4.irs.gov/irs/cda/common/styleSheets/navigation-gecko.css
Requested by
Host: karavanyarns.com
URL: http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
104.88.19.215 Cambridge, United States, ASN2914 (NTT-COMMUNICATIONS-2914 - NTT America, Inc., US),
Reverse DNS
a104-88-19-215.deploy.static.akamaitechnologies.com
Software
none /
Resource Hash
f744b12f98c587935973a925ebf44557a63a52032bbbf9c79d181d5c63520837
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:35 GMT
Last-Modified
Tue, 14 Oct 2014 19:27:42 GMT
Server
none
X-Frame-Options
SAMEORIGIN
ETag
W/"3098-1413314862000"
Strict-Transport-Security
max-age=31536000
Content-Type
text/css
Cache-Control
max-age=21600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3098
Expires
Wed, 17 Jan 2018 08:08:35 GMT
styles-gecko.css
la2.alt.www4.irs.gov/irs/cda/common/styleSheets/
10 KB
0
Stylesheet
General
Full URL
https://la2.alt.www4.irs.gov/irs/cda/common/styleSheets/styles-gecko.css
Requested by
Host: karavanyarns.com
URL: http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
104.88.19.215 Cambridge, United States, ASN2914 (NTT-COMMUNICATIONS-2914 - NTT America, Inc., US),
Reverse DNS
a104-88-19-215.deploy.static.akamaitechnologies.com
Software
none /
Resource Hash
bdc0fedc2c6186ea5f706dabce79c4cf936bd64986b46c96693b10cbb872b633
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:35 GMT
Last-Modified
Tue, 14 Oct 2014 19:27:42 GMT
Server
none
X-Frame-Options
SAMEORIGIN
ETag
W/"10012-1413314862000"
Strict-Transport-Security
max-age=31536000
Content-Type
text/css
Cache-Control
max-age=21600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10012
Expires
Wed, 17 Jan 2018 08:08:35 GMT
login_styles.css
la2.alt.www4.irs.gov/irs/cda/common/styleSheets/
3 KB
0
Stylesheet
General
Full URL
https://la2.alt.www4.irs.gov/irs/cda/common/styleSheets/login_styles.css
Requested by
Host: karavanyarns.com
URL: http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
104.88.19.215 Cambridge, United States, ASN2914 (NTT-COMMUNICATIONS-2914 - NTT America, Inc., US),
Reverse DNS
a104-88-19-215.deploy.static.akamaitechnologies.com
Software
none /
Resource Hash
f0daae5aaadfc00f3a6fa525ee39b0d047c508bd28d0edfce9a669c57eaadcfa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:35 GMT
Last-Modified
Tue, 14 Oct 2014 19:27:42 GMT
Server
none
X-Frame-Options
SAMEORIGIN
ETag
W/"2763-1413314862000"
Strict-Transport-Security
max-age=31536000
Content-Type
text/css
Cache-Control
max-age=21600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2763
Expires
Wed, 17 Jan 2018 08:08:35 GMT
logo.png
la2.alt.www4.irs.gov/irs/cda/common/images/
3 KB
0
Image
General
Full URL
https://la2.alt.www4.irs.gov/irs/cda/common/images/logo.png
Requested by
Host: karavanyarns.com
URL: http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
104.88.19.215 Cambridge, United States, ASN2914 (NTT-COMMUNICATIONS-2914 - NTT America, Inc., US),
Reverse DNS
a104-88-19-215.deploy.static.akamaitechnologies.com
Software
none /
Resource Hash
b831fccf6dfafa26d4eb3d51369ed026b733dbfd7850217b15511e1266d96115
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://karavanyarns.com/irs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:35 GMT
Last-Modified
Tue, 14 Oct 2014 19:27:42 GMT
Server
none
X-Frame-Options
SAMEORIGIN
ETag
W/"2716-1413314862000"
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Cache-Control
max-age=21600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2716
Expires
Wed, 17 Jan 2018 08:08:35 GMT
Error-Icon.gif
la2.alt.www4.irs.gov/irs/cda/common/images/
631 B
0
Image
General
Full URL
https://la2.alt.www4.irs.gov/irs/cda/common/images/Error-Icon.gif
Requested by
Host: karavanyarns.com
URL: http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
104.88.19.215 Cambridge, United States, ASN2914 (NTT-COMMUNICATIONS-2914 - NTT America, Inc., US),
Reverse DNS
a104-88-19-215.deploy.static.akamaitechnologies.com
Software
none /
Resource Hash
91a7dae545c53af1df87fee0140dfb06d9b57fda7d7d11c381d62d9e5bfd85a7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://karavanyarns.com/irs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:35 GMT
Last-Modified
Tue, 14 Oct 2014 19:27:42 GMT
Server
none
X-Frame-Options
SAMEORIGIN
ETag
W/"631-1413314862000"
Strict-Transport-Security
max-age=31536000
Content-Type
image/gif
Cache-Control
max-age=21600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
631
Expires
Wed, 17 Jan 2018 08:08:35 GMT
button_login.jpg
la2.alt.www4.irs.gov/irs/cda/common/images/
4 KB
0
Image
General
Full URL
https://la2.alt.www4.irs.gov/irs/cda/common/images/button_login.jpg
Requested by
Host: karavanyarns.com
URL: http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
104.88.19.215 Cambridge, United States, ASN2914 (NTT-COMMUNICATIONS-2914 - NTT America, Inc., US),
Reverse DNS
a104-88-19-215.deploy.static.akamaitechnologies.com
Software
none /
Resource Hash
61383a504d8be3a57952af03d28ee235c3a4e0732d9c46da6218445e64130b4e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://karavanyarns.com/irs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:35 GMT
Last-Modified
Tue, 14 Oct 2014 19:27:42 GMT
Server
none
X-Frame-Options
SAMEORIGIN
ETag
W/"3963-1413314862000"
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=21600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3963
Expires
Wed, 17 Jan 2018 08:08:35 GMT
button_register.jpg
la2.alt.www4.irs.gov/irs/cda/common/images/
5 KB
0
Image
General
Full URL
https://la2.alt.www4.irs.gov/irs/cda/common/images/button_register.jpg
Requested by
Host: karavanyarns.com
URL: http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
104.88.19.215 Cambridge, United States, ASN2914 (NTT-COMMUNICATIONS-2914 - NTT America, Inc., US),
Reverse DNS
a104-88-19-215.deploy.static.akamaitechnologies.com
Software
none /
Resource Hash
cb3a03e8eaaaee9d33e562213bd2a4dcb6b9fcea3467c1f29ade759a32c48109
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://karavanyarns.com/irs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:35 GMT
Last-Modified
Tue, 14 Oct 2014 19:27:42 GMT
Server
none
X-Frame-Options
SAMEORIGIN
ETag
W/"4715-1413314862000"
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=21600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4715
Expires
Wed, 17 Jan 2018 08:08:35 GMT
blank.gif
karavanyarns.com/irs/cda/common/images/
348 B
0
Image
General
Full URL
http://karavanyarns.com/irs/cda/common/images/blank.gif
Requested by
Host: karavanyarns.com
URL: http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
132.148.91.6 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-132-148-91-6.ip.secureserver.net
Software
Apache /
Resource Hash
ff79949531fab53a64b533b44933432c0d707402a2e20ca1e3a4ee5b029010f5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
karavanyarns.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://karavanyarns.com/irs/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://karavanyarns.com/irs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:35 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
348
Content-Type
text/html; charset=iso-8859-1
bgBody.png
la2.alt.www4.irs.gov/irs/cda/common/images/
361 B
0
Image
General
Full URL
https://la2.alt.www4.irs.gov/irs/cda/common/images/bgBody.png
Requested by
Host: karavanyarns.com
URL: http://karavanyarns.com/irs/
Protocol
HTTP/1.1
Server
104.88.19.215 Cambridge, United States, ASN2914 (NTT-COMMUNICATIONS-2914 - NTT America, Inc., US),
Reverse DNS
a104-88-19-215.deploy.static.akamaitechnologies.com
Software
none /
Resource Hash
2b6212b217be7145dadb4ac68fcb55dbbab40d764e1b8de3ec083c8f758d4bee
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://la2.alt.www4.irs.gov/irs/cda/common/styleSheets/login_styles.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 17 Jan 2018 02:08:35 GMT
Last-Modified
Tue, 14 Oct 2014 19:27:42 GMT
Server
none
X-Frame-Options
SAMEORIGIN
ETag
W/"361-1413314862000"
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Cache-Control
max-age=21600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
361
Expires
Wed, 17 Jan 2018 08:08:35 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint function| setDivHeight function| getCookieVal function| GetCookie function| returnWin string| eservFrameCookie object| c undefined| selfLocation function| setMyCookie function| checkForm

0 Cookies