irs.com-input.info Open in urlscan Pro
130.198.88.73  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response irs.com-input.info/	152 KB 76 KB	713ms 382ms	Document text/html	130.198.88.73 SoftLayer Technol...
General Check archive.org Show headers Download Go to Full URL http://irs.com-input.info/?rid=Rgi79Sv Protocol HTTP/1.1 Server 130.198.88.73 , United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US), Reverse DNS 49.58.c682.ip4.static.sl-reverse.com Software / Resource Hash 95e0518b21e13a5348acca1be379a50196a6173720d4f75c6242e7b7ea9a2fad Request headers Host irs.com-input.info Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Content-Encoding gzip Content-Type text/html; charset=utf-8 Vary Accept-Encoding Date Mon, 28 Jan 2019 21:42:45 GMT Transfer-Encoding chunked
GET H2	200	styles-ie-1024.css la1.www4.irs.gov/eauth/pub/common/styleSheets/	31 KB 32 KB	590ms 173ms	Stylesheet text/css	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/styleSheets/styles-ie-1024.css Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash 21fc56479fe469cc7d0eba9220f897fc4aa8e58ddc0730bd98a4d07263488c44 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://la1.www4.irs.gov/eauth/pub/login.jsp?Data=VGFyZ2V0TG9BPUY%253D&TYPE=33554433&REALMOID=06-000e8ffa-9958-1a23-9952-163b0acf4007&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=UOkC7yx4eMTO24FGxPfBRb5q3Mj3Xh3pyXfBEjYyHJ97nGCXu16wx5MzFHjfZmlG&TARGET=-SM-https%3a%2f%2fla%2ewww4%2eirs%2egov%2fae_rup_atcc%2f User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:38 GMT server Apache etag "7da9-57cd90b024980" x-frame-options SAMEORIGIN content-type text/css; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 32169 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	password-feedback-styles-ie-1024.css la1.www4.irs.gov/eauth/pub/common/styleSheets/	5 KB 5 KB	684ms 267ms	Stylesheet text/css	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/styleSheets/password-feedback-styles-ie-1024.css Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash 330c133a5d4fd1e7b99ef6331804fceaa46831e7bcc20e405210ca81ed3c5cb4 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://la1.www4.irs.gov/eauth/pub/login.jsp?Data=VGFyZ2V0TG9BPUY%253D&TYPE=33554433&REALMOID=06-000e8ffa-9958-1a23-9952-163b0acf4007&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=UOkC7yx4eMTO24FGxPfBRb5q3Mj3Xh3pyXfBEjYyHJ97nGCXu16wx5MzFHjfZmlG&TARGET=-SM-https%3a%2f%2fla%2ewww4%2eirs%2egov%2fae_rup_atcc%2f User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:38 GMT server Apache etag "12e5-57cd90b024980" x-frame-options SAMEORIGIN content-type text/css; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 4837 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	styles-ie-1024-x-ua-compatible.css la1.www4.irs.gov/eauth/pub/common/styleSheets/	3 KB 3 KB	684ms 268ms	Stylesheet text/css	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/styleSheets/styles-ie-1024-x-ua-compatible.css Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash 1976f06a5dacded27bd50e14d2140e5fce0eb66a7b97a71c3b74b0aeb2dd97da Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://la1.www4.irs.gov/eauth/pub/login.jsp?Data=VGFyZ2V0TG9BPUY%253D&TYPE=33554433&REALMOID=06-000e8ffa-9958-1a23-9952-163b0acf4007&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=UOkC7yx4eMTO24FGxPfBRb5q3Mj3Xh3pyXfBEjYyHJ97nGCXu16wx5MzFHjfZmlG&TARGET=-SM-https%3a%2f%2fla%2ewww4%2eirs%2egov%2fae_rup_atcc%2f User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:38 GMT server Apache etag "ad4-57cd90b024980" x-frame-options SAMEORIGIN content-type text/css; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 2772 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	password-feedback-styles-ie-1024-x-ua-compatible.css la1.www4.irs.gov/eauth/pub/common/styleSheets/	5 KB 5 KB	684ms 268ms	Stylesheet text/css	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/styleSheets/password-feedback-styles-ie-1024-x-ua-compatible.css Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash dae52af51368787c9364aad63d9aa6c648e50c9f6524693faf1c669e7ede7bc0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://la1.www4.irs.gov/eauth/pub/login.jsp?Data=VGFyZ2V0TG9BPUY%253D&TYPE=33554433&REALMOID=06-000e8ffa-9958-1a23-9952-163b0acf4007&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=UOkC7yx4eMTO24FGxPfBRb5q3Mj3Xh3pyXfBEjYyHJ97nGCXu16wx5MzFHjfZmlG&TARGET=-SM-https%3a%2f%2fla%2ewww4%2eirs%2egov%2fae_rup_atcc%2f User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:38 GMT server Apache etag "1392-57cd90b024980" x-frame-options SAMEORIGIN content-type text/css; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 5010 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	table.css la1.www4.irs.gov/eauth/pub/common/styleSheets/	9 KB 9 KB	683ms 267ms	Stylesheet text/css	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/styleSheets/table.css Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash 27ad5be4102ef88add12d3ed9fcd75d69102343ed22f9538ea6d7b19ad9f7f5d Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://la1.www4.irs.gov/eauth/pub/login.jsp?Data=VGFyZ2V0TG9BPUY%253D&TYPE=33554433&REALMOID=06-000e8ffa-9958-1a23-9952-163b0acf4007&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=UOkC7yx4eMTO24FGxPfBRb5q3Mj3Xh3pyXfBEjYyHJ97nGCXu16wx5MzFHjfZmlG&TARGET=-SM-https%3a%2f%2fla%2ewww4%2eirs%2egov%2fae_rup_atcc%2f User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:38 GMT server Apache etag "236d-57cd90b024980" x-frame-options SAMEORIGIN content-type text/css; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 9069 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	ga6.js Show response la1.www4.irs.gov/eauth/pub/common/scripts/	1 KB 2 KB	101ms 100ms	Script text/javascript	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/scripts/ga6.js Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash 82c54fc0f123e80a4791ea2a8348812e073cbda81f8f45ea4ebcd4c381fe2827 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:36 GMT server Apache etag "500-57cd90ae3c500" x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 1280 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	alerts.jsp Show response la1.www4.irs.gov/eauth/pub/common/scripts/	26 KB 6 KB	377ms 376ms	Script text/javascript	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/scripts/alerts.jsp Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software none / Resource Hash 6ca2a95f111dba03b6892d316620c72cd40d2fc446774a814b8510c3ff2b24de Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:46 GMT content-encoding gzip x-content-type-options nosniff server none x-frame-options SAMEORIGIN content-language en status 200 strict-transport-security max-age=31536000 content-type text/javascript; charset=UTF-8 vary Accept-Encoding content-length 5458 x-xss-protection 1; mode=block
GET H2	200	constants.js Show response la1.www4.irs.gov/eauth/pub/common/scripts/	27 KB 28 KB	120ms 119ms	Script text/javascript	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/scripts/constants.js Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash d99384f6c916d6a5eb83aae16019d3e7bba34e4c9cda779937972056d0375a39 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:36 GMT server Apache etag "6deb-57cd90ae3c500" x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 28139 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	tools.js Show response la1.www4.irs.gov/eauth/pub/common/scripts/	96 KB 97 KB	189ms 188ms	Script text/javascript	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/scripts/tools.js Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash e9261fd72c1748eb456841f5aff5af9e87d153a465dc38f99b1136f3ee8a4223 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:36 GMT server Apache etag "181fd-57cd90ae3c500" x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 98813 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	login_display.js Show response la1.www4.irs.gov/eauth/pub/common/scripts/	2 KB 3 KB	206ms 205ms	Script text/javascript	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/scripts/login_display.js Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash 6b59c582971919822043793373b145bb3e30ac05ff7e9c369e732085013e45e9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:36 GMT server Apache etag "918-57cd90ae3c500" x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 2328 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	login_validation.js Show response la1.www4.irs.gov/eauth/pub/common/scripts/	2 KB 2 KB	208ms 207ms	Script text/javascript	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/scripts/login_validation.js Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash 4bb869815ae1769db30845928b106809b8f2b3af05b862810adeafee9796a92c Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:36 GMT server Apache etag "621-57cd90ae3c500" x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 1569 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	cookies.js Show response la1.www4.irs.gov/eauth/pub/common/scripts/	1 KB 1 KB	209ms 208ms	Script text/javascript	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://la1.www4.irs.gov/eauth/pub/common/scripts/cookies.js Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash fc469373428729fb31a143825bf37f5a27ac655aef497f58eb428de45e637789 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:36 GMT server Apache etag "45f-57cd90ae3c500" x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 1119 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	logo.png la1.www4.irs.gov/eauth/pub/common/images/	3 KB 3 KB	209ms 209ms	Image image/png	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://la1.www4.irs.gov/eauth/pub/common/images/logo.png Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash b831fccf6dfafa26d4eb3d51369ed026b733dbfd7850217b15511e1266d96115 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:34 GMT server Apache etag "a9c-57cd90ac54080" x-frame-options SAMEORIGIN content-type image/png status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 2716 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	button_create_account.jpg la1.www4.irs.gov/eauth/pub/common/images/	6 KB 6 KB	210ms 210ms	Image image/jpeg	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://la1.www4.irs.gov/eauth/pub/common/images/button_create_account.jpg Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash da21673d43c3753aa0e7a1ba3240c041362a1a7a954ac54edbbf283422088023 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:45 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:34 GMT server Apache etag "16f1-57cd90ac54080" x-frame-options SAMEORIGIN content-type image/jpeg status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 5873 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:45 GMT
GET H2	200	button_login.jpg la1.www4.irs.gov/eauth/pub/common/images/	2 KB 2 KB	108ms 108ms	Image image/jpeg	2600:1408:20:28f::12d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://la1.www4.irs.gov/eauth/pub/common/images/button_login.jpg Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:1408:20:28f::12d4 , United States, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash 78b674690cd6985d972b94c4abf3dda60fe59f1a80b343977036b17aca1d074e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:42:46 GMT x-content-type-options nosniff last-modified Wed, 12 Dec 2018 20:28:36 GMT server Apache etag "7de-57cd90ae3c500" x-frame-options SAMEORIGIN content-type image/jpeg status 200 cache-control max-age=21600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 2014 x-xss-protection 1; mode=block expires Tue, 29 Jan 2019 03:42:46 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	43 KB 17 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:81d::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: la1.www4.irs.gov URL: https://la1.www4.irs.gov/eauth/pub/common/scripts/ga6.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash 3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 16 Jan 2019 20:01:45 GMT server Golfe2 age 1702 date Mon, 28 Jan 2019 21:14:23 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="44,43,39" content-length 17543 expires Mon, 28 Jan 2019 23:14:23 GMT
GET H2	200	linkid.js Show response www.google-analytics.com/plugins/ua/	2 KB 925 B	6ms 6ms	Script text/javascript	2a00:1450:4001:81d::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/plugins/ua/linkid.js Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 28 Jan 2019 21:10:08 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 21 Apr 2016 03:17:22 GMT server sffe age 1957 vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=3600 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="44,43,39" content-length 856 x-xss-protection 1; mode=block expires Mon, 28 Jan 2019 22:10:08 GMT
GET H2	200	collect www.google-analytics.com/r/	35 B 111 B	13ms 13ms	Image image/gif	2a00:1450:4001:81d::200e Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/r/collect?v=1&_v=j73&a=1942540982&t=pageview&_s=1&dl=http%3A%2F%2Firs.com-input.info%2F%3Frid%3DRgi79Sv&ul=en-us&de=UTF-8&dt=Log%20In&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KGBACEAjB~&jid=1741294002&gjid=15306282&cid=1877117578.1548711766&tid=UA-22588183-6&_gid=1200509134.1548711766&_r=1&z=733555097 Requested by Host: irs.com-input.info URL: http://irs.com-input.info/?rid=Rgi79Sv Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://irs.com-input.info/?rid=Rgi79Sv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers pragma no-cache date Mon, 28 Jan 2019 21:42:46 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 access-control-allow-origin * content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate alt-svc quic=":443"; ma=2592000; v="44,43,39" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

224 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask string| url undefined| search_url_path function| gaError string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| alerts boolean| canSubmit boolean| hasSuccessfullyEnteredPassword1 boolean| hasAttemptedValidateMatchingPassword boolean| hasVisitedSSN1 boolean| hasVisitedSSN2 number| sharedSecretCount string| actDefault string| emailAddr object| emailPattern object| sitePhrasePattern object| passwordPattern object| illegalPasswordPattern object| ssnFormatPattern object| nonDigitPattern object| confCodePattern object| confCodeSplitPattern object| actCodePattern object| secCodePattern string| noCookieMsg string| warningMsg string| warningMsg2 object| confCodeLens object| browsers string| userAgent boolean| isIE boolean| isIE11Plus boolean| isOpera boolean| isFirefox boolean| isSafari boolean| isChrome string| pathURL string| pathPubURL string| pathScriptsURL string| pathStylesURL string| pathJSPFURL string| pathRegURL string| pathErrorURL string| pathHelpURL string| pathSecureURL string| pathBlockURL string| pathHomeURL string| pathLandingURL string| pathProfileURL string| validateURLFailURL string| id_proofingImg01HTML string| id_proofingImg02HTML string| pfAriaDescribedByAttrVal object| passwordRulesLineItemImgHTMLArray boolean| hasCheckedSiteKey number| site_key boolean| isProfileURL number| page boolean| hasDisabledIndChecked object| siteKeyIndexTable object| randomSiteImgArray object| hiddenSiteImageSequenceNumberArray object| numericalLanguageArray object| cc_type object| countries object| days object| filing_statuses object| months object| states function| load function| openExternalLink function| getFormElementArray function| getFormElementObject function| getInputTextObject function| getNameRegex function| getNextFormElement function| getPageNumber function| getPasswordRules function| getQueryStringDictionary function| getQueryStringVal function| getVersionMatches function| setIsIE function| setIsIE11Plus function| randomize function| containsIllegalCharacter function| containsSpace function| containsSpecialCharacter function| containsSSN function| hasCSS function| hasDetectedBackspaceKey function| hasDetectedBackspaceKeySSN function| hasNonQuirksMeta function| isNotDeleteKey function| isNullOrEmpty function| isValidActCode function| disableElementName function| disableElement function| enableElementName function| enableElement function| isElementNameEnabled function| isElementEnabled function| isValidated function| isValidBankAccount function| isValidCode function| isValidConfirmationCode function| isValidFullConfirmationCode function| isValidConfirmPassword function| isValidCreditCard function| isValidEmailPhrase function| isValidMobile function| isValidName function| isValidPassword function| isValidRouting function| isValidSecCode function| isValidSecondaryEmail function| isValidSitePhrase function| isValidSSN function| isValidSSNLast4 function| isValidTOTPSecCode function| isValidURL function| isValidUserID function| willAddFocusIndicator function| addCCDash function| addCCDashLast8 function| addConfirmationCodeDash function| addEvent function| addEventSelectivelyToTextFields function| addEventToTextFields function| addListener function| addPhoneChars function| addSSNDash function| addVisualFocusIndicator function| adjustErrorMessage function| autoWidth function| adjustHeight function| backButtonOverride function| backButtonOverrideBody function| changeInputType function| changeTitle function| combineSSN function| createHiddenElement function| disableRequired function| displayArrayAsHTMLDropdown function| displayDaysArrayAsHTMLDropdown function| displayNextFieldId function| displaySuccessWindow function| displaySuccessWindowChangePassword function| doMask function| doMaskSSN function| emptySSNFields function| emptySSNHiddenFields function| eventHandler function| eventRadioHandler function| formatCode function| formatPhoneNumeric function| handleEnter function| handleHTML5InputTypes function| handleRadioEnter function| handleWillRememberDevice function| hideLabel function| initializeSSNForm function| keys function| linkStyleChanger function| makeEditable function| parsePhone function| performAllMasking function| performMasking function| populateDaysArray function| populateFormObject function| produceSharedSecretsDropdownHTML function| redirectFromChangePasswordSuccessPopup function| redirectFromChangePasswordSuccessPopup1 function| redirectFromResetPasswordSuccessPopup function| reformatSSN function| replaceNumericalSSN function| replaceSSN function| rePopulate function| retrieveHasReturned function| ssnChange function| ssnJump function| ssnRemoveNonDigits function| successWindowDisplayAction function| toggleYearFieldDisplay function| validateFullConfirmationCode function| validateRegEx function| validateNonEmpty function| validateURLAction function| vanishGhosted function| getPhoneRegex function| validatePhone function| formatPhone function| moveToNextElemIfFull function| isElementFull function| isUserEditing function| toggle_visibility function| backClicked function| clearSSN function| cancelClicked function| cnclClicked function| isInt function| wait function| adjustDivs function| centerPage function| displayEmbeddedUNAX function| doBlurAction function| doFocusAction function| doLoginPopup function| joinActCodes function| skipAC function| isValidPasswordWithSitePhrase function| isValidActivationCode function| isValidLoginID function| createCookie function| readCookie function| eraseCookie function| areCookiesEnabled function| concat

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.com-input.info/	1970-01-18 22:11:51	Name: _gat Value: 1
			.com-input.info/	1970-01-18 22:13:18	Name: _gid Value: GA1.2.1200509134.1548711766
			.com-input.info/	1970-01-19 15:43:03	Name: _ga Value: GA1.2.1877117578.1548711766

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

irs.com-input.info
la1.www4.irs.gov
www.google-analytics.com
130.198.88.73
2600:1408:20:28f::12d4
2a00:1450:4001:81d::200e
1976f06a5dacded27bd50e14d2140e5fce0eb66a7b97a71c3b74b0aeb2dd97da
21fc56479fe469cc7d0eba9220f897fc4aa8e58ddc0730bd98a4d07263488c44
27ad5be4102ef88add12d3ed9fcd75d69102343ed22f9538ea6d7b19ad9f7f5d
330c133a5d4fd1e7b99ef6331804fceaa46831e7bcc20e405210ca81ed3c5cb4
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
4bb869815ae1769db30845928b106809b8f2b3af05b862810adeafee9796a92c
6b59c582971919822043793373b145bb3e30ac05ff7e9c369e732085013e45e9
6ca2a95f111dba03b6892d316620c72cd40d2fc446774a814b8510c3ff2b24de
78b674690cd6985d972b94c4abf3dda60fe59f1a80b343977036b17aca1d074e
82c54fc0f123e80a4791ea2a8348812e073cbda81f8f45ea4ebcd4c381fe2827
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
95e0518b21e13a5348acca1be379a50196a6173720d4f75c6242e7b7ea9a2fad
b831fccf6dfafa26d4eb3d51369ed026b733dbfd7850217b15511e1266d96115
d99384f6c916d6a5eb83aae16019d3e7bba34e4c9cda779937972056d0375a39
da21673d43c3753aa0e7a1ba3240c041362a1a7a954ac54edbbf283422088023
dae52af51368787c9364aad63d9aa6c648e50c9f6524693faf1c669e7ede7bc0
e9261fd72c1748eb456841f5aff5af9e87d153a465dc38f99b1136f3ee8a4223
fc469373428729fb31a143825bf37f5a27ac655aef497f58eb428de45e637789