statefile.pr-3832.getyourrefund-testing.org Open in urlscan Pro
54.237.159.171 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://statefile.pr-3832.getyourrefund-testing.org/
Effective URL:
https://statefile.pr-3832.getyourrefund-testing.org/en
Submission: On December 01 via automatic, source certstream-suspicious (December 1st 2023, 9:09:36 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 54.237.159.171, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is statefile.pr-3832.getyourrefund-testing.org.
TLS certificate: Issued by R3 on December 1st 2023. Valid for: 3 months.

This is the only time statefile.pr-3832.getyourrefund-testing.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 10	54.237.159.171 54.237.159.171	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
11	3

10 54.237.159.171 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-237-159-171.compute-1.amazonaws.com

statefile.pr-3832.getyourrefund-testing.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	getyourrefund-testing.org 1 redirects statefile.pr-3832.getyourrefund-testing.org	183 KB
1	gstatic.com fonts.gstatic.com	15 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	886 B
11	3

	Domain	Requested by
10	statefile.pr-3832.getyourrefund-testing.org	1 redirects statefile.pr-3832.getyourrefund-testing.org
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	statefile.pr-3832.getyourrefund-testing.org
11	3

This site contains links to these domains. Also see Links.

Domain
www.getyourrefund.org
pr-3832.getyourrefund-testing.org
ctc.pr-3832.getyourrefund-testing.org
www.codeforamerica.org
www.getyourrefundstatus.org

Subject Issuer	Validity	Valid
statefile.pr-3832.getyourrefund-testing.org R3	`2023-12-01` - `2024-02-29`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://statefile.pr-3832.getyourrefund-testing.org/en
Frame ID: 1773C4CDD5BEF9D0E7FA5F42DE8C6CBF
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Free tax help from IRS-certified volunteers. | State File

Page URL History Show full URLs

https://statefile.pr-3832.getyourrefund-testing.org/ HTTP 302
https://statefile.pr-3832.getyourrefund-testing.org/en Page URL

Detected technologies

Stimulus (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-controller

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

197 kB
Transfer

768 kB
Size

2
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.getyourrefund.org/
Title: GetYourRefund.org

Search URL Search Domain Scan URL

URL: https://pr-3832.getyourrefund-testing.org/en
Title: https://pr-3832.getyourrefund-testing.org/en

Search URL Search Domain Scan URL

URL: https://ctc.pr-3832.getyourrefund-testing.org/en
Title: https://ctc.pr-3832.getyourrefund-testing.org/en

Search URL Search Domain Scan URL

URL: https://www.codeforamerica.org/
Title: Code for America

Search URL Search Domain Scan URL

URL: https://www.getyourrefundstatus.org/
Title: Service status

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://statefile.pr-3832.getyourrefund-testing.org/ HTTP 302
https://statefile.pr-3832.getyourrefund-testing.org/en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request en Show response
statefile.pr-3832.getyourrefund-testing.org/
Redirect Chain

https://statefile.pr-3832.getyourrefund-testing.org/
https://statefile.pr-3832.getyourrefund-testing.org/en

6 KB
8 KB

122ms
121ms

Document
text/html

54.237.159.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://statefile.pr-3832.getyourrefund-testing.org/en

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.159.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-159-171.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

0da9ee1014a856cc3bb66384e8f00841eb30aa50b97f828195d9fae7bc062ab2

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, private, must-revalidate
Connection: keep-alive
Content-Length: 6123
Content-Security-Policy
Content-Type: text/html; charset=utf-8
Date: Fri, 01 Dec 2023 09:09:30 GMT
Etag: W/"0da9ee1014a856cc3bb66384e8f00841"
Link: </assets/application-e2dcbad71a000a194e2197b62225d888d51f0c956355ad4c398882a7cd1a430d.css>; rel=preload; as=style; nopush,</packs/css/application-5433f474.css>; rel=preload; as=style; nopush
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D"}]}
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D
Server: Cowboy
Strict-Transport-Security: max-age=63072000; includeSubDomains
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: be3b9171-98d7-4879-939d-cd8810a66c25
X-Runtime: 0.011888
X-Xss-Protection: 0

Redirect headers

Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Security-Policy
Content-Type: text/html; charset=utf-8
Date: Fri, 01 Dec 2023 09:09:30 GMT
Location: https://statefile.pr-3832.getyourrefund-testing.org/en
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1701421770&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=7CBGZ5yJQvRMy3%2F%2Fy6Pot2zqoiWQOzhAgsNTNBfBXoA%3D"}]}
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1701421770&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=7CBGZ5yJQvRMy3%2F%2Fy6Pot2zqoiWQOzhAgsNTNBfBXoA%3D
Server: Cowboy
Strict-Transport-Security: max-age=63072000; includeSubDomains
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: d60296ef-b1b0-43aa-a55d-59aa70180c25
X-Runtime: 0.015670
X-Xss-Protection: 0

GET
H/1.1 200
OK application-e2dcbad71a000a194e2197b62225d888d51f0c956355ad4c398882a7cd1a430d.css
statefile.pr-3832.getyourrefund-testing.org/assets/ 220 KB
42 KB 108ms
107ms Stylesheet
text/css 54.237.159.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://statefile.pr-3832.getyourrefund-testing.org/assets/application-e2dcbad71a000a194e2197b62225d888d51f0c956355ad4c398882a7cd1a430d.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.159.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-159-171.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

8016cb4e83d080bc8cc996f8dd432be75ad329a814a3b8f9e3d24fb8779d2cbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://statefile.pr-3832.getyourrefund-testing.org/en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Fri, 01 Dec 2023 09:09:31 GMT
Content-Encoding: gzip
Via: 1.1 vegur
Strict-Transport-Security: max-age=63072000; includeSubDomains
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: Cowboy
Last-Modified: Fri, 01 Dec 2023 09:03:59 GMT
Vary: accept-encoding
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D"}]}
Content-Type: text/css
Cache-Control: public, max-age=31536000
Connection: keep-alive
Content-Length: 42372
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D

GET
H/1.1 200
OK application-5433f474.css
statefile.pr-3832.getyourrefund-testing.org/packs/css/ 10 KB
3 KB 327ms
112ms Stylesheet
text/css 54.237.159.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://statefile.pr-3832.getyourrefund-testing.org/packs/css/application-5433f474.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.159.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-159-171.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

1580331be0ce4c6908f21a3c3f816c61c8c92a8d2e12a6ccea033d4fee6d4eca

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://statefile.pr-3832.getyourrefund-testing.org/en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Fri, 01 Dec 2023 09:09:30 GMT
Content-Encoding: br
Via: 1.1 vegur
Strict-Transport-Security: max-age=63072000; includeSubDomains
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: Cowboy
Last-Modified: Fri, 01 Dec 2023 09:04:47 GMT
Vary: accept-encoding
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D"}]}
Content-Type: text/css
Cache-Control: public, max-age=31536000
Connection: keep-alive
Content-Length: 2347
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D

GET
H2 200 css
fonts.googleapis.com/ 1 KB
886 B 76ms
30ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Public%20Sans

Requested by

Host: statefile.pr-3832.getyourrefund-testing.org
URL: https://statefile.pr-3832.getyourrefund-testing.org/en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0ace8426ff5822402c0e93a97abf8e3ac2cdfba9a9b9b9e7ff70da852bb82996

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://statefile.pr-3832.getyourrefund-testing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 01 Dec 2023 09:09:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 01 Dec 2023 08:40:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 01 Dec 2023 09:09:31 GMT

GET
H/1.1 200
OK runtime-5d83b91d2172c6417e29.js Show response
statefile.pr-3832.getyourrefund-testing.org/packs/js/ 1 KB
2 KB 324ms
108ms Script
application/javascript 54.237.159.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://statefile.pr-3832.getyourrefund-testing.org/packs/js/runtime-5d83b91d2172c6417e29.js

Requested by

Host: statefile.pr-3832.getyourrefund-testing.org
URL: https://statefile.pr-3832.getyourrefund-testing.org/en

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.159.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-159-171.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

b4bbca17dde30ca7c1ebeef9eacb9bc8705ca76f4089911a3c60500eb2e17224

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://statefile.pr-3832.getyourrefund-testing.org/en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Fri, 01 Dec 2023 09:09:31 GMT
Content-Encoding: br
Via: 1.1 vegur
Strict-Transport-Security: max-age=63072000; includeSubDomains
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: Cowboy
Last-Modified: Fri, 01 Dec 2023 09:04:47 GMT
Vary: accept-encoding
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D"}]}
Content-Type: application/javascript
Cache-Control: public, max-age=31536000
Connection: keep-alive
Content-Length: 728
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D

GET
H/1.1 200
OK 822-19d83f4aa39adb18930f.js Show response
statefile.pr-3832.getyourrefund-testing.org/packs/js/ 451 KB
103 KB 339ms
112ms Script
application/javascript 54.237.159.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://statefile.pr-3832.getyourrefund-testing.org/packs/js/822-19d83f4aa39adb18930f.js

Requested by

Host: statefile.pr-3832.getyourrefund-testing.org
URL: https://statefile.pr-3832.getyourrefund-testing.org/en

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.159.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-159-171.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

fdebb880bf08c8e7ff4ec28dae39abfbe2783294dc5464292571a807e64f0c59

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://statefile.pr-3832.getyourrefund-testing.org/en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Fri, 01 Dec 2023 09:09:30 GMT
Content-Encoding: br
Via: 1.1 vegur
Strict-Transport-Security: max-age=63072000; includeSubDomains
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: Cowboy
Last-Modified: Fri, 01 Dec 2023 09:04:47 GMT
Vary: accept-encoding
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D"}]}
Content-Type: application/javascript
Cache-Control: public, max-age=31536000
Connection: keep-alive
Content-Length: 104991
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D

GET
H/1.1 200
OK application-6e54d2dc48e56d8f43b8.js Show response
statefile.pr-3832.getyourrefund-testing.org/packs/js/ 53 KB
17 KB 340ms
113ms Script
application/javascript 54.237.159.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://statefile.pr-3832.getyourrefund-testing.org/packs/js/application-6e54d2dc48e56d8f43b8.js

Requested by

Host: statefile.pr-3832.getyourrefund-testing.org
URL: https://statefile.pr-3832.getyourrefund-testing.org/en

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.159.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-159-171.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

39bf348672cc007a104bd4ea4fce57a311b8d9a750fe565bb46c84043761d025

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://statefile.pr-3832.getyourrefund-testing.org/en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Fri, 01 Dec 2023 09:09:30 GMT
Content-Encoding: br
Via: 1.1 vegur
Strict-Transport-Security: max-age=63072000; includeSubDomains
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: Cowboy
Last-Modified: Fri, 01 Dec 2023 09:04:47 GMT
Vary: accept-encoding
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D"}]}
Content-Type: application/javascript
Cache-Control: public, max-age=31536000
Connection: keep-alive
Content-Length: 16088
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D

GET
H/1.1 200
OK state_file-8383c7086e31e82e4d39.js Show response
statefile.pr-3832.getyourrefund-testing.org/packs/js/ 10 KB
4 KB 109ms
109ms Script
application/javascript 54.237.159.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://statefile.pr-3832.getyourrefund-testing.org/packs/js/state_file-8383c7086e31e82e4d39.js

Requested by

Host: statefile.pr-3832.getyourrefund-testing.org
URL: https://statefile.pr-3832.getyourrefund-testing.org/en

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.159.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-159-171.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

c58074567ebac3cbe5fd1d0bf643a99e80758b6edd7190c67f61b5fd2054f0a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://statefile.pr-3832.getyourrefund-testing.org/en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Fri, 01 Dec 2023 09:09:30 GMT
Content-Encoding: br
Via: 1.1 vegur
Strict-Transport-Security: max-age=63072000; includeSubDomains
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: Cowboy
Last-Modified: Fri, 01 Dec 2023 09:04:47 GMT
Vary: accept-encoding
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D"}]}
Content-Type: application/javascript
Cache-Control: public, max-age=31536000
Connection: keep-alive
Content-Length: 2830
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D

GET
H/1.1 200
OK checkbox-logo--white-252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e.png
statefile.pr-3832.getyourrefund-testing.org/assets/ 363 B
1 KB 333ms
114ms Image
image/png 54.237.159.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://statefile.pr-3832.getyourrefund-testing.org/assets/checkbox-logo--white-252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e.png

Requested by

Host: statefile.pr-3832.getyourrefund-testing.org
URL: https://statefile.pr-3832.getyourrefund-testing.org/en

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.159.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-159-171.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://statefile.pr-3832.getyourrefund-testing.org/en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Fri, 01 Dec 2023 09:09:30 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Via: 1.1 vegur
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: Cowboy
Last-Modified: Fri, 01 Dec 2023 09:02:43 GMT
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D"}]}
Content-Type: image/png
Cache-Control: public, max-age=31536000
Connection: keep-alive
Content-Length: 363
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D

GET
H/1.1 200
OK checkbox-logo--white-252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e.png
statefile.pr-3832.getyourrefund-testing.org/assets/ 363 B
1 KB 112ms
112ms Image
image/png 54.237.159.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://statefile.pr-3832.getyourrefund-testing.org/assets/checkbox-logo--white-252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e.png

Requested by

Host: statefile.pr-3832.getyourrefund-testing.org
URL: https://statefile.pr-3832.getyourrefund-testing.org/assets/application-e2dcbad71a000a194e2197b62225d888d51f0c956355ad4c398882a7cd1a430d.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.159.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-159-171.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://statefile.pr-3832.getyourrefund-testing.org/assets/application-e2dcbad71a000a194e2197b62225d888d51f0c956355ad4c398882a7cd1a430d.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Fri, 01 Dec 2023 09:09:31 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
Via: 1.1 vegur
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: Cowboy
Last-Modified: Fri, 01 Dec 2023 09:02:43 GMT
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D"}]}
Content-Type: image/png
Cache-Control: public, max-age=31536000
Connection: keep-alive
Content-Length: 363
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1701421771&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=DAG73Z7JdK0IY4nIm5OgPsgRs0QPK3t6ZWXtxXdES0A%3D

GET
H2 200 ijwGs572Xtc6ZYQws9YVwllKVG8qX1oyOymuFpmJxAco.woff2
fonts.gstatic.com/s/publicsans/v15/ 14 KB
15 KB 78ms
17ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/publicsans/v15/ijwGs572Xtc6ZYQws9YVwllKVG8qX1oyOymuFpmJxAco.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Public%20Sans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9707fd1d120b6fd56804438c1c0879cee23233534149a1a4a7782ca1f40121ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://statefile.pr-3832.getyourrefund-testing.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 09:41:21 GMT
x-content-type-options: nosniff
age: 516490
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14648
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 23:34:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 09:41:21 GMT

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			statefile.pr-3832.getyourrefund-testing.org/	1970-01-21 02:13:01	Name: visitor_id Value: ByuT%2FLeNDCrkdRrqVZamzC5MLiUlApRIE%2B4hkPORJjyfDbAGnO07vvoxXwAwCcjkbkRm5vqfhXNKuHMDP8keo7J8%2FnRuZbwVCNmc9Ylm7%2FYbfYwoGexrWNEDHCKkc4BrbOTLA6JYQ8JglgbHHgMZ9pxO1khdaoJLkhhC6cTBZxJwO5oCvQDtcXUNKQNO%2FHNrhpe3d2JzQJbf%2F8wL--bVRJdhvo2%2FcU%2Boy9--3ZrQpHWzVFYNXy0TD0Bqgg%3D%3D
			statefile.pr-3832.getyourrefund-testing.org/	1969-12-31 23:59:59	Name: _vita_min_session Value: 9UbLnQvKJfProxobipvQXY7KwMnZmolkF7M76HaDjejtWq%2BpR1erLkWvjeJd%2Bo5doFrb9oAgM2TRXNUsVA0zR1k4C6sysx2STWTEtDPh%2BBo%2FqbMgWFkYS0ITYy6otfnSEJKW40M0kHwbJP3bY4XnpOmkMQvY9eLJXRs213dOoKbrQFZaEkS6aGQU%2Fg8QO66Ir4hM8VrPqU50lFmPtnW1cHUNGqNVky1u3Nuq0lUdLGp1bEHmF%2FdCUsZnutuYkADZYcyhgCgAwcEA2ABFLS0R43C%2FMnjXGIgk70CEU8WpotcxyUhhpG1fosfUuoiNdX%2FGag%3D%3D--%2Fcb04awJYt9M%2FwTt--gs5A6bxpwXZuJ%2FPnxIThAw%3D%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
statefile.pr-3832.getyourrefund-testing.org
2a00:1450:4001:810::2003
2a00:1450:4001:827::200a
54.237.159.171
0ace8426ff5822402c0e93a97abf8e3ac2cdfba9a9b9b9e7ff70da852bb82996
0da9ee1014a856cc3bb66384e8f00841eb30aa50b97f828195d9fae7bc062ab2
1580331be0ce4c6908f21a3c3f816c61c8c92a8d2e12a6ccea033d4fee6d4eca
252f6970859e7b1ba37367e7820af3472b45415066bb501fae76813011fde48e
39bf348672cc007a104bd4ea4fce57a311b8d9a750fe565bb46c84043761d025
8016cb4e83d080bc8cc996f8dd432be75ad329a814a3b8f9e3d24fb8779d2cbc
9707fd1d120b6fd56804438c1c0879cee23233534149a1a4a7782ca1f40121ad
b4bbca17dde30ca7c1ebeef9eacb9bc8705ca76f4089911a3c60500eb2e17224
c58074567ebac3cbe5fd1d0bf643a99e80758b6edd7190c67f61b5fd2054f0a8
fdebb880bf08c8e7ff4ec28dae39abfbe2783294dc5464292571a807e64f0c59

statefile.pr-3832.getyourrefund-testing.org Open in urlscan Pro 54.237.159.171 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

197 kBTransfer

768 kBSize

2 Cookies

5 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

statefile.pr-3832.getyourrefund-testing.org Open in urlscan Pro
54.237.159.171 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

197 kB
Transfer

768 kB
Size

2
Cookies

11 HTTP transactions
0 data transactions