urlscan.io logo urlscan.io
SecurityTrails logo

refund-tax-verify.com Open in urlscan Pro
198.54.116.99  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://refund-tax-verify.com/claim/refund/email
Submission: On January 20 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 198.54.116.99, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is refund-tax-verify.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 18th 2021. Valid for: a year.
This is the only time refund-tax-verify.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

IP Address AS Autonomous System
9 198.54.116.99 22612 (NAMECHEAP...)
9 1
Apex Domain
Subdomains		 Transfer
9 refund-tax-verify.com
refund-tax-verify.com
72 KB
9 1
Domain Requested by
9 refund-tax-verify.com refund-tax-verify.com
9 1

This site contains no links.

Subject Issuer Validity Valid
refund-tax-verify.com
Sectigo RSA Domain Validation Secure Server CA		 2021-01-18 -
2022-01-18		 a year crt.sh

This page contains 1 frames:

Primary Page: https://refund-tax-verify.com/claim/refund/email
Frame ID: 0AAC8CEA07183DCA37F3D200F2E1E509
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

72 kB
Transfer

245 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request email
refund-tax-verify.com/claim/refund/ 		7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://refund-tax-verify.com/claim/refund/email
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.99 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server219-4.web-hosting.com
Software
Apache / PHP/7.2.34
Resource Hash
17e35b80b4959ce8e016888c4f18d99ee9e6471c86fa865ca419d4a5d45cad75

Request headers

:method
GET
:authority
refund-tax-verify.com
:scheme
https
:path
/claim/refund/email
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:21:44 GMT
server
Apache
x-powered-by
PHP/7.2.34
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
set-cookie
PHPSESSID=0c15a34b39df76e87e4ce64b7a2f30d4; path=/
vary
Accept-Encoding
content-encoding
gzip
content-length
2140
content-type
text/html; charset=UTF-8
jquery-3.2.1.min.js
refund-tax-verify.com/claim/refund/code_files/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://refund-tax-verify.com/claim/refund/code_files/jquery-3.2.1.min.js
Requested by
Host: refund-tax-verify.com
URL: https://refund-tax-verify.com/claim/refund/email
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.99 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server219-4.web-hosting.com
Software
Apache /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Referer
https://refund-tax-verify.com/claim/refund/email
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:21:46 GMT
content-encoding
gzip
last-modified
Fri, 13 Mar 2020 03:32:54 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
30138
jquery.validate.js
refund-tax-verify.com/claim/refund/code_files/ 		47 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://refund-tax-verify.com/claim/refund/code_files/jquery.validate.js
Requested by
Host: refund-tax-verify.com
URL: https://refund-tax-verify.com/claim/refund/email
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.99 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server219-4.web-hosting.com
Software
Apache /
Resource Hash
3980637d10c8be157e33048db192981d022c22a028fce4f54b77b65c75041c5a

Request headers

Referer
https://refund-tax-verify.com/claim/refund/email
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:21:46 GMT
content-encoding
gzip
last-modified
Fri, 13 Mar 2020 03:32:54 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
12771
main.css
refund-tax-verify.com/claim/refund/assets/css/ 		41 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://refund-tax-verify.com/claim/refund/assets/css/main.css
Requested by
Host: refund-tax-verify.com
URL: https://refund-tax-verify.com/claim/refund/email
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.99 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server219-4.web-hosting.com
Software
Apache /
Resource Hash
32bf41d94114aa835fcd68acf7994e3e85f999ab3ceb84a0fc77e2086e2305c1

Request headers

Referer
https://refund-tax-verify.com/claim/refund/email
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:21:46 GMT
content-encoding
gzip
last-modified
Fri, 13 Mar 2020 03:32:54 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
7224
3d.css
refund-tax-verify.com/claim/refund/code_files/ 		57 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://refund-tax-verify.com/claim/refund/code_files/3d.css
Requested by
Host: refund-tax-verify.com
URL: https://refund-tax-verify.com/claim/refund/email
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.99 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server219-4.web-hosting.com
Software
Apache /
Resource Hash
2148131db38b66fa8205e59afe1de159557c478a33b6de8e27adcc44fdb4b123

Request headers

Referer
https://refund-tax-verify.com/claim/refund/email
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:21:46 GMT
content-encoding
gzip
last-modified
Fri, 13 Mar 2020 03:32:54 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
9923
logo.png
refund-tax-verify.com/claim/refund/assets/img/ 		780 B
901 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://refund-tax-verify.com/claim/refund/assets/img/logo.png
Requested by
Host: refund-tax-verify.com
URL: https://refund-tax-verify.com/claim/refund/email
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.99 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server219-4.web-hosting.com
Software
Apache /
Resource Hash
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6

Request headers

Referer
https://refund-tax-verify.com/claim/refund/email
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:21:47 GMT
last-modified
Fri, 13 Mar 2020 03:32:54 GMT
server
Apache
accept-ranges
bytes
content-length
780
content-type
image/png
eml.png
refund-tax-verify.com/claim/refund/code_files/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://refund-tax-verify.com/claim/refund/code_files/eml.png
Requested by
Host: refund-tax-verify.com
URL: https://refund-tax-verify.com/claim/refund/email
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.99 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server219-4.web-hosting.com
Software
Apache /
Resource Hash
da042e37f35efac8e3f64cf4085fed673b04de4847647500937b5e0d4e1f021e

Request headers

Referer
https://refund-tax-verify.com/claim/refund/email
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:21:47 GMT
last-modified
Fri, 13 Mar 2020 03:32:54 GMT
server
Apache
accept-ranges
bytes
content-length
4695
content-type
image/png
o.png
refund-tax-verify.com/claim/refund/assets/img/ 		761 B
882 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://refund-tax-verify.com/claim/refund/assets/img/o.png
Requested by
Host: refund-tax-verify.com
URL: https://refund-tax-verify.com/claim/refund/assets/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.99 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server219-4.web-hosting.com
Software
Apache /
Resource Hash
c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042

Request headers

Referer
https://refund-tax-verify.com/claim/refund/assets/css/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:21:47 GMT
last-modified
Fri, 13 Mar 2020 03:32:54 GMT
server
Apache
accept-ranges
bytes
content-length
761
content-type
image/png
logo2.png
refund-tax-verify.com/claim/refund/assets/img/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://refund-tax-verify.com/claim/refund/assets/img/logo2.png
Requested by
Host: refund-tax-verify.com
URL: https://refund-tax-verify.com/claim/refund/assets/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.99 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server219-4.web-hosting.com
Software
Apache /
Resource Hash
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b

Request headers

Referer
https://refund-tax-verify.com/claim/refund/assets/css/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:21:47 GMT
last-modified
Fri, 13 Mar 2020 03:32:54 GMT
server
Apache
accept-ranges
bytes
content-length
3584
content-type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| form object| button

1 Cookies

Domain/Path Name / Value
refund-tax-verify.com/ Name: PHPSESSID
Value: 0c15a34b39df76e87e4ce64b7a2f30d4