epa.com.uy Open in urlscan Pro
66.71.240.30 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://wmwr.ca/ref/
Effective URL:
https://epa.com.uy/login_web-clients/start.html
Submission: On June 10 via automatic, source openphish (June 10th 2021, 12:30:10 am UTC)

Summary HTTP 11 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 66.71.240.30, located in Atlanta, United States and belongs to PERFORMIVE, US. The main domain is epa.com.uy.
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on March 10th 2021. Valid for: a year.

This is the only time epa.com.uy was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) IRS (Government)

Domain & IP information

	IP Address	AS Autonomous System
1	172.98.66.114 172.98.66.114	46562 (PERFORMIVE) (PERFORMIVE)
10	66.71.240.30 66.71.240.30	46562 (PERFORMIVE) (PERFORMIVE)
11	2

1 172.98.66.114 (Toronto, Canada)

ASN46562 (PERFORMIVE, US)
PTR: serv-11884.infotechonline.ca

wmwr.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 66.71.240.30 (Atlanta, United States)

ASN46562 (PERFORMIVE, US)
PTR: server.serversitios.com

epa.com.uy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	epa.com.uy epa.com.uy	52 KB
1	wmwr.ca wmwr.ca	349 B
11	2

	Domain	Requested by
10	epa.com.uy	wmwr.ca epa.com.uy
1	wmwr.ca
11	2

This site contains links to these domains. Also see Links.

Domain
www.irs.gov

Subject Issuer	Validity	Valid
wmwr.ca cPanel, Inc. Certification Authority	`2021-05-25` - `2021-08-23`	3 months	crt.sh
www.epa.com.uy RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-03-10` - `2022-03-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://epa.com.uy/login_web-clients/start.html
Frame ID: A7950D333F269D498574FA296435FD26
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://wmwr.ca/ref/ Page URL
https://epa.com.uy/login_web-clients/start.html Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

53 kB
Transfer

50 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.irs.gov/
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://wmwr.ca/ref/ Page URL
https://epa.com.uy/login_web-clients/start.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
wmwr.ca/ref/ 107 B
349 B 434ms
111ms Document
text/html 172.98.66.114
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://wmwr.ca/ref/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 172.98.66.114 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS: serv-11884.infotechonline.ca
Software: Apache /
Resource Hash: 871effcf730995b3c701aeded127d8f072e41dd1f21ad3c1a86b18cebe5fc128

Request headers

Host: wmwr.ca
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 10 Jun 2021 00:29:43 GMT
Server: Apache
Last-Modified: Wed, 09 Jun 2021 17:37:56 GMT
Accept-Ranges: bytes
Content-Length: 107
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK Primary Request start.html Show response
epa.com.uy/login_web-clients/ 4 KB
5 KB 365ms
121ms Document
text/html 66.71.240.30
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://epa.com.uy/login_web-clients/start.html
Requested by: Host: wmwr.ca
URL: https://wmwr.ca/ref/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.71.240.30 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server.serversitios.com
Software: Apache /
Resource Hash: deb778950898e1930330cd8eb6fe0e062b0dbb2572340d06509c7fe9f48ebb51

Request headers

Host: epa.com.uy
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://wmwr.ca/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://wmwr.ca/

Response headers

Date: Thu, 10 Jun 2021 00:29:44 GMT
Server: Apache
Last-Modified: Wed, 13 Jun 2018 13:14:24 GMT
Accept-Ranges: bytes
Content-Length: 4390
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK c.js Show response
epa.com.uy/login_web-clients/ 12 KB
12 KB 124ms
124ms Script
application/javascript 66.71.240.30
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://epa.com.uy/login_web-clients/c.js
Requested by: Host: epa.com.uy
URL: https://epa.com.uy/login_web-clients/start.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.71.240.30 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server.serversitios.com
Software: Apache /
Resource Hash: 344ce7ae9a0179e949d1daf2b1811828294ec092ebdd622a7d8f2f379e801823

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: epa.com.uy
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://epa.com.uy/login_web-clients/start.html
Connection: keep-alive
Referer: https://epa.com.uy/login_web-clients/start.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 10 Jun 2021 00:29:44 GMT
Last-Modified: Wed, 19 Apr 2017 06:28:04 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 12315

GET
H/1.1 200
OK navigation-gecko.css
epa.com.uy/login_web-clients/c/ 3 KB
3 KB 247ms
121ms Stylesheet
text/css 66.71.240.30
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://epa.com.uy/login_web-clients/c/navigation-gecko.css
Requested by: Host: epa.com.uy
URL: https://epa.com.uy/login_web-clients/start.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.71.240.30 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server.serversitios.com
Software: Apache /
Resource Hash: 66542a133de9a0b879c90265a584c5405eb8d7532c3639d696801dcf1c924e4b

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: epa.com.uy
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Connection: keep-alive
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 10 Jun 2021 00:29:44 GMT
Last-Modified: Tue, 12 Jun 2018 23:00:16 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 3106

GET
H/1.1 200
OK styles-gecko.css
epa.com.uy/login_web-clients/c/ 12 KB
13 KB 355ms
118ms Stylesheet
text/css 66.71.240.30
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://epa.com.uy/login_web-clients/c/styles-gecko.css
Requested by: Host: epa.com.uy
URL: https://epa.com.uy/login_web-clients/start.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.71.240.30 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server.serversitios.com
Software: Apache /
Resource Hash: 112b4d6249381eee495c7d298379c1e5516754e3608300c8ad343566bad5d172

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: epa.com.uy
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Connection: keep-alive
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 10 Jun 2021 00:29:44 GMT
Last-Modified: Tue, 12 Jun 2018 23:00:24 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 12782

GET
H/1.1 200
OK icce-gecko.css
epa.com.uy/login_web-clients/c/ 14 KB
15 KB 363ms
121ms Stylesheet
text/css 66.71.240.30
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://epa.com.uy/login_web-clients/c/icce-gecko.css
Requested by: Host: epa.com.uy
URL: https://epa.com.uy/login_web-clients/start.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.71.240.30 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server.serversitios.com
Software: Apache /
Resource Hash: 3754ac8cbcec1a68eb87213d27ff04d2768beb4b9e11b934f1ca333d6a796620

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: epa.com.uy
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Connection: keep-alive
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 10 Jun 2021 00:29:44 GMT
Last-Modified: Tue, 12 Jun 2018 23:00:32 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 14607

GET
H/1.1 200
OK irslogo.gif
epa.com.uy/login_web-clients/c/ 2 KB
3 KB 242ms
121ms Image
image/gif 66.71.240.30
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://epa.com.uy/login_web-clients/c/irslogo.gif
Requested by: Host: epa.com.uy
URL: https://epa.com.uy/login_web-clients/start.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.71.240.30 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server.serversitios.com
Software: Apache /
Resource Hash: c3c2be650f8b26f1440136df0eb1d3f7c37dfa69c77dd86cc42d8cd9013d4640

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: epa.com.uy
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://epa.com.uy/login_web-clients/start.html
Connection: keep-alive
Referer: https://epa.com.uy/login_web-clients/start.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 10 Jun 2021 00:29:44 GMT
Last-Modified: Tue, 12 Jun 2018 23:01:06 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 2483

GET
H/1.1 200
OK 1x1-transparent.gif
epa.com.uy/login_web-clients/c/ 43 B
284 B 250ms
125ms Image
image/gif 66.71.240.30
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://epa.com.uy/login_web-clients/c/1x1-transparent.gif
Requested by: Host: epa.com.uy
URL: https://epa.com.uy/login_web-clients/start.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.71.240.30 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server.serversitios.com
Software: Apache /
Resource Hash: db5d64a9ea32ed3abb874f295003ef2465cecc2f669efe951930e182c34a5013

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: epa.com.uy
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://epa.com.uy/login_web-clients/start.html
Connection: keep-alive
Referer: https://epa.com.uy/login_web-clients/start.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 10 Jun 2021 00:29:44 GMT
Last-Modified: Tue, 12 Jun 2018 23:01:14 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 43

GET
H/1.1 200
OK 1x1-grey.gif
epa.com.uy/login_web-clients/c/ 43 B
284 B 356ms
118ms Image
image/gif 66.71.240.30
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://epa.com.uy/login_web-clients/c/1x1-grey.gif
Requested by: Host: epa.com.uy
URL: https://epa.com.uy/login_web-clients/start.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.71.240.30 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server.serversitios.com
Software: Apache /
Resource Hash: 984f0a18749fb1ecb93ac942a469036db3ab53bc67b5ddd05b674f2844dbdff2

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: epa.com.uy
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://epa.com.uy/login_web-clients/start.html
Connection: keep-alive
Referer: https://epa.com.uy/login_web-clients/start.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 10 Jun 2021 00:29:44 GMT
Last-Modified: Tue, 12 Jun 2018 23:01:24 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 43

GET
H/1.1 200
OK red-arrow.gif
epa.com.uy/login_web-clients/c/ 184 B
425 B 242ms
120ms Image
image/gif 66.71.240.30
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://epa.com.uy/login_web-clients/c/red-arrow.gif
Requested by: Host: epa.com.uy
URL: https://epa.com.uy/login_web-clients/start.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.71.240.30 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server.serversitios.com
Software: Apache /
Resource Hash: b7e3f5fe3264de4a77fdeddcb4d9c51b00d2f4c7b938d397c82540eedc450b37

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: epa.com.uy
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://epa.com.uy/login_web-clients/start.html
Connection: keep-alive
Referer: https://epa.com.uy/login_web-clients/start.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 10 Jun 2021 00:29:44 GMT
Last-Modified: Tue, 12 Jun 2018 23:02:16 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 184

GET
H/1.1 404
Not Found top-transparent.gif
epa.com.uy/login_web-clients/images/en/ 1 KB
1 KB 163ms
163ms Image
text/html 66.71.240.30
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://epa.com.uy/login_web-clients/images/en/top-transparent.gif

Requested by

Host: epa.com.uy
URL: https://epa.com.uy/login_web-clients/c/icce-gecko.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

66.71.240.30 Atlanta, United States, ASN46562 (PERFORMIVE, US),

Reverse DNS

server.serversitios.com

Software

Apache /

Resource Hash

2f00779d7a25ef918f4c7c9129c2e3f3a4bc48b552000196d552b93eaea2c79f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: epa.com.uy
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://epa.com.uy/login_web-clients/c/icce-gecko.css
Connection: keep-alive
Referer: https://epa.com.uy/login_web-clients/c/icce-gecko.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 10 Jun 2021 00:29:44 GMT
X-Content-Type-Options: nosniff
Server: Apache
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, private
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
X-UA-Compatible: IE=edge

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) IRS (Government)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

epa.com.uy
wmwr.ca
172.98.66.114
66.71.240.30
112b4d6249381eee495c7d298379c1e5516754e3608300c8ad343566bad5d172
2f00779d7a25ef918f4c7c9129c2e3f3a4bc48b552000196d552b93eaea2c79f
344ce7ae9a0179e949d1daf2b1811828294ec092ebdd622a7d8f2f379e801823
3754ac8cbcec1a68eb87213d27ff04d2768beb4b9e11b934f1ca333d6a796620
66542a133de9a0b879c90265a584c5405eb8d7532c3639d696801dcf1c924e4b
871effcf730995b3c701aeded127d8f072e41dd1f21ad3c1a86b18cebe5fc128
984f0a18749fb1ecb93ac942a469036db3ab53bc67b5ddd05b674f2844dbdff2
b7e3f5fe3264de4a77fdeddcb4d9c51b00d2f4c7b938d397c82540eedc450b37
c3c2be650f8b26f1440136df0eb1d3f7c37dfa69c77dd86cc42d8cd9013d4640
db5d64a9ea32ed3abb874f295003ef2465cecc2f669efe951930e182c34a5013
deb778950898e1930330cd8eb6fe0e062b0dbb2572340d06509c7fe9f48ebb51

epa.com.uy Open in urlscan Pro 66.71.240.30 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

53 kBTransfer

50 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

24 JavaScript Global Variables

0 Cookies

Indicators

epa.com.uy Open in urlscan Pro
66.71.240.30 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

53 kB
Transfer

50 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!