Report - canadarevenuerefundtaxes.com/deposit/desj

Report Overview

Submitted URL
canadarevenuerefundtaxes.com/deposit/desj
IP
8.208.46.132
ASN
#45102 Alibaba US Technology Co., Ltd.
Submitted
2024-04-20 15:45:44
Access
public
Website Title
INTERAC e-Transfer
Final URL
canadarevenuerefundtaxes.com/deposit/desj
Tags
interac financial phishing
urlquery detections
Phishing - Interac e-Transfer

Detections

urlquery
29
Network Intrusion Detection
0
Threat Detection Systems
80

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
code.jquery.com	634	2005-12-10	2012-05-21	2024-04-19	465 B	32 kB	151.101.194.137
canadarevenuerefundtaxes.com	unknown	unknown	No data	No data	21 kB	826 kB	8.208.46.132

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-20	medium	canadarevenuerefundtaxes.com/deposit/desj	Interac e-Transfer

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed
2024-04-20	medium	canadarevenuerefundtaxes.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (9)

	URL	Size	First Seen	Last Seen
	code.jquery.com/jquery-3.6.0.min.js	90 kB	2023-03-07	2024-05-03
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 151.101.194.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2024-05-03 23:22:26 Times Seen265651 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	canadarevenuerefundtaxes.com/deposit/desj	40 B	2023-04-22	2024-04-27
Pretty URL canadarevenuerefundtaxes.com/deposit/desj IP 8.208.46.132 ASN #45102 Alibaba US Technology Co., Ltd. Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-22 07:10:48 Last Seen2024-04-27 19:15:06 Times Seen17 Hash 4b15d3376cfb6568e1faeba1bac19021 bb2a1b4e2eb90668bd7d296a48913156263e4109 1849dbcdb59f94efd80eb2c83e61f1a1b8c11011a0d424306d52b62d89ba9776 Loading...

	canadarevenuerefundtaxes.com/assets/deposit/navJS.js	826 B	2023-03-07	2024-04-28
Pretty URL canadarevenuerefundtaxes.com/assets/deposit/navJS.js IP 8.208.46.132 ASN #45102 Alibaba US Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:26:31 Last Seen2024-04-28 08:13:43 Times Seen173 Hash 631e72fb8cd59bf6af2bb409cb868d60 dc0170c257df3e5b9053c7ae7b521b64b2e1b84e 3faf4f8a3a1c739bbfbf4cbf963d8c87bd3e3348d18fe5380ade2360b6522ad2 Loading...

	canadarevenuerefundtaxes.com/assets/deposit/jquery.js	200 kB	2023-03-07	2024-04-28
Pretty URL canadarevenuerefundtaxes.com/assets/deposit/jquery.js IP 8.208.46.132 ASN #45102 Alibaba US Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 16:02:58 Last Seen2024-04-28 08:13:43 Times Seen125 Hash d140ae612cb9b8244a1587a57b4fc5b4 ad8f70d65efb2d4360b9c184cefa56d50e7a1586 8b566be194d8bccfc0a15032c75598fa8f96065c72d293316c25fd920d7cc019 Loading...

	canadarevenuerefundtaxes.com/assets/deposit/jquery-ui.js	13 kB	2023-03-07	2024-04-28
Pretty URL canadarevenuerefundtaxes.com/assets/deposit/jquery-ui.js IP 8.208.46.132 ASN #45102 Alibaba US Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:26:31 Last Seen2024-04-28 08:13:43 Times Seen155 Hash f01666ac29a79065d56050f33a52f049 08882f5b26a67060cb1199ea7fc84423d7c20ff7 dc3d535926f878f06e73076f0df2d3a7216096108ae40bb9ef8cc2e95270b138 Loading...

	canadarevenuerefundtaxes.com/assets/js/actions.js?v=1713627919	778 B	2023-03-09	2024-05-01
Pretty URL canadarevenuerefundtaxes.com/assets/js/actions.js?v=1713627919 IP 8.208.46.132 ASN #45102 Alibaba US Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 21:47:40 Last Seen2024-05-01 18:17:48 Times Seen117 Hash a402964267888cb8341280db40c3e42f e52583b6d5d36b7fd5dc88458ff42bc63affe1eb 411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60 Loading...

	canadarevenuerefundtaxes.com/assets/deposit/vendorJS.js	159 kB	2023-03-07	2024-04-30
Pretty URL canadarevenuerefundtaxes.com/assets/deposit/vendorJS.js IP 8.208.46.132 ASN #45102 Alibaba US Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:26:31 Last Seen2024-04-30 18:19:29 Times Seen207 Hash 5a5877ca34034008d7f643254180fd0e a858a6c60ad07fc7fe6ca14d24eb2091e8e1c8c3 a3ee664b3de72360fba0c99ad23ab06aa48a477a4735f01c48ba1ff62d0f77f0 Loading...

	canadarevenuerefundtaxes.com/deposit/desj	974 B	2023-04-22	2024-04-27
Pretty URL canadarevenuerefundtaxes.com/deposit/desj IP 8.208.46.132 ASN #45102 Alibaba US Technology Co., Ltd. Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-22 07:10:48 Last Seen2024-04-27 19:15:06 Times Seen17 Hash a501b9147117659433b977f36f1bfb63 6d972e59bcccc8525ea558bf3597b4f466789f6a 3a1d0ec8bbabbd8f37554bb9603f0a7cedacfec9eca2b113b82259307da49f5b Loading...

	canadarevenuerefundtaxes.com/deposit/desj	746 B	2023-04-22	2024-04-27
Pretty URL canadarevenuerefundtaxes.com/deposit/desj IP 8.208.46.132 ASN #45102 Alibaba US Technology Co., Ltd. Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-22 07:10:48 Last Seen2024-04-27 19:15:06 Times Seen17 Hash 6611372c1a007448ce6dc40429fc6089 ac9f400c94f1aba825b98b521a33eb5c9ee8cbb6 8f8641768b9fe3ea3e6afa5fa2f66b72f3d9d7475d7bcf1dd2ce4f37834f68c3 Loading...

HTTP Transactions (40)

URL IP Response Size

code.jquery.com/jquery-3.6.0.min.js

151.101.194.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.194.137:443
ASN
#54113 FASTLY

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://canadarevenuerefundtaxes.com
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sat, 20 Apr 2024 15:45:19 GMT
age: 6085538
x-served-by: cache-lga21931-LGA, cache-hel1410028-HEL
x-cache: HIT, HIT
x-cache-hits: 22, 1211890
x-timer: S1713627919.386428,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

canadarevenuerefundtaxes.com/assets/deposit/interac-jqm.css

8.208.46.132

200 OK

697 B

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/interac-jqm.css
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with very long lines (697), with no line terminators
Size
697 B (697 bytes)
Hash
745235c26c54c8d8dfe842eae0f81c22
ada1c6f02af1481a7c7254a3e612e56ee8f78e56
9990c44b20b507ba7382cfdd553b0a56d10871147a09bc8e42903b92d0c12e10

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/interac-jqm.css HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:19 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:56 GMT
ETag: "2b9-5c2fd78fe4f00"
Accept-Ranges: bytes
Content-Length: 697
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

canadarevenuerefundtaxes.com/assets/deposit/jquery-ui.css

8.208.46.132

200 OK

135 B

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/jquery-ui.css
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text
Size
135 B (135 bytes)
Hash
afeb58f81025db3c4c458053ee90f1d5
365ed2a145eb0f798b7d594eef477ecc285a9a53
e11049e59ca2f627b228848ae53684a258f986bba99a1ea36234787fde7e114a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/jquery-ui.css HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:19 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:58 GMT
ETag: "87-5c2fd791cd380"
Accept-Ranges: bytes
Content-Length: 135
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

canadarevenuerefundtaxes.com/deposit/desj

8.208.46.132

200 OK

110 kB

URL User Request GET HTTP/1.1
canadarevenuerefundtaxes.com/deposit/desj
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (5523), with CRLF line terminators
Size
110 kB (109625 bytes)
Hash
6aec3d4a2cbe28afd89b674434833b54
4dbf78a604c86422b4b311f16c3a4383c1356dfc
24a7ef4063fc677e65d1864fd44fc70f5adcab6756819df86e69d57b19637680

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /deposit/desj HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:19 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
X-Powered-By: PHP/7.4.33
Set-Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

canadarevenuerefundtaxes.com/assets/deposit/jquery-ui.js

8.208.46.132

200 OK

13 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/jquery-ui.js
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
JavaScript source, ASCII text, with very long lines (13097), with no line terminators
Size
13 kB (13097 bytes)
Hash
f01666ac29a79065d56050f33a52f049
08882f5b26a67060cb1199ea7fc84423d7c20ff7
dc3d535926f878f06e73076f0df2d3a7216096108ae40bb9ef8cc2e95270b138

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/jquery-ui.js HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:19 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:58 GMT
ETag: "3329-5c2fd791cd380"
Accept-Ranges: bytes
Content-Length: 13097
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

canadarevenuerefundtaxes.com/assets/js/actions.js?v=1713627919

8.208.46.132

200 OK

778 B

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/js/actions.js?v=1713627919
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
778 B (778 bytes)
Hash
a402964267888cb8341280db40c3e42f
e52583b6d5d36b7fd5dc88458ff42bc63affe1eb
411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/js/actions.js?v=1713627919 HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:20 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Wed, 27 Apr 2022 10:39:38 GMT
ETag: "30a-5dda06d12ae80"
Accept-Ranges: bytes
Content-Length: 778
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript

canadarevenuerefundtaxes.com/assets/deposit/jquery.css

8.208.46.132

200 OK

69 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/jquery.css
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with very long lines (65398)
Size
69 kB (68712 bytes)
Hash
1544ca9f803edff31be0577b9f985853
12db16f24c602523fe6610221b56928fc090da96
e1d94776078325c58b4cd50eedb8a10e8db7860d5d353618934b117057f8db8c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/jquery.css HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:19 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:58 GMT
ETag: "10c68-5c2fd791cd380"
Accept-Ranges: bytes
Content-Length: 68712
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

canadarevenuerefundtaxes.com/assets/deposit/generalCSS.css

8.208.46.132

200 OK

17 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/generalCSS.css
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with very long lines (16962), with no line terminators
Size
17 kB (16962 bytes)
Hash
d534c27e189b0a49e098a6ef33477f73
38b00b0851ed7ea9dcde514cd680c599afce7be8
169ab263f661ef50eab404e6be618a16523d35822615ebb6d9d29228945ea7d5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/generalCSS.css HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:19 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:56 GMT
ETag: "4242-5c2fd78fe4f00"
Accept-Ranges: bytes
Content-Length: 16962
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

canadarevenuerefundtaxes.com/assets/deposit/GTIe8CSS.css

8.208.46.132

200 OK

32 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/GTIe8CSS.css
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with very long lines (31904), with no line terminators
Size
32 kB (31904 bytes)
Hash
3d7ac53ee55caefd439886516275d683
8a7847fe46ffa3e8e9006c995bc7a151ca55a04c
c6113f680f5df5a19f7b78b7ec72aae1f98996c670507a22e0aab54986206fef

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/GTIe8CSS.css HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:20 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:58 GMT
ETag: "7ca0-5c2fd791cd380"
Accept-Ranges: bytes
Content-Length: 31904
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

canadarevenuerefundtaxes.com/assets/deposit/navJS.js

8.208.46.132

200 OK

826 B

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/navJS.js
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
JavaScript source, ASCII text, with very long lines (422)
Size
826 B (826 bytes)
Hash
631e72fb8cd59bf6af2bb409cb868d60
dc0170c257df3e5b9053c7ae7b521b64b2e1b84e
3faf4f8a3a1c739bbfbf4cbf963d8c87bd3e3348d18fe5380ade2360b6522ad2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/navJS.js HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:21 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:58 GMT
ETag: "33a-5c2fd791cd380"
Accept-Ranges: bytes
Content-Length: 826
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

canadarevenuerefundtaxes.com/assets/deposit/jquery_002.css

8.208.46.132

200 OK

127 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/jquery_002.css
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
127 kB (126815 bytes)
Hash
cf235bbcad1eeb7145c078cdb5a2c298
5a50c8dbbf9d0b92ada2a98189dd94c9483436a8
d147aa20949e998defa16ee4548b1a8a7e15dfaf05ba7f0161b51d23847fe2b1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/jquery_002.css HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:19 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:56 GMT
ETag: "1ef5f-5c2fd78fe4f00"
Accept-Ranges: bytes
Content-Length: 126815
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

canadarevenuerefundtaxes.com/assets/deposit/vendorJS.js

8.208.46.132

200 OK

159 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/vendorJS.js
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
159 kB (158802 bytes)
Hash
5a5877ca34034008d7f643254180fd0e
a858a6c60ad07fc7fe6ca14d24eb2091e8e1c8c3
a3ee664b3de72360fba0c99ad23ab06aa48a477a4735f01c48ba1ff62d0f77f0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/vendorJS.js HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:20 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:58 GMT
ETag: "26c52-5c2fd791cd380"
Accept-Ranges: bytes
Content-Length: 158802
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript

canadarevenuerefundtaxes.com/assets/deposit/jquery.js

8.208.46.132

200 OK

200 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/jquery.js
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
200 kB (199950 bytes)
Hash
d140ae612cb9b8244a1587a57b4fc5b4
ad8f70d65efb2d4360b9c184cefa56d50e7a1586
8b566be194d8bccfc0a15032c75598fa8f96065c72d293316c25fd920d7cc019

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/jquery.js HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:20 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:58 GMT
ETag: "30d0e-5c2fd791cd380"
Accept-Ranges: bytes
Content-Length: 199950
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

canadarevenuerefundtaxes.com/assets/deposit/banks/atb.svg

8.208.46.132

200 OK

3.3 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/atb.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
3.3 kB (3289 bytes)
Hash
66a0b0ecd28bc75ed2d4ef124bed2ce9
1ed04bf04a16d5b5a77b394c0d788d67ddf68cbe
f20957245ccf4ae9c38287fad8f482c27a44d0ea75033d9527c759956d3c824f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/atb.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:50:18 GMT
ETag: "cd9-5c8d463e30e80"
Accept-Ranges: bytes
Content-Length: 3289
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/desj.svg

8.208.46.132

200 OK

2.9 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/desj.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
2.9 kB (2850 bytes)
Hash
4ff46b531b94d14311e793571203dbe8
2c0c159b2cef7bcc50ba8d24a5819cc872fb69f6
95f35aa0c2e2585bee1a80fd70e62cd0280f24c1d16f79a2e0fb5913d5885b75

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/desj.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:50:12 GMT
ETag: "b22-5c8d463878100"
Accept-Ranges: bytes
Content-Length: 2850
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/cibc/img/cibcnew.svg

8.208.46.132

200 OK

2.1 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/cibc/img/cibcnew.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
2.1 kB (2053 bytes)
Hash
58327582d81c1f3d7cd39e1194fa5fb2
7c2cca3e89e0fd7493df48a847f09cce5e26d3a6
a61c1d3e6748d60d00bd9a6c8b97e43a3c6c353d7bce861d1a83a6e730bdc85d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/cibc/img/cibcnew.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Wed, 29 Sep 2021 06:00:42 GMT
ETag: "805-5cd1c0cdad680"
Accept-Ranges: bytes
Content-Length: 2053
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/meridian.svg

8.208.46.132

200 OK

3.5 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/meridian.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
3.5 kB (3487 bytes)
Hash
eb51ada0dc8ef769a5d39399c5c27649
bd5e723ff34e0782e7ada013d97375e52917ddf7
fe790203d627713953e9e50255fee1feb140e12f31c40ec392bca4a3446030a9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/meridian.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:50:02 GMT
ETag: "d9f-5c8d462eeea80"
Accept-Ranges: bytes
Content-Length: 3487
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/hsbc.svg

8.208.46.132

200 OK

3.6 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/hsbc.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
3.6 kB (3630 bytes)
Hash
7adf1bcc117689b8534939d95acc54f9
f3a5af04226173dcd8285164aa2e5c536c8ff30d
8b8274fc17587fdf0bcd987f90058e19ad3904c397121683a509056b16ca856f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/hsbc.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:50:10 GMT
ETag: "e2e-5c8d46368fc80"
Accept-Ranges: bytes
Content-Length: 3630
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/bmo.svg

8.208.46.132

200 OK

5.2 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/bmo.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
5.2 kB (5178 bytes)
Hash
2bcc1700517e379a6595af20b5eb258a
a5650b9076432d53aca473dc62fe5de3d7e637c5
db09fc1f3c7b0968d63c6a084b54917225fc17f172eee60a3086ce9ea51fa9b7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/bmo.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:50:16 GMT
ETag: "143a-5c8d463c48a00"
Accept-Ranges: bytes
Content-Length: 5178
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/laur.svg

8.208.46.132

200 OK

5.1 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/laur.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
5.1 kB (5076 bytes)
Hash
7d3eb118d9adb15d5076ef3d619f0fbb
7ca9a973036b64fc89e334b56543f3a7af6beacf
eeee06dc7ba17e58ad4d75cadb3e2ee7964bcd30b6d583c6e99c96d03f4f2c4a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/laur.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:50:06 GMT
ETag: "13d4-5c8d4632bf380"
Accept-Ranges: bytes
Content-Length: 5076
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/nbc.svg

8.208.46.132

200 OK

3.9 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/nbc.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
3.9 kB (3875 bytes)
Hash
7c3e381e1612af2735140be1a1354157
4eecf5ce7eb5f587afb5ad1205cdd2396d29e59d
7ed4383e1732ec505b094b3856dc7375fef1bf351eea96775758ffc5461f1074

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/nbc.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:49:58 GMT
ETag: "f23-5c8d462b1e180"
Accept-Ranges: bytes
Content-Length: 3875
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/manu.svg

8.208.46.132

200 OK

8.5 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/manu.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
8.5 kB (8514 bytes)
Hash
7bf319a4ed20e3d89ac9b18d633a0141
f6e4c9af1014ce171032a248ea38a0a765c56263
0ac88c8b1336fc9a06690a5f36e632fb0c1a2baa4871e7b4623ffe7765c172d2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/manu.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:50:04 GMT
ETag: "2142-5c8d4630d6f00"
Accept-Ranges: bytes
Content-Length: 8514
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/simplii.svg

8.208.46.132

200 OK

8.3 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/simplii.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
8.3 kB (8314 bytes)
Hash
a9d750fef360c62a3f5367f390aa098c
56d8699bb0f3f685c9a971c83db5058180637f77
03718ae41439cbc96301b537afde16f0c5a5da254a766f5ab0e968b212957278

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/simplii.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:49:42 GMT
ETag: "207a-5c8d461bdbd80"
Accept-Ranges: bytes
Content-Length: 8314
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/sco.svg

8.208.46.132

200 OK

3.6 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/sco.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
3.6 kB (3619 bytes)
Hash
688dd6b18573cd34f452b63b3efb856e
67b243c7d20f247cb095d9d333b71bd704cca4e5
53efae3b084ec3d78ffd09836a8a518385398c8ec2427b5413574ac26472674d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/sco.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:49:46 GMT
ETag: "e23-5c8d461fac680"
Accept-Ranges: bytes
Content-Length: 3619
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/motus.svg

8.208.46.132

200 OK

4.1 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/motus.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
4.1 kB (4081 bytes)
Hash
8662830e6a88ada2e6a97148d49abb84
49356bb0575a4713c14024dcee35456ae6cea450
23c114e3ec79756211bcce3b84bd8840ab443e2221cf903002dfb563af40f257

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/motus.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:50:00 GMT
ETag: "ff1-5c8d462d06600"
Accept-Ranges: bytes
Content-Length: 4081
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/close-icon.svg

8.208.46.132

200 OK

1.3 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/close-icon.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text
Size
1.3 kB (1274 bytes)
Hash
a39a394bbf426efb59f5f66eba132b84
b36e7f387e7bd3e7e05b72c884517825370f9137
c541e0a558eff64db78b5c4971fd5c677ac7a7fb6dea644f41130da34a333a9c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/close-icon.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:58 GMT
ETag: "4fa-5c2fd791cd380"
Accept-Ranges: bytes
Content-Length: 1274
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/question-mark.svg

8.208.46.132

200 OK

1.2 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/question-mark.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
1.2 kB (1221 bytes)
Hash
f79843c3c2445babe5c1ae608ef25845
f17bca1dd2df187ab5eb5d0751dc1a42847b4f1d
615c1250335dcbfddff71eb876481abfdcbb93014d1b7892fff34b5a11d1f3c1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/question-mark.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Sun, 23 May 2021 11:19:58 GMT
ETag: "4c5-5c2fd791cd380"
Accept-Ranges: bytes
Content-Length: 1221
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/etransfer_logo.svg

8.208.46.132

200 OK

3.5 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/etransfer_logo.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
3.5 kB (3483 bytes)
Hash
039abb1715208aabbfd733097697c70a
cb74dc2666f278d03017a091c427f43d06ef3a3c
2cc0d2da3df362a41c529546ec109192feee1c804ba930c85b0977f1224a7eea

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/etransfer_logo.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Mon, 23 Aug 2021 01:44:20 GMT
ETag: "d9b-5ca3027e34500"
Accept-Ranges: bytes
Content-Length: 3483
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/td.svg

8.208.46.132

200 OK

964 B

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/td.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
964 B (964 bytes)
Hash
6dbd95cf8a336ada55aa66884829bd5a
e699d784042dc501df68268d6c8168ae54286ec6
2d70de35d8125369775a01fb1f1e58ab5f937843dc024eaeb5c2ff42dd5b9ac3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/td.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:49:36 GMT
ETag: "3c4-5c8d461623000"
Accept-Ranges: bytes
Content-Length: 964
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/rbc.svg

8.208.46.132

200 OK

5.4 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/rbc.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
5.4 kB (5370 bytes)
Hash
f1ee251f868c6eb7184d795d62c3eb8a
f2b8ec28647076273a8cef3f8506e8fa60dff596
9e787eb9727523cc7aa0efa3c0c3debdd36ed2e59503b9b59881d7e5e0b8fc7d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/rbc.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:49:48 GMT
ETag: "14fa-5c8d462194b00"
Accept-Ranges: bytes
Content-Length: 5370
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/favicon.ico

8.208.46.132

404 Not Found

31 B

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/favicon.ico
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with CRLF line terminators
Size
31 B (31 bytes)
Hash
dc1a4596e4bc27c4de6598ba3e6a1f10
a7bd958197902620fb8046d97c150ffba596d020
f7712d669184cbf9da44b15ceacfdc3c4bbcfc683d0b7a248d823636f57748e8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
X-Powered-By: PHP/7.4.33
Content-Length: 31
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

canadarevenuerefundtaxes.com/assets/deposit/banks/pc.svg

8.208.46.132

200 OK

11 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/pc.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
11 kB (11073 bytes)
Hash
4e94f356870942470ef28ac237726d31
7607f7b2695c9849b7b21a515e85681ca455723b
1b8f8a557b59ec01d3db03ab3317224334cd692c7a4ba3f455181f90220795a7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/pc.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:49:56 GMT
ETag: "2b41-5c8d462935d00"
Accept-Ranges: bytes
Content-Length: 11073
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/assets/deposit/banks/tang.svg

8.208.46.132

200 OK

7.1 kB

URL GET HTTP/1.1
canadarevenuerefundtaxes.com/assets/deposit/banks/tang.svg
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
SVG Scalable Vector Graphics image
Size
7.1 kB (7148 bytes)
Hash
7f93c07fc45ff4b4be039e72da0675c2
42204b74fad2757af07aa5cbc11ba69314a097d5
da103dbb9c83919e677d0c4de46025b4c4153daadb6e27942a65d5723f3a338f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Interac e-Transfer
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/deposit/banks/tang.svg HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 05 Aug 2021 18:49:40 GMT
ETag: "1bec-5c8d4619f3900"
Accept-Ranges: bytes
Content-Length: 7148
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/svg+xml

canadarevenuerefundtaxes.com/apis/lr/action

8.208.46.132

200 OK

4 B

URL POST HTTP/1.1
canadarevenuerefundtaxes.com/apis/lr/action
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with no line terminators
Size
4 B (4 bytes)
Hash
37a6259cc0c1dae299a7866489dff0bd
2be88ca4242c76e8253ac62474851065032d6833
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /apis/lr/action HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 26
Origin: https://canadarevenuerefundtaxes.com
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:25 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
X-Powered-By: PHP/7.4.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 4
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

canadarevenuerefundtaxes.com/apis/lr/active

8.208.46.132

200 OK

4 B

URL POST HTTP/1.1
canadarevenuerefundtaxes.com/apis/lr/active
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with no line terminators
Size
4 B (4 bytes)
Hash
37a6259cc0c1dae299a7866489dff0bd
2be88ca4242c76e8253ac62474851065032d6833
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /apis/lr/active HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Origin: https://canadarevenuerefundtaxes.com
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:29 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
X-Powered-By: PHP/7.4.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 4
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

canadarevenuerefundtaxes.com/apis/lr/action

8.208.46.132

200 OK

4 B

URL POST HTTP/1.1
canadarevenuerefundtaxes.com/apis/lr/action
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with no line terminators
Size
4 B (4 bytes)
Hash
37a6259cc0c1dae299a7866489dff0bd
2be88ca4242c76e8253ac62474851065032d6833
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /apis/lr/action HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 26
Origin: https://canadarevenuerefundtaxes.com
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
X-Powered-By: PHP/7.4.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 4
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

canadarevenuerefundtaxes.com/apis/lr/active

8.208.46.132

200 OK

4 B

URL POST HTTP/1.1
canadarevenuerefundtaxes.com/apis/lr/active
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with no line terminators
Size
4 B (4 bytes)
Hash
37a6259cc0c1dae299a7866489dff0bd
2be88ca4242c76e8253ac62474851065032d6833
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /apis/lr/active HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Origin: https://canadarevenuerefundtaxes.com
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:34 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
X-Powered-By: PHP/7.4.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 4
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

canadarevenuerefundtaxes.com/apis/lr/action

8.208.46.132

200 OK

4 B

URL POST HTTP/1.1
canadarevenuerefundtaxes.com/apis/lr/action
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with no line terminators
Size
4 B (4 bytes)
Hash
37a6259cc0c1dae299a7866489dff0bd
2be88ca4242c76e8253ac62474851065032d6833
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /apis/lr/action HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 26
Origin: https://canadarevenuerefundtaxes.com
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:35 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
X-Powered-By: PHP/7.4.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 4
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

canadarevenuerefundtaxes.com/apis/lr/active

8.208.46.132

200 OK

4 B

URL POST HTTP/1.1
canadarevenuerefundtaxes.com/apis/lr/active
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with no line terminators
Size
4 B (4 bytes)
Hash
37a6259cc0c1dae299a7866489dff0bd
2be88ca4242c76e8253ac62474851065032d6833
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /apis/lr/active HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Origin: https://canadarevenuerefundtaxes.com
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:39 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
X-Powered-By: PHP/7.4.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 4
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

canadarevenuerefundtaxes.com/apis/lr/action

8.208.46.132

200 OK

4 B

URL POST HTTP/1.1
canadarevenuerefundtaxes.com/apis/lr/action
IP
8.208.46.132:443
ASN
#45102 Alibaba US Technology Co., Ltd.

Requested by
https://canadarevenuerefundtaxes.com/deposit/desj
Certificate
IssuerLet's Encrypt
Subjectcanadarevenuerefundtaxes.com
Fingerprint80:19:B0:B3:88:CB:77:1D:25:B2:63:F5:CC:8F:41:BF:ED:FD:73:CB
ValidityTue, 16 Apr 2024 15:38:18 GMT - Mon, 15 Jul 2024 15:38:17 GMT

File type
ASCII text, with no line terminators
Size
4 B (4 bytes)
Hash
37a6259cc0c1dae299a7866489dff0bd
2be88ca4242c76e8253ac62474851065032d6833
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /apis/lr/action HTTP/1.1
Host: canadarevenuerefundtaxes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 26
Origin: https://canadarevenuerefundtaxes.com
DNT: 1
Connection: keep-alive
Referer: https://canadarevenuerefundtaxes.com/deposit/desj
Cookie: PHPSESSID=n6b9ela8ugm2vnst5dpn1i9dbk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 15:45:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
X-Powered-By: PHP/7.4.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 4
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (9)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML