Security Report: can01.safelinks.protection.outlook.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/29285baf-2098-48eb-8efd-9299a517f722 Domain and IP registration (RDAP)/api/v1/rdap/29285baf-2098-48eb-8efd-9299a517f722How often this domain was scanned/api/v1/domain/stats/can01.safelinks.protection.outlook.com Scan history for this domain/api/v1/domain/history/can01.safelinks.protection.outlook.com?limit=15

This website contacted 10 IPs in 3 countries across 7 domains to perform 27 HTTP transactions. The main domain is outlook.com and was registered 32 years ago.

Submitted URL: https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu118072074.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.3zoogpfFuMN4ws79ubeyvcglLJcD7eZPVZ3hCMev8MWvb5XzUH7n76L-2Fn8Y50Zty1I3YI7RqidbQjAtek-2FD0SryzXzRVQq-2FrjqPgTo6Nxco-3D8i5o_MyRoo-2FgKDJi5q8-2F7KoCH-2B76fuF2k-2BLiITSl96AiBUo5zkGif-2FwwP-2FxL98XK8YbdmbQr72ITUVoSio2v2PnAtKaOVqheM-2Fotq-2BMolW6Ux5zR-2Fx6YekcOwKSRvS-2B2GLETCF1MVBKu-2BEVcKMKpeYjmiC4vGbjKZ2uB0CQQ3GyksCWDj0bpZ7kmWxiFc2ByD2caRGoWA6oiCY-2Fp0xajrJ4T7YA-3D-3D&data=05%7C02%7Cspam%40cra-arc.gc.ca%7C14817012a89247c7338208df3aacca1b%7C4ca51fed92c44f5494c5dcc41cbf1c9e%7C0%7C0%7C639294187107481427%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C40000%7C%7C%7C&sdata=yELpvGZZsCIKkUG1wlrWBf%2FopJC6hUgVuFkNPB8f%2BNA%3D&reserved=0

Effective URL:

https://cra-apply.web.app/

Redirected

The Cisco Umbrella rank of the primary domain is #138 of the top 1 million websitesTop 1K Site

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Fake Canada Revenue Agency tax refund page on cra-apply.web.app collects email and phone numbers and exfiltrates them via a Telegram bot. Redirect chain through SendGrid and ClickFunnels confirms phishing campaign.

Risk Factors (4)

Brand impersonation of a government agency

Data exfiltration via Telegram bot

Deceptive redirect chain through trusted services

Collection of personal information without legitimate purpose

Domain age information unavailable

Details

Page Title

Canada Revenue Agency — Tax Refund

Scan Type

public

Favicon Hash

MMH3: -1443848016

MD5: 12e8dd0cf491bfc71bdb06888ff98b40

Domain Name Analysis

Domain 'can01.safelinks.protection.outlook.com' uses the commercial generic top-level domain (.com) and includes subdomain 'can01.safelinks.protection'. The core label 'outlook' covers 7 characters holding four vowels versus three consonants. Word splitting yields one word: outlook. Expect seven characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.30s

Total Load Time

398 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-CA

Text Length:450 chars

Detector Agreement:75%

Website Classification

Primary Category

government public service50% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

government public service

50%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
9	199.36.158.100Fastly · CDN	United States	AS54113Fastly, Inc.
2	52.102.113.33Azure · CLOUD	Frankfurt am Main, Hesse, Germany	AS8075Microsoft Corporation
2	63.34.147.103Aws · CLOUD	Dublin, Leinster, Ireland	AS16509Amazon.com, Inc.
2	172.64.152.44Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	142.251.110.95Google · CDN	United States	AS15169Google LLC
2	142.250.154.94Google · CDN	United States	AS15169Google LLC
2	142.251.127.94Google · CDN	United States	AS15169Google LLC
2	52.102.113.48Azure · CLOUD	Frankfurt am Main, Hesse, Germany	AS8075Microsoft Corporation
2	54.77.152.7Aws · CLOUD	Dublin, Leinster, Ireland	AS16509Amazon.com, Inc.
2	104.18.35.212Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
27	10	-	-