formulaire-ipt.fr Open in urlscan Pro
193.46.215.132  Malicious Activity! Public Scan

Submitted URL: https://u10188899.ct.sendgrid.net/wf/click?upn=0B931DgrWIeBHKTNqgXwM9Doy6xUgFj-2B4vEn4FVaI05WVN1XlsAWxptNkQsTWr72uQfVotxQBeqsiFwel...
Effective URL: https://formulaire-ipt.fr/
Submission: On February 01 via manual from FR

Summary

This website contacted 5 IPs in 2 countries across 7 domains to perform 10 HTTP transactions. The main IP is 193.46.215.132, located in Germany and belongs to KEY-SYSTEMS-AS Im Oberen Werk 1, DE. The main domain is formulaire-ipt.fr.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 25th 2020. Valid for: 3 months.
This is the only time formulaire-ipt.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Impots Gouv (Government)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.115.54 11377 (SENDGRID)
1 1 173.236.13.234 32475 (SINGLEHOP...)
5 193.46.215.132 196763 (KEY-SYSTE...)
1 23.111.9.35 33438 (HIGHWINDS2)
2 104.20.150.33 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
10 5
Domain Requested by
5 formulaire-ipt.fr formulaire-ipt.fr
1 c.statcounter.com www.statcounter.com
1 fonts.gstatic.com formulaire-ipt.fr
1 fonts.googleapis.com formulaire-ipt.fr
1 www.statcounter.com formulaire-ipt.fr
1 use.fontawesome.com formulaire-ipt.fr
1 garzareyna.com 1 redirects
1 u10188899.ct.sendgrid.net 1 redirects
10 8

This site contains links to these domains. Also see Links.

Domain
www.impots.gouv.fr
Subject Issuer Validity Valid
formulaire-ipt.fr
Let's Encrypt Authority X3
2020-01-25 -
2020-04-24
3 months crt.sh
*.fontawesome.com
DigiCert SHA2 Secure Server CA
2019-10-28 -
2020-12-23
a year crt.sh
us-dallas.statcounter.com
Sectigo RSA Domain Validation Secure Server CA
2019-11-22 -
2020-10-29
a year crt.sh
*.storage.googleapis.com
GTS CA 1O1
2020-01-14 -
2020-04-07
3 months crt.sh
*.google.com
GTS CA 1O1
2020-01-14 -
2020-04-07
3 months crt.sh

This page contains 1 frames:

Primary Page: https://formulaire-ipt.fr/
Frame ID: D8622E1A9415D139866AF4A971246B84
Requests: 10 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://u10188899.ct.sendgrid.net/wf/click?upn=0B931DgrWIeBHKTNqgXwM9Doy6xUgFj-2B4vEn4FVaI05WVN1XlsAWxptNkQsTW... HTTP 302
    https://garzareyna.com/www/access/web_fr/tlsconnct/layer/https/crt HTTP 302
    https://formulaire-ipt.fr/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href="https:\/\/use\.fontawesome\.com\/releases\/v([^>]+)\/css\//i

Overall confidence: 100%
Detected patterns
  • script /statcounter\.com\/counter\/counter/i

Page Statistics

10
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

8
Subdomains

5
IPs

2
Countries

106 kB
Transfer

289 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u10188899.ct.sendgrid.net/wf/click?upn=0B931DgrWIeBHKTNqgXwM9Doy6xUgFj-2B4vEn4FVaI05WVN1XlsAWxptNkQsTWr72uQfVotxQBeqsiFwelIwlsPDv4z7JBMvg4rg2RrpQQME-3D_JBGxee3KyegqRyHKeYvEXFtEFeDVQnlKDb0szMYWLAaZZ5FdbCldG0Ik3kkbMkbhjk9QarqX-2FYzB0fXMkbB5p7CehrAiQqIutLaWNzVLL27L-2FPev2TZ0TWBfghjyREQQ4Jae3Kh1l6wMdqB5NPSy8-2FXstpYE-2FmtJKtKq2irMokJroZFXcQLAsFH2KmLypXXmwC8XkE3nnndxYkFpaV8v5250UudIXkCTKu7PJw8EP0Nu-2BEwkjstXVAk8ESIzW0rC HTTP 302
    https://garzareyna.com/www/access/web_fr/tlsconnct/layer/https/crt HTTP 302
    https://formulaire-ipt.fr/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
formulaire-ipt.fr/
Redirect Chain
  • https://u10188899.ct.sendgrid.net/wf/click?upn=0B931DgrWIeBHKTNqgXwM9Doy6xUgFj-2B4vEn4FVaI05WVN1XlsAWxptNkQsTWr72uQfVotxQBeqsiFwelIwlsPDv4z7JBMvg4rg2RrpQQME-3D_JBGxee3KyegqRyHKeYvEXFtEFeDVQnlKDb0sz...
  • https://garzareyna.com/www/access/web_fr/tlsconnct/layer/https/crt
  • https://formulaire-ipt.fr/
3 KB
2 KB
Document
General
Full URL
https://formulaire-ipt.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.46.215.132 , Germany, ASN196763 (KEY-SYSTEMS-AS Im Oberen Werk 1, DE),
Reverse DNS
web-02.dd24.net
Software
Apache /
Resource Hash
0b4001786296d94ceaa867c942cb54bfb3facd2f9e0c9a07afc7a94e757ca45c

Request headers

Host
formulaire-ipt.fr
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

Date
Sat, 01 Feb 2020 14:29:50 GMT
Server
Apache
Accept-Ranges
none
Vary
Accept-Encoding
Content-Encoding
gzip
Connection
close
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

status
302
server
nginx
date
Sat, 01 Feb 2020 14:29:50 GMT
content-type
text/html; charset=iso-8859-1
content-length
209
location
https://formulaire-ipt.fr
x-proxy-cache
MISS
alt-svc
quic=":443"; ma=86400; v="43,39"
all.css
use.fontawesome.com/releases/v5.8.2/css/
54 KB
14 KB
Stylesheet
General
Full URL
https://use.fontawesome.com/releases/v5.8.2/css/all.css
Requested by
Host: formulaire-ipt.fr
URL: https://formulaire-ipt.fr/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://formulaire-ipt.fr/
Origin
https://formulaire-ipt.fr

Response headers

date
Sat, 01 Feb 2020 14:29:50 GMT
content-encoding
gzip
last-modified
Tue, 07 May 2019 16:50:11 GMT
server
NetDNA-cache/2.2
access-control-allow-origin
*
etag
W/"77cbad34e5ce95e70847b074e05faeab"
vary
Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
status
200
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
counter.js
www.statcounter.com/counter/
33 KB
11 KB
Script
General
Full URL
https://www.statcounter.com/counter/counter.js
Requested by
Host: formulaire-ipt.fr
URL: https://formulaire-ipt.fr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.150.33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbbcdeefd3fbb080ee426adc7598ee85d9ce7ed53b290c0e117e3f2a78a297b4

Request headers

Referer
https://formulaire-ipt.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sat, 01 Feb 2020 14:29:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 21 Jan 2020 14:41:47 GMT
server
cloudflare
age
31779
etag
W/"5e270dab-85d3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=43200
cf-ray
55e49eb0d85ebfe8-MAN
expires
Sat, 01 Feb 2020 17:40:10 GMT
style_v2.css
formulaire-ipt.fr/
137 KB
19 KB
Stylesheet
General
Full URL
https://formulaire-ipt.fr/style_v2.css
Requested by
Host: formulaire-ipt.fr
URL: https://formulaire-ipt.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.46.215.132 , Germany, ASN196763 (KEY-SYSTEMS-AS Im Oberen Werk 1, DE),
Reverse DNS
web-02.dd24.net
Software
Apache /
Resource Hash
85307c97af670d28bb632564840323b8ef1d51873acdaff58b7f1998ea5cfd2f

Request headers

Referer
https://formulaire-ipt.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Sat, 01 Feb 2020 14:29:50 GMT
Content-Encoding
gzip
Last-Modified
Sat, 25 Jan 2020 19:34:49 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Connection
close
Accept-Ranges
none
Content-Length
19638
xVg23539348883.PNG
formulaire-ipt.fr/img/
7 KB
7 KB
Image
General
Full URL
https://formulaire-ipt.fr/img/xVg23539348883.PNG
Requested by
Host: formulaire-ipt.fr
URL: https://formulaire-ipt.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.46.215.132 , Germany, ASN196763 (KEY-SYSTEMS-AS Im Oberen Werk 1, DE),
Reverse DNS
web-02.dd24.net
Software
Apache /
Resource Hash
2d91d6d35df49561b4ece5155597fc90697d23c9b98eae4bee4ee9f6a9df13b9

Request headers

Referer
https://formulaire-ipt.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Sat, 01 Feb 2020 14:29:50 GMT
Last-Modified
Sat, 25 Jan 2020 19:34:56 GMT
Server
Apache
ETag
"1a4a-59cfbf812400f"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
6730
okeriDF34233.PNG
formulaire-ipt.fr/img/
4 KB
5 KB
Image
General
Full URL
https://formulaire-ipt.fr/img/okeriDF34233.PNG
Requested by
Host: formulaire-ipt.fr
URL: https://formulaire-ipt.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.46.215.132 , Germany, ASN196763 (KEY-SYSTEMS-AS Im Oberen Werk 1, DE),
Reverse DNS
web-02.dd24.net
Software
Apache /
Resource Hash
69fa7ceb5f6e7d118ac48f31ff839a8718711f2c0eb03e09fe0e12743af43aca

Request headers

Referer
https://formulaire-ipt.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Sat, 01 Feb 2020 14:29:50 GMT
Last-Modified
Sat, 25 Jan 2020 19:34:55 GMT
Server
Apache
ETag
"115c-59cfbf802ee36"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
4444
actu.PNG
formulaire-ipt.fr/img/
39 KB
39 KB
Image
General
Full URL
https://formulaire-ipt.fr/img/actu.PNG
Requested by
Host: formulaire-ipt.fr
URL: https://formulaire-ipt.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.46.215.132 , Germany, ASN196763 (KEY-SYSTEMS-AS Im Oberen Werk 1, DE),
Reverse DNS
web-02.dd24.net
Software
Apache /
Resource Hash
082b1fcf845d08b5a47bee4bc76324142ed4c582d054d68694b46739b339143b

Request headers

Referer
https://formulaire-ipt.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Sat, 01 Feb 2020 14:29:50 GMT
Last-Modified
Sat, 25 Jan 2020 19:34:52 GMT
Server
Apache
ETag
"9aad-59cfbf7d3720a"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
39597
css
fonts.googleapis.com/
2 KB
605 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext
Requested by
Host: formulaire-ipt.fr
URL: https://formulaire-ipt.fr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
39be29f582399edb6270c003ff52e7a8c9cc5769c304dc2289bb38b6c3b7f8c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://formulaire-ipt.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sat, 01 Feb 2020 14:29:50 GMT
server
ESF
access-control-allow-origin
*
date
Sat, 01 Feb 2020 14:29:50 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Sat, 01 Feb 2020 14:29:50 GMT
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: formulaire-ipt.fr
URL: https://formulaire-ipt.fr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext
Origin
https://formulaire-ipt.fr

Response headers

date
Sat, 01 Feb 2020 00:22:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:49 GMT
server
sffe
age
50843
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
9132
x-xss-protection
0
expires
Sun, 31 Jan 2021 00:22:27 GMT
t.php
c.statcounter.com/
49 B
404 B
Other
General
Full URL
https://c.statcounter.com/t.php?sc_project=12010957&java=1&security=b2851ea1&u1=73ADD5FF2B1E4FB3FBE959851F36F928&sc_rum_f_s=0&sc_rum_f_e=3781&sc_rum_e_s=3787&sc_rum_e_e=3798&sc_random=0.47548744739013005&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=&u=https%3A//formulaire-ipt.fr/&t=Impots%20%3A%20Formulaire%20de%20remboursement&sc_snum=1&sess=0d8f9c&p=0&invisible=1
Requested by
Host: www.statcounter.com
URL: https://www.statcounter.com/counter/counter.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.150.33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Referer
https://formulaire-ipt.fr/
Origin
https://formulaire-ipt.fr
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sat, 01 Feb 2020 14:29:51 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
status
200
cf-ray
55e49eb128a7bfe8-MAN
content-type
image/gif
content-length
49
expires
Mon, 26 Jul 1997 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Impots Gouv (Government)

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate number| sc_project number| sc_invisible string| sc_security number| sc_https boolean| sc_new_ad_detection number| sc_rum_start number| sc_width number| sc_height string| sc_referer number| sc_unique number| sc_returning number| sc_returns number| sc_error number| sc_remove number| sc_cls number| sc_inv string| sc_os string| sc_title string| sc_url string| sc_base_dir string| sc_click_dir string| sc_link_back_start string| sc_link_back_end string| sc_security_code string| sc_http_url string| sc_host string| sc_dc string| sc_alt_text string| sc_counter_size number| sc_prerendering string| sc_uuid string| sc_uuid_q function| sc_fgetval string| sc_unique_returning string| sc_sp function| _sc_strip_tags function| _sc_sanitiseTags function| _sc_validateTags function| getSCPerformanceTags function| getScPerformanceUrlParams function| getTagString function| isValidEventName undefined| _statcounter_pending object| _statcounter number| sc_script_num object| _sc_imgs string| sc_pageview_tag_string number| _sc_project_int object| _sc_epoch_now number| _sc_epoch_days number| _sc_days_elapsed number| _sc_fix_threshold number| _sc_fix_min_threshold boolean| _sc_apply_mar_2017_fixes boolean| _sc_use_performance_tags number| clickstat_done number| clickstat_project string| clickstat_security string| dlext string| ltype string| second object| dl object| lnk object| domsec string| host_name object| host_splitted string| domain string| host_split string| lnklocal_mask object| lnklocal object| anchors object| areaTags object| anchor string| sc_gsyn_pattern string| sc_gsyn_pattern2 undefined| sc_px undefined| sc_py undefined| element_in_focus undefined| time_element_gained_focus undefined| sc_existing function| sc_process_anchor function| sc_none function| sc_delay function| sc_clickstat_call function| sc_adsense_click function| sc_adsense_init function| sc_getmouse function| sc_findy function| sc_findx function| sc_exitpage string| sc_doc_loc object| myRE object| sc_date number| sc_time number| sc_time_difference string| cookie_value number| sc_call

1 Cookies

Domain/Path Name / Value
.formulaire-ipt.fr/ Name: sc_is_visitor_unique
Value: rx12010957.1580567391.73ADD5FF2B1E4FB3FBE959851F36F928.1.1.1.1.1.1.1.1.1