impots-direction-generale.c1020147.ferozo.com Open in urlscan Pro
200.58.110.17 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://impots-direction-generale.c1020147.ferozo.com/
Effective URL:
http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Submission: On December 01 via manual (December 1st 2017, 10:57:45 am UTC) from IN

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 200.58.110.17, located in Rosario, Argentina and belongs to Dattatec.com, AR. The main domain is impots-direction-generale.c1020147.ferozo.com.

This is the only time impots-direction-generale.c1020147.ferozo.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Impots Gouv (Government)

Domain & IP information

	IP Address	AS Autonomous System
2 10	200.58.110.17 200.58.110.17	27823 (Dattatec.com) (Dattatec.com)
2	2a00:1450:400... 2a00:1450:4001:81d::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
10	2

10 200.58.110.17 (Rosario, Argentina) 2 redirects

ASN27823 (Dattatec.com, AR)
PTR: c102.dattaweb.com

impots-direction-generale.c1020147.ferozo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	ferozo.com 2 redirects impots-direction-generale.c1020147.ferozo.com	129 KB
2	googleapis.com ajax.googleapis.com	61 KB
10	2

	Domain	Requested by
10	impots-direction-generale.c1020147.ferozo.com	2 redirects impots-direction-generale.c1020147.ferozo.com
2	ajax.googleapis.com	impots-direction-generale.c1020147.ferozo.com
10	2

This site contains no links.

Subject Issuer	Validity	Valid
*.googleapis.com Google Internet Authority G2	`2017-11-16` - `2018-02-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Frame ID: 18992.1
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://impots-direction-generale.c1020147.ferozo.com/ HTTP 302
http://impots-direction-generale.c1020147.ferozo.com/bc171 HTTP 301
http://impots-direction-generale.c1020147.ferozo.com/bc171/ Page URL
http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5 Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js/i

Page Statistics

10
Requests

20 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

190 kB
Transfer

445 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://impots-direction-generale.c1020147.ferozo.com/ HTTP 302
http://impots-direction-generale.c1020147.ferozo.com/bc171 HTTP 301
http://impots-direction-generale.c1020147.ferozo.com/bc171/ Page URL
http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://impots-direction-generale.c1020147.ferozo.com/ HTTP 302
http://impots-direction-generale.c1020147.ferozo.com/bc171 HTTP 301
http://impots-direction-generale.c1020147.ferozo.com/bc171/

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
impots-direction-generale.c1020147.ferozo.com/bc171/
Redirect Chain

http://impots-direction-generale.c1020147.ferozo.com/
http://impots-direction-generale.c1020147.ferozo.com/bc171
http://impots-direction-generale.c1020147.ferozo.com/bc171/

337 B
287 B

284ms
284ms

Document
text/html

200.58.110.17
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/
Protocol: HTTP/1.1
Server: 200.58.110.17 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: c102.dattaweb.com
Software: Apache / PHP/7.0.25
Resource Hash: fff45b5d29b49c6626bab40f71a8df8b25ed182585d935ba12c74f7927101fc6

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: impots-direction-generale.c1020147.ferozo.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 01 Dec 2017 10:57:33 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/7.0.25
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: Keep-Alive
Keep-Alive: timeout=10, max=198

Redirect headers

Location: http://impots-direction-generale.c1020147.ferozo.com/bc171/
Date: Fri, 01 Dec 2017 10:57:32 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=10, max=199
Content-Length: 267
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK Primary Request acces.php Show response
impots-direction-generale.c1020147.ferozo.com/bc171/ 20 KB
4 KB 278ms
278ms Document
text/html 200.58.110.17
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Requested by: Host: impots-direction-generale.c1020147.ferozo.com
URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/
Protocol: HTTP/1.1
Server: 200.58.110.17 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: c102.dattaweb.com
Software: Apache / PHP/7.0.25
Resource Hash: 7f76911fa81250c85481979d178967510775dfd3143f3956a07d107d6782c501

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: impots-direction-generale.c1020147.ferozo.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/
Connection: keep-alive
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 01 Dec 2017 10:57:33 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/7.0.25
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: Keep-Alive
Keep-Alive: timeout=10, max=197

GET
H/1.1 200
OK aa.css
impots-direction-generale.c1020147.ferozo.com/bc171/css/ 5 KB
1 KB 267ms
267ms Stylesheet
text/css 200.58.110.17
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/css/aa.css
Requested by: Host: impots-direction-generale.c1020147.ferozo.com
URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Protocol: HTTP/1.1
Server: 200.58.110.17 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: c102.dattaweb.com
Software: Apache /
Resource Hash: d597d5c06d719d23c70326ada7add6c332a7b9cbc26583456609434d05fc7325

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: impots-direction-generale.c1020147.ferozo.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Connection: keep-alive
Cache-Control: no-cache
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 01 Dec 2017 10:57:33 GMT
Content-Encoding: gzip
Last-Modified: Fri, 01 Dec 2017 10:57:32 GMT
Server: Apache
ETag: "147d-55f453c439f00-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=196
Content-Length: 1240

GET
H/1.1 200
OK fix.css
impots-direction-generale.c1020147.ferozo.com/bc171/css/ 2 KB
490 B 266ms
265ms Stylesheet
text/css 200.58.110.17
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/css/fix.css
Requested by: Host: impots-direction-generale.c1020147.ferozo.com
URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Protocol: HTTP/1.1
Server: 200.58.110.17 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: c102.dattaweb.com
Software: Apache /
Resource Hash: 2820761d90140c9474b8051e4097a86f9bdeb0d2a02598f445010516839c9fb4

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: impots-direction-generale.c1020147.ferozo.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Connection: keep-alive
Cache-Control: no-cache
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 01 Dec 2017 10:57:33 GMT
Content-Encoding: gzip
Last-Modified: Fri, 01 Dec 2017 10:57:32 GMT
Server: Apache
ETag: "7e6-55f453c439f00-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=200
Content-Length: 490

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.2/ 84 KB
29 KB 19ms
6ms Script
text/javascript 2a00:1450:4001:81d::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.2/jquery.min.js

Requested by

Host: impots-direction-generale.c1020147.ferozo.com
URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81d::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /ajax/libs/jquery/2.2.2/jquery.min.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: ajax.googleapis.com
referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
:scheme: https
:method: GET
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 09 Nov 2017 19:45:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1869140
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 30094
x-xss-protection: 1; mode=block
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Nov 2018 19:45:13 GMT

GET
H/1.1 200
OK jquery_172.js Show response
impots-direction-generale.c1020147.ferozo.com/bc171/ 160 KB
39 KB 538ms
272ms Script
application/javascript 200.58.110.17
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/jquery_172.js
Requested by: Host: impots-direction-generale.c1020147.ferozo.com
URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Protocol: HTTP/1.1
Server: 200.58.110.17 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: c102.dattaweb.com
Software: Apache /
Resource Hash: 0949c47e167a6f2e0ea19d34cfe1aa0916f0b3e13a7422313a2cdb63c84e946c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: impots-direction-generale.c1020147.ferozo.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Connection: keep-alive
Cache-Control: no-cache
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 01 Dec 2017 10:57:34 GMT
Content-Encoding: gzip
Last-Modified: Fri, 01 Dec 2017 10:57:32 GMT
Server: Apache
ETag: "281b3-55f453c439f00-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=199
Content-Length: 39719

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.6.1/ 89 KB
31 KB 28ms
16ms Script
text/javascript 2a00:1450:4001:81d::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js

Requested by

Host: impots-direction-generale.c1020147.ferozo.com
URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81d::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /ajax/libs/jquery/1.6.1/jquery.min.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: ajax.googleapis.com
referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
:scheme: https
:method: GET
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 09 Nov 2017 19:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1869158
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 32124
x-xss-protection: 1; mode=block
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Nov 2018 19:44:55 GMT

GET
H/1.1 200
OK logo.svg
impots-direction-generale.c1020147.ferozo.com/bc171/img/ 79 KB
79 KB 266ms
265ms Image
image/svg+xml 200.58.110.17
Dattatec.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/img/logo.svg
Requested by: Host: impots-direction-generale.c1020147.ferozo.com
URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Protocol: HTTP/1.1
Server: 200.58.110.17 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: c102.dattaweb.com
Software: Apache /
Resource Hash: f1189f7e91a2ee383d2734b0cd93183d5e4ec58ec6ae696ee836ab0c23e83cb1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: impots-direction-generale.c1020147.ferozo.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/css/aa.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/css/aa.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 01 Dec 2017 10:57:34 GMT
Last-Modified: Fri, 01 Dec 2017 10:57:32 GMT
Server: Apache
ETag: "13d96-55f453c439f00"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=198
Content-Length: 81302

GET
H/1.1 200
OK rt1.png
impots-direction-generale.c1020147.ferozo.com/bc171/img/ 2 KB
2 KB 269ms
269ms Image
image/png 200.58.110.17
Dattatec.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/img/rt1.png
Requested by: Host: impots-direction-generale.c1020147.ferozo.com
URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Protocol: HTTP/1.1
Server: 200.58.110.17 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: c102.dattaweb.com
Software: Apache /
Resource Hash: 66fb45c738715ba07b6425b9e4aff3de256e27bbe7cba6b8388b29960845a40e

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: impots-direction-generale.c1020147.ferozo.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/css/aa.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/css/aa.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 01 Dec 2017 10:57:34 GMT
Last-Modified: Fri, 01 Dec 2017 10:57:32 GMT
Server: Apache
ETag: "986-55f453c439f00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=195
Content-Length: 2438

GET
H/1.1 200
OK rt2.png
impots-direction-generale.c1020147.ferozo.com/bc171/img/ 2 KB
2 KB 274ms
273ms Image
image/png 200.58.110.17
Dattatec.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/img/rt2.png
Requested by: Host: impots-direction-generale.c1020147.ferozo.com
URL: http://impots-direction-generale.c1020147.ferozo.com/bc171/acces.php?31147465499e725387b390b34171cfd2625042e5
Protocol: HTTP/1.1
Server: 200.58.110.17 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: c102.dattaweb.com
Software: Apache /
Resource Hash: c44bcd50d737d03ee30ee599af05b2ce1f506467d5229e19e89bdeae22d95330

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: impots-direction-generale.c1020147.ferozo.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/css/aa.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://impots-direction-generale.c1020147.ferozo.com/bc171/css/aa.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 01 Dec 2017 10:57:34 GMT
Last-Modified: Fri, 01 Dec 2017 10:57:32 GMT
Server: Apache
ETag: "9c1-55f453c439f00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=200
Content-Length: 2497

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Impots Gouv (Government)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| type_carte

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
impots-direction-generale.c1020147.ferozo.com
200.58.110.17
2a00:1450:4001:81d::200a
0949c47e167a6f2e0ea19d34cfe1aa0916f0b3e13a7422313a2cdb63c84e946c
2820761d90140c9474b8051e4097a86f9bdeb0d2a02598f445010516839c9fb4
66fb45c738715ba07b6425b9e4aff3de256e27bbe7cba6b8388b29960845a40e
7f76911fa81250c85481979d178967510775dfd3143f3956a07d107d6782c501
c44bcd50d737d03ee30ee599af05b2ce1f506467d5229e19e89bdeae22d95330
c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776
d597d5c06d719d23c70326ada7add6c332a7b9cbc26583456609434d05fc7325
dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32
f1189f7e91a2ee383d2734b0cd93183d5e4ec58ec6ae696ee836ab0c23e83cb1
fff45b5d29b49c6626bab40f71a8df8b25ed182585d935ba12c74f7927101fc6

impots-direction-generale.c1020147.ferozo.com Open in urlscan Pro 200.58.110.17 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

20 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

190 kBTransfer

445 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

impots-direction-generale.c1020147.ferozo.com Open in urlscan Pro
200.58.110.17 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

20 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

190 kB
Transfer

445 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!