cfspart-idp-impots-gouv.xcuiqbcha.com Open in urlscan Pro
188.114.96.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/
Submission: On December 05 via api (December 5th 2024, 11:21:43 pm UTC) from BE — Scanned from NL

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 12 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is cfspart-idp-impots-gouv.xcuiqbcha.com.
TLS certificate: Issued by WE1 on November 5th 2024. Valid for: 3 months.

This is the only time cfspart-idp-impots-gouv.xcuiqbcha.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Impots Gouv (Government)

Domain & IP information

	IP Address		AS Autonomous System
10	188.114.96.3 188.114.96.3		13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2

10 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

cfspart-idp-impots-gouv.xcuiqbcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	xcuiqbcha.com cfspart-idp-impots-gouv.xcuiqbcha.com	30 KB
0	impots.gouv.fr Failed cfspart.impots.gouv.fr Failed
12	2

	Domain	Requested by
10	cfspart-idp-impots-gouv.xcuiqbcha.com	cfspart-idp-impots-gouv.xcuiqbcha.com
0	cfspart.impots.gouv.fr Failed	cfspart-idp-impots-gouv.xcuiqbcha.com
12	2

This site contains no links.

Subject Issuer	Validity	Valid
xcuiqbcha.com WE1	`2024-11-05` - `2025-02-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/
Frame ID: B670CEF73B274B65AD637DF84716EDF2
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Particuliers | authentification

Page Statistics

12
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

30 kB
Transfer

49 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/	6 KB 2 KB	376ms 338ms	Document text/html	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `bdcf5e7ac9bbf32218246f5509dd40e70a1962cbca5b1ed2355ca5ae760fdae7` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8ed7c6103b79664a-AMS content-encoding zstd content-type text/html; charset=UTF-8 date Thu, 05 Dec 2024 23:21:38 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7s2qoAIJqwEoqX2DwnZLURHJF13TtfdvRk5xzekACNSJe9lIxQnmph%2BTYidsgf8vUxu3%2B9hx0eLEeP%2Fn3TsPQMxtdinkqBjJA65%2FR7rVKm3u%2BMpE%2Fy4J7Hctoh4XlkHY4IHcesXu6SNqmZaet3c7AzVEVyMtUwl4"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=12731&min_rtt=12247&rtt_var=2294&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4142&recv_bytes=4515&delivery_rate=732&cwnd=12000&unsent_bytes=0&cid=3c706ee14bd1b31e&ts=343&x=1" cfHdrFlush;dur=0 vary Accept-Encoding
GET H3	200	style.css cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/css/	8 KB 2 KB	351ms 351ms	Stylesheet text/css	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/css/style.css Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `990e3dcb5cbb5cd129bdc85c306b69fb50aa47dd3be973609079a2c1979511ad` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers content-encoding gzip cf-cache-status EXPIRED etag "1ed6-6285f3205aa72-gzip" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UeMjrqQiO332wuzFwC6Fpy3sVGmEYq4SD8pW%2BOwZisddBLNE8rTENn%2BSBWgD%2Bd2Vm0AoKCPknuZMUbRFoyiXuB9SaizAGFp26uo3jvpCo%2BiyqklWF8us5K9rZpBiUPS8SDdDYCeb9%2BU%2FuVGEpsuZB7IBLd4Tg5WQ"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12737&min_rtt=12247&rtt_var=1732&sent=26&recv=19&lost=0&retrans=0&sent_bytes=18363&recv_bytes=7647&delivery_rate=170199&cwnd=12000&unsent_bytes=0&cid=3c706ee14bd1b31e&ts=688&x=1", cfHdrFlush;dur=12 date Thu, 05 Dec 2024 23:21:39 GMT content-type text/css last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8ed7c6125d9a664a-AMS accept-ranges bytes content-length 1451 server cloudflare
GET H3	200	imforlogo.svg cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	18 KB 6 KB	340ms 339ms	Image image/svg+xml	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/imforlogo.svg Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `90d8552964c8e804a6dea1870bfd34d3114389e6c28b725bcdec63808b75c8a6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status REVALIDATED etag W/"4608-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pRbD7DvbUO3lipTnKd53T47kbWsUS%2B9HxRfdZSZSjXDtUkk7Z83lm9yID8NamLpGlodeSraAibbvZzg8QEu5WwpXBjjtAUyOCmt7eCZkMXxhG8hULOgUETWrzcyEaAXqEF9gUM9R2FH%2BP3xpPjQYbteSjxAYIuHY"}],"group":"cf-nel","max_age":604800} cf-ray 8ed7c6125d9d664a-AMS alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12737&min_rtt=12247&rtt_var=1732&sent=24&recv=19&lost=0&retrans=0&sent_bytes=17088&recv_bytes=7647&delivery_rate=170199&cwnd=12000&unsent_bytes=0&cid=3c706ee14bd1b31e&ts=688&x=1", cfHdrFlush;dur=0 date Thu, 05 Dec 2024 23:21:39 GMT content-type image/svg+xml last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	im22forlogo.svg cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	3 KB 2 KB	357ms 357ms	Image image/svg+xml	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/im22forlogo.svg Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c4502e1bffc9155988eeb261ae88885e93211e73cad60005d710ba19ac860b5e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status REVALIDATED etag W/"d10-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wZVwnxFtOlgLMOOQb88%2F64S3owsjIOWtdvx%2Fxef64KuKxaPXYzEzSLGkO81Yk1JtimX%2B7Zha9mYRaVYsL1DZSSAxJw%2BT69DfUwEG%2FtDPzGwQ5kNhhbsvZCNiQPi%2B%2BKa6pH4EQYiRiJljBaM90LCq2lmsq6DTY7Tt"}],"group":"cf-nel","max_age":604800} cf-ray 8ed7c6125d9f664a-AMS alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12737&min_rtt=12247&rtt_var=1732&sent=26&recv=19&lost=0&retrans=0&sent_bytes=18363&recv_bytes=7647&delivery_rate=170199&cwnd=12000&unsent_bytes=0&cid=3c706ee14bd1b31e&ts=692&x=1", cfHdrFlush;dur=8 date Thu, 05 Dec 2024 23:21:39 GMT content-type image/svg+xml last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	espacezra9829.png cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	686 B 1 KB	344ms 344ms	Image image/png	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/espacezra9829.png Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0d0741e418e5fa6fe7a6d2f5f42083d5aec49beb9e2ab2ec93a5c76e88b52381` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status REVALIDATED etag "2ae-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=67ynhhrrExPEKQz7CWhfI3YLaJ0ZbKisaVicTmAGCXHK0fp9xOY2shBLm6SAo8P5%2F0nW3dcLXZqS64OubSLSav5V2lhW447muj9bqm1mNQnZKGnIPtazC1MftMeBDgITJO8hpmKKzqQZCf9JyFZNudIlx8j6RK4v"}],"group":"cf-nel","max_age":604800} cf-ray 8ed7c6126daf664a-AMS accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12737&min_rtt=12247&rtt_var=1732&sent=26&recv=19&lost=0&retrans=0&sent_bytes=18363&recv_bytes=7647&delivery_rate=170199&cwnd=12000&unsent_bytes=0&cid=3c706ee14bd1b31e&ts=690&x=1", cfHdrFlush;dur=10 content-length 686 date Thu, 05 Dec 2024 23:21:39 GMT content-type image/png last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	espace9fooahmar.png cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	678 B 1 KB	345ms 345ms	Image image/png	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/espace9fooahmar.png Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4d12b8796dded3fa21ae1cd8142ecadf3fb5e92b64232a6f5b57e4145c9d0d68` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status REVALIDATED etag "2a6-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NHWu6fqhoDYcjgzycKZAtDsVt0y9hfSRtRhSJzyIztAwxMI0fvFMR2pQcVZBynOl6n73zzNMCcKzFze1nOt2ran%2Bm0EzZUFuXnC9O3x2hqnXQIPk3KRoVdGE58JIl0YsdYpOirSXP%2FtPTHgzKwB%2BSXah4%2Ba96drL"}],"group":"cf-nel","max_age":604800} cf-ray 8ed7c6126db1664a-AMS accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12737&min_rtt=12247&rtt_var=1732&sent=26&recv=19&lost=0&retrans=0&sent_bytes=18363&recv_bytes=7647&delivery_rate=170199&cwnd=12000&unsent_bytes=0&cid=3c706ee14bd1b31e&ts=692&x=1", cfHdrFlush;dur=8 content-length 678 date Thu, 05 Dec 2024 23:21:39 GMT content-type image/png last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	payzarim.png cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	10 KB 10 KB	330ms 329ms	Image image/png	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/payzarim.png Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4cf4a799d8e8d76b027cf25800d00d2f0ef7ea8219933af5f57144b126c3c539` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status REVALIDATED etag "2671-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WmBGzXLkGBZMSPte3q2Zf%2Fv3RJAPvAeDPpjwF4X4EAiERYZh884lYOeU7N%2BfR05jgyM8JSrw9hczTVik6ctoHRRnyb2ncPOmLrVMtTeTdnRkoT033HedkUUj5EHC%2F4Vp059sApvg%2BiBnVqNSrEoNBR8ohXMCgLYA"}],"group":"cf-nel","max_age":604800} cf-ray 8ed7c6126db3664a-AMS accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12737&min_rtt=12247&rtt_var=1732&sent=15&recv=19&lost=0&retrans=0&sent_bytes=6363&recv_bytes=7647&delivery_rate=170199&cwnd=12000&unsent_bytes=0&cid=3c706ee14bd1b31e&ts=687&x=1", cfHdrFlush;dur=0 content-length 9841 date Thu, 05 Dec 2024 23:21:39 GMT content-type image/png last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	awtakhalesd.png cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	2 KB 2 KB	346ms 346ms	Image image/png	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/awtakhalesd.png Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2e4751a03f6bae610276711572bef318b0fa4fc5abc0003cff54043b17b78e82` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status REVALIDATED etag "700-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YrhV1TNlXpKryJ86eFQHN6AffLA2o1RnCP5R3M4EUuULlnlLZ17i3QIpmMW9SX0uTsAPu4cscf8np8rxZXjAQQlWhv0v881pm2ZUbY%2BPic3Y3az7PeMwmRozsjsQpg6pL3RpHIgYQWSjxc9U5dQsSoAV%2B%2BRCk4QG"}],"group":"cf-nel","max_age":604800} cf-ray 8ed7c6126db7664a-AMS accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12737&min_rtt=12247&rtt_var=1732&sent=26&recv=19&lost=0&retrans=0&sent_bytes=18363&recv_bytes=7647&delivery_rate=170199&cwnd=12000&unsent_bytes=0&cid=3c706ee14bd1b31e&ts=694&x=1", cfHdrFlush;dur=6 content-length 1792 date Thu, 05 Dec 2024 23:21:39 GMT content-type image/png last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	main.js Show response cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/js/	666 B 932 B	346ms 346ms	Script text/javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/js/main.js Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7639019193b23e3e493a6cfb780d540c865098afd9b9456a972b2b87c6f18253` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers content-encoding gzip cf-cache-status EXPIRED etag "29a-6285f3205aa72-gzip" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7l%2FDt8R0OGNTEZUTTbk6SWrXpK3UYUh9aGXlgQciu%2FgKwNfR03uh2vBEovSY8TG5QmLsInZrh%2BjdgvIMfAlelZSrEz0hY8ouedENsZuQ1I7sj%2FXwLQeRMWPEOdWkD0QBbSwv1blNTN9FFsGDNv4fjL89y5Z58RFj"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12737&min_rtt=12247&rtt_var=1732&sent=26&recv=19&lost=0&retrans=0&sent_bytes=18363&recv_bytes=7647&delivery_rate=170199&cwnd=12000&unsent_bytes=0&cid=3c706ee14bd1b31e&ts=696&x=1", cfHdrFlush;dur=4 date Thu, 05 Dec 2024 23:21:39 GMT content-type text/javascript last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8ed7c6126db6664a-AMS accept-ranges bytes content-length 247 server cloudflare
GET		open-sans-latin-ext-regular.woff2 cfspart.impots.gouv.fr/templates//polices/	0 0

GET		open-sans-latin-ext-regular.woff cfspart.impots.gouv.fr/templates/polices/	0 0

GET H3	200	favicon.ico cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	1 KB 1 KB	329ms 329ms	Other image/x-icon	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `99af879888a29feeec095725f74e18cd070de29e7f1b4a35f20746fa45382c21` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status MISS etag W/"47e-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UojQnPa7UA%2FL4NpWaJn9Bxavl06xjHypSCUYReDrug2coNe%2FN4s8NX7WfpZxwE01zjr52OZyWmz99lQgWsxCF3TA%2BlS4aB22iedvHCW0DFNSwg4qEc3u%2FO%2BWIOvc7AapD%2BV%2BHilsG9UOKTXVT6PwNTIGbBxl%2B%2BfC"}],"group":"cf-nel","max_age":604800} cf-ray 8ed7c615b9bd664a-AMS alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=12748&min_rtt=12247&rtt_var=131&sent=44&recv=34&lost=0&retrans=0&sent_bytes=34394&recv_bytes=8647&delivery_rate=49231&cwnd=22800&unsent_bytes=0&cid=3c706ee14bd1b31e&ts=1214&x=1", cfHdrFlush;dur=0 date Thu, 05 Dec 2024 23:21:39 GMT content-type image/x-icon last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cfspart.impots.gouv.fr
URL: https://cfspart.impots.gouv.fr/templates//polices/open-sans-latin-ext-regular.woff2

Domain: cfspart.impots.gouv.fr
URL: https://cfspart.impots.gouv.fr/templates/polices/open-sans-latin-ext-regular.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Impots Gouv (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
javascript	error	URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Message: Access to font at 'https://cfspart.impots.gouv.fr/templates//polices/open-sans-latin-ext-regular.woff2' from origin 'https://cfspart-idp-impots-gouv.xcuiqbcha.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cfspart.impots.gouv.fr/templates//polices/open-sans-latin-ext-regular.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Message: Access to font at 'https://cfspart.impots.gouv.fr/templates/polices/open-sans-latin-ext-regular.woff' from origin 'https://cfspart-idp-impots-gouv.xcuiqbcha.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cfspart.impots.gouv.fr/templates/polices/open-sans-latin-ext-regular.woff Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cfspart-idp-impots-gouv.xcuiqbcha.com
cfspart.impots.gouv.fr
cfspart.impots.gouv.fr
188.114.96.3
0d0741e418e5fa6fe7a6d2f5f42083d5aec49beb9e2ab2ec93a5c76e88b52381
2e4751a03f6bae610276711572bef318b0fa4fc5abc0003cff54043b17b78e82
4cf4a799d8e8d76b027cf25800d00d2f0ef7ea8219933af5f57144b126c3c539
4d12b8796dded3fa21ae1cd8142ecadf3fb5e92b64232a6f5b57e4145c9d0d68
7639019193b23e3e493a6cfb780d540c865098afd9b9456a972b2b87c6f18253
90d8552964c8e804a6dea1870bfd34d3114389e6c28b725bcdec63808b75c8a6
990e3dcb5cbb5cd129bdc85c306b69fb50aa47dd3be973609079a2c1979511ad
99af879888a29feeec095725f74e18cd070de29e7f1b4a35f20746fa45382c21
bdcf5e7ac9bbf32218246f5509dd40e70a1962cbca5b1ed2355ca5ae760fdae7
c4502e1bffc9155988eeb261ae88885e93211e73cad60005d710ba19ac860b5e

cfspart-idp-impots-gouv.xcuiqbcha.com Open in urlscan Pro 188.114.96.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

12 Requests

83 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

30 kBTransfer

49 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

5 Console Messages

Indicators

cfspart-idp-impots-gouv.xcuiqbcha.com Open in urlscan Pro
188.114.96.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

30 kB
Transfer

49 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!