cfspart-idp-impots-gouv.xcuiqbcha.com Open in urlscan Pro
188.114.96.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://caudsim.com/fr
Effective URL:
https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/
Submission: On December 03 via manual (December 3rd 2024, 3:19:49 pm UTC) from FR — Scanned from FR

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 16 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is cfspart-idp-impots-gouv.xcuiqbcha.com.
TLS certificate: Issued by WE1 on November 5th 2024. Valid for: 3 months.

This is the only time cfspart-idp-impots-gouv.xcuiqbcha.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Impots Gouv (Government)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2606:4700:303... 2606:4700:3033::6815:4f19	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 5	172.67.140.154 172.67.140.154	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	37.48.65.182 37.48.65.182	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.)
2 2	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	4

2 2606:4700:3033::6815:4f19 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

caudsim.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.67.140.154 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

caudsim.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.48.65.182 (Amsterdam, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL)

extreme-ip-lookup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3120::3 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

cfspart-idp-impots-gouv.xcuiqbcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

cfspart-idp-impots-gouv.xcuiqbcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	xcuiqbcha.com 2 redirects cfspart-idp-impots-gouv.xcuiqbcha.com	31 KB
7	caudsim.com 4 redirects caudsim.com	10 KB
1	extreme-ip-lookup.com extreme-ip-lookup.com — Cisco Umbrella Rank: 25233	545 B
0	impots.gouv.fr Failed cfspart.impots.gouv.fr Failed
16	4

	Domain	Requested by
12	cfspart-idp-impots-gouv.xcuiqbcha.com	2 redirects caudsim.com cfspart-idp-impots-gouv.xcuiqbcha.com
7	caudsim.com	4 redirects caudsim.com
1	extreme-ip-lookup.com	caudsim.com
0	cfspart.impots.gouv.fr Failed	cfspart-idp-impots-gouv.xcuiqbcha.com
16	4

This site contains no links.

Subject Issuer	Validity	Valid
caudsim.com WE1	`2024-10-24` - `2025-01-22`	3 months	crt.sh
t1.extreme-dm.com R11	`2024-10-08` - `2025-01-06`	3 months	crt.sh
xcuiqbcha.com WE1	`2024-11-05` - `2025-02-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/
Frame ID: 6238F06C5BC9266D4967F18A42119CA7
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Particuliers | authentification

Page URL History Show full URLs

https://caudsim.com/fr HTTP 301
http://caudsim.com/fr/ HTTP 307
https://caudsim.com/fr/ HTTP 302
https://caudsim.com/fr/b522f HTTP 301
http://caudsim.com/fr/b522f/ HTTP 307
https://caudsim.com/fr/b522f/ Page URL
https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/ HTTP 302
https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09 HTTP 301
http://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ HTTP 307
https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

16
Requests

81 %
HTTPS

40 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

38 kB
Transfer

55 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://caudsim.com/fr HTTP 301
http://caudsim.com/fr/ HTTP 307
https://caudsim.com/fr/ HTTP 302
https://caudsim.com/fr/b522f HTTP 301
http://caudsim.com/fr/b522f/ HTTP 307
https://caudsim.com/fr/b522f/ Page URL
https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/ HTTP 302
https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09 HTTP 301
http://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ HTTP 307
https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://caudsim.com/fr HTTP 301
http://caudsim.com/fr/ HTTP 307
https://caudsim.com/fr/ HTTP 302
https://caudsim.com/fr/b522f HTTP 301
http://caudsim.com/fr/b522f/ HTTP 307
https://caudsim.com/fr/b522f/

Request Chain 3

https://caudsim.com/favicon.ico HTTP 302
https://caudsim.com/wp-includes/images/w-logo-blue-white-bg.png

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	/ Show response caudsim.com/fr/b522f/ Redirect Chain https://caudsim.com/fr http://caudsim.com/fr/ https://caudsim.com/fr/ https://caudsim.com/fr/b522f http://caudsim.com/fr/b522f/ https://caudsim.com/fr/b522f/	321 B 876 B	196ms 196ms	Document text/html	172.67.140.154 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://caudsim.com/fr/b522f/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.140.154 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c16470a2ecc8a550fa484c064ae54879e0cff3aad81d3374dfac9d775a963165` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8ec4896b4d35b0ec-MAN content-encoding zstd content-type text/html; charset=UTF-8 date Tue, 03 Dec 2024 15:19:45 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=0,i report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iHNxWChmWFPluGYz8XW1ua5fUuIlfl1t8mKm3iGkvHNYwRiQd0RI76pYgEtfUHmDj2H2L3MPrQvWf5kHcovuCqhMmi70l7D5ZwIiiFKUhFEMBwdWn26ynher%2FfB17w%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=31620&min_rtt=30998&rtt_var=3766&sent=15&recv=13&lost=0&retrans=0&sent_bytes=5235&recv_bytes=4979&delivery_rate=516&cwnd=12000&unsent_bytes=0&cid=9d42236159b3a719&ts=1003&x=1" cfExtPri cfHdrFlush;dur=0 vary Accept-Encoding Redirect headers Location https://caudsim.com/fr/b522f/ Non-Authoritative-Reason HttpsUpgrades
GET H3	200	app.js Show response caudsim.com/fr/b522f/	2 KB 2 KB	359ms 359ms	Script text/javascript	172.67.140.154 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://caudsim.com/fr/b522f/app.js?version=1733239185 Requested by Host: caudsim.com URL: https://caudsim.com/fr/b522f/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.140.154 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f4498268ffc48f2d932e52d9b46f4acc91aa4c4d5e4a46ab2a3ba6059fb26db1` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://caudsim.com/fr/b522f/ Response headers content-encoding gzip cf-cache-status MISS etag W/"82b-6285f31ea42c3-gzip" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1%2B%2FdJW9zmEgUBWgtxnjSbckXClJZwHgZVoxzBQuDaO46HFGmj2PVEEMjXKRCt5acLvL53o0FPDGK8DEEydWlh4k%2BdHmIO2g7rgqvsXgR6cw8WgqIC0eiOpZbaPKRXw%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=32137&min_rtt=30998&rtt_var=3858&sent=17&recv=14&lost=0&retrans=0&sent_bytes=6158&recv_bytes=5267&delivery_rate=25142&cwnd=12000&unsent_bytes=0&cid=9d42236159b3a719&ts=1367&x=1", cfExtPri, cfHdrFlush;dur=0 date Tue, 03 Dec 2024 15:19:45 GMT content-type text/javascript last-modified Tue, 03 Dec 2024 15:19:44 GMT vary Accept-Encoding priority u=3,i=?0 cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8ec4896c8ecfb0ec-MAN accept-ranges bytes content-length 1057 server cloudflare
GET H2	200	/ Show response extreme-ip-lookup.com/json/	397 B 545 B	98ms 33ms	Fetch application/json	37.48.65.182 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://extreme-ip-lookup.com/json/?key=UwA8TANiWiY8nBBd4u5a Requested by Host: caudsim.com URL: https://caudsim.com/fr/b522f/app.js?version=1733239185 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 37.48.65.182 Amsterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL), Reverse DNS Software nginx / Resource Hash `20172da86df7e51afc06f43c6b313bd2bcc69aaad87bad661959340da9f6956f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://caudsim.com/ Response headers access-control-allow-origin * cache-control max-age=3600 content-length 397 date Tue, 03 Dec 2024 15:19:45 GMT content-type application/json; charset=utf-8; server nginx access-control-allow-headers *
GET H3	200	w-logo-blue-white-bg.png caudsim.com/wp-includes/images/ Redirect Chain https://caudsim.com/favicon.ico https://caudsim.com/wp-includes/images/w-logo-blue-white-bg.png	4 KB 5 KB	355ms 355ms	Other image/png	172.67.140.154 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://caudsim.com/wp-includes/images/w-logo-blue-white-bg.png Protocol H3 Server 172.67.140.154 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://caudsim.com/fr/b522f/ Response headers cf-cache-status MISS etag "1017-624add2646180" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pxwe7m5Q5fo%2B3k60N0MxVxftBRPrYtoO8cpMj8%2Fdyn6GIMYQWacCP%2BSgaMJhb0IXFK2XOgYJ3PQJusizJqXuLPNGS63LuJiobCXNvA9sZ0bVXYirP9CsOLiCoIaqmw%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=32073&min_rtt=30998&rtt_var=2519&sent=22&recv=17&lost=0&retrans=0&sent_bytes=8771&recv_bytes=6031&delivery_rate=2068&cwnd=12000&unsent_bytes=0&cid=9d42236159b3a719&ts=2097&x=1", cfExtPri, cfHdrFlush;dur=0 date Tue, 03 Dec 2024 15:19:46 GMT content-type image/png last-modified Thu, 17 Oct 2024 15:27:18 GMT vary Accept-Encoding priority u=1,i cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8ec489711ca5b0ec-MAN accept-ranges bytes content-length 4119 server cloudflare Redirect headers x-redirect-by WordPress link <https://caudsim.com/wp-json/>; rel="https://api.w.org/" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} location https://caudsim.com/wp-includes/images/w-logo-blue-white-bg.png cf-cache-status BYPASS report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EmbKN9PhGOCU3%2Bhyj8BO1LVdT1G3sTEE5tK9kXLGuEwsrvT6feYZEDJwilx63Sl6j1%2BoPbrQ2JpA%2BymAqsvxs1IH2WF6BfKfeVbW%2FFCQODdNfOEHUogJTemvGqiV4w%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ec4896ec9b9b0ec-MAN alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=32001&min_rtt=30998&rtt_var=3166&sent=20&recv=16&lost=0&retrans=0&sent_bytes=7979&recv_bytes=5656&delivery_rate=5023&cwnd=12000&unsent_bytes=0&cid=9d42236159b3a719&ts=1742&x=1", cfExtPri, cfHdrFlush;dur=0 date Tue, 03 Dec 2024 15:19:46 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding server cloudflare priority u=1,i
GET H3	200	Primary Request / Show response cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Redirect Chain https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/ https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09 http://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/	6 KB 2 KB	360ms 360ms	Document text/html	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Requested by Host: caudsim.com URL: https://caudsim.com/fr/b522f/app.js?version=1733239185 Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `bdcf5e7ac9bbf32218246f5509dd40e70a1962cbca5b1ed2355ca5ae760fdae7` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8ec489758a3f0745-MAN content-encoding zstd content-type text/html; charset=UTF-8 date Tue, 03 Dec 2024 15:19:47 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xGMmR4pMfx47f7LdvkVAr9rvR8xY6hAuQ68%2B%2BEIaIYKU90TSOWxOwtqQkdimF36uooxV3i45GctmKgNwgqIVlKcKqswWx7YfwEgN21SWK9XdnvKuCdlgVj1AMChSG%2FJmydTcwrMa59Qlzqz9oWn32h20F%2BDe%2FOec"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=31179&min_rtt=31048&rtt_var=5025&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4241&recv_bytes=4502&delivery_rate=497&cwnd=12000&unsent_bytes=0&cid=5d290589cf6f22b5&ts=511&x=1" cfHdrFlush;dur=0 vary Accept-Encoding Redirect headers Location https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Non-Authoritative-Reason HttpsUpgrades
GET H3	200	style.css cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/css/	8 KB 2 KB	369ms 369ms	Stylesheet text/css	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/css/style.css Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `990e3dcb5cbb5cd129bdc85c306b69fb50aa47dd3be973609079a2c1979511ad` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers content-encoding gzip cf-cache-status MISS etag W/"1ed6-6285f3205aa72-gzip" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C4%2Boo2AVve2IOMOrqyi4wMd9Ls0o2zZMFSbFu9j9vn2L3hCpZnOnG3DajP2yAsFCM1PTbkdocPPPvvmN1VluVsoDsSpy1caMfGwitJP5jf9pCAMwHFGT3ClivG5iqAfA3JzqTA%2F4Z2wZANDGIj%2FIpC9MNWWJrYkI"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=31255&min_rtt=31048&rtt_var=2967&sent=23&recv=19&lost=0&retrans=0&sent_bytes=10975&recv_bytes=7640&delivery_rate=6120&cwnd=12000&unsent_bytes=0&cid=5d290589cf6f22b5&ts=885&x=1", cfHdrFlush;dur=0 date Tue, 03 Dec 2024 15:19:47 GMT content-type text/css last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8ec48977ce2e0745-MAN accept-ranges bytes content-length 1451 server cloudflare
GET H3	200	imforlogo.svg cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	18 KB 6 KB	503ms 503ms	Image image/svg+xml	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/imforlogo.svg Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `90d8552964c8e804a6dea1870bfd34d3114389e6c28b725bcdec63808b75c8a6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status MISS etag W/"4608-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C6MM0eg48n75nb9uaELIqpincMk0PVtZ6MG1SUm%2BRCIU8dNI2VwPCutmaNye%2B09qC3wc4995u%2Bul7ApN3x9PFagXES05ItUbniNzXnj%2BI28p7ozM2Dhex%2FmVet699uY88ek06FHGYjVBknf6Wq7w20HJ5jvaPvGx"}],"group":"cf-nel","max_age":604800} cf-ray 8ec48977ce310745-MAN alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=38855&min_rtt=31048&rtt_var=6456&sent=42&recv=32&lost=0&retrans=0&sent_bytes=27866&recv_bytes=8200&delivery_rate=41769&cwnd=18000&unsent_bytes=0&cid=5d290589cf6f22b5&ts=1020&x=1", cfHdrFlush;dur=0 date Tue, 03 Dec 2024 15:19:47 GMT content-type image/svg+xml last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	im22forlogo.svg cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	3 KB 2 KB	355ms 354ms	Image image/svg+xml	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/im22forlogo.svg Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c4502e1bffc9155988eeb261ae88885e93211e73cad60005d710ba19ac860b5e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status MISS etag W/"d10-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8UaLKLuQ1dnyJhZvkmNacHMe%2F8zDf9DU3gsBoHofqrTfGIeQ0G%2FhqzN5juss7PxPqmqkZuSe3xS%2BKDYGuisJk7M%2FV75gyN2aRpKNOxHAVBrIqfn1S4Kot%2Fn9f33bCAzIYyvC8B3kzGtIJrpWmWjjg%2BsFPf7zw9CX"}],"group":"cf-nel","max_age":604800} cf-ray 8ec48977ce350745-MAN alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=31255&min_rtt=31048&rtt_var=2967&sent=17&recv=19&lost=0&retrans=0&sent_bytes=6484&recv_bytes=7640&delivery_rate=6120&cwnd=12000&unsent_bytes=0&cid=5d290589cf6f22b5&ts=871&x=1", cfHdrFlush;dur=0 date Tue, 03 Dec 2024 15:19:47 GMT content-type image/svg+xml last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	espacezra9829.png cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	686 B 1 KB	360ms 360ms	Image image/png	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/espacezra9829.png Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0d0741e418e5fa6fe7a6d2f5f42083d5aec49beb9e2ab2ec93a5c76e88b52381` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status MISS etag W/"2ae-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fMOglNwREE9jKuM76A9uuLkFp4w8%2B5cRVtl1Evawzgu9nXecMXWM%2BBQBur4j4WrS6J0DZSac%2FEeC5IeoZmdCLD8nEFy5IrqzyVZdOfsRMVrTiV6v7dMIvvBNHk4BTTEiC9odWGKmHUs4%2BcUZhFPPCZVWnvFF9kHM"}],"group":"cf-nel","max_age":604800} cf-ray 8ec48977de450745-MAN accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=31255&min_rtt=31048&rtt_var=2967&sent=21&recv=19&lost=0&retrans=0&sent_bytes=9577&recv_bytes=7640&delivery_rate=6120&cwnd=12000&unsent_bytes=0&cid=5d290589cf6f22b5&ts=883&x=1", cfHdrFlush;dur=0 content-length 686 date Tue, 03 Dec 2024 15:19:47 GMT content-type image/png last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	espace9fooahmar.png cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	678 B 1 KB	380ms 379ms	Image image/png	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/espace9fooahmar.png Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4d12b8796dded3fa21ae1cd8142ecadf3fb5e92b64232a6f5b57e4145c9d0d68` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status MISS etag W/"2a6-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bkPCYM4acYoWv1V%2BUAqTT0lcwZ0HgcMgZGI7GmYvwO0CY65ZYN9NdDu3ksIzWGAgMZJi0YowxQS85aIgyfOuKPDZfNXf%2BWbnTntB3jvQTdQAXHNnDqORQnpoZSWNK8OTlh58VKPetr3KrS9PYXDYHUkQ%2FJ3Z%2FFcI"}],"group":"cf-nel","max_age":604800} cf-ray 8ec48977de490745-MAN accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=31255&min_rtt=31048&rtt_var=2967&sent=30&recv=19&lost=0&retrans=0&sent_bytes=18484&recv_bytes=7640&delivery_rate=6120&cwnd=12000&unsent_bytes=0&cid=5d290589cf6f22b5&ts=892&x=1", cfHdrFlush;dur=11 content-length 678 date Tue, 03 Dec 2024 15:19:47 GMT content-type image/png last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	payzarim.png cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	10 KB 10 KB	365ms 364ms	Image image/png	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/payzarim.png Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4cf4a799d8e8d76b027cf25800d00d2f0ef7ea8219933af5f57144b126c3c539` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status MISS etag W/"2671-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sxMLJE4t9MW5FOpMKwJamYRpTwHjZFt589MDPqSDRwapWVQvALrEKtvH63ElwurkJ66s95BGH1ugQUeXK%2BIGLtNPUrRkqHW5FtaW60sp35Cyh1FrSFAlxusudD6JAE5JRDw0xx37m8Nx1%2BNHSyJdkApiLIeIJF0o"}],"group":"cf-nel","max_age":604800} cf-ray 8ec48977de4c0745-MAN accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=31255&min_rtt=31048&rtt_var=2967&sent=25&recv=19&lost=0&retrans=0&sent_bytes=13141&recv_bytes=7640&delivery_rate=6120&cwnd=12000&unsent_bytes=0&cid=5d290589cf6f22b5&ts=889&x=1", cfHdrFlush;dur=0 content-length 9841 date Tue, 03 Dec 2024 15:19:47 GMT content-type image/png last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	awtakhalesd.png cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	2 KB 2 KB	380ms 380ms	Image image/png	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/awtakhalesd.png Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2e4751a03f6bae610276711572bef318b0fa4fc5abc0003cff54043b17b78e82` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status MISS etag W/"700-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LsBUPqgU5%2FRL3CfYZo4caUbHOym10J%2BBcKFfFQ0o8a4fp6VWp9waM%2BJ1OohiIaCRVAK%2BgFd6lHbtHPqXxgMXCL8mAhdwWUMCRyowd9qw5HqFq8x8SyOTqBs81bmiGZT%2FuT%2FY8Pg%2FnoV46NlVbc8v26uIdYixG3YP"}],"group":"cf-nel","max_age":604800} cf-ray 8ec48977de520745-MAN accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=31255&min_rtt=31048&rtt_var=2967&sent=30&recv=19&lost=0&retrans=0&sent_bytes=18484&recv_bytes=7640&delivery_rate=6120&cwnd=12000&unsent_bytes=0&cid=5d290589cf6f22b5&ts=890&x=1", cfHdrFlush;dur=13 content-length 1792 date Tue, 03 Dec 2024 15:19:47 GMT content-type image/png last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare
GET H3	200	main.js Show response cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/js/	666 B 929 B	358ms 357ms	Script text/javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/js/main.js Requested by Host: cfspart-idp-impots-gouv.xcuiqbcha.com URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7639019193b23e3e493a6cfb780d540c865098afd9b9456a972b2b87c6f18253` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers content-encoding gzip cf-cache-status MISS etag W/"29a-6285f3205aa72-gzip" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nvudLAYRmt%2B3ZF2U791okLPyGHjihZXuM7j3FPX%2BShYqv8vTVm4snx16olGQGdy6dFYPRflOCgjdmkDYMJWuJxv4be0%2FzKTg%2B6O0E3oryEabBKpQ1RTUl3xleGdokXJodxmPkKwBMkf5aWfbJFMjcqO8jZj6UQPf"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=31255&min_rtt=31048&rtt_var=2967&sent=20&recv=19&lost=0&retrans=0&sent_bytes=8625&recv_bytes=7640&delivery_rate=6120&cwnd=12000&unsent_bytes=0&cid=5d290589cf6f22b5&ts=882&x=1", cfHdrFlush;dur=0 date Tue, 03 Dec 2024 15:19:47 GMT content-type text/javascript last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8ec48977de4e0745-MAN accept-ranges bytes content-length 247 server cloudflare
GET		open-sans-latin-ext-regular.woff2 cfspart.impots.gouv.fr/templates//polices/	0 0

GET		open-sans-latin-ext-regular.woff cfspart.impots.gouv.fr/templates/polices/	0 0

GET H3	200	favicon.ico cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/	1 KB 1 KB	367ms 367ms	Other image/x-icon	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/img/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `99af879888a29feeec095725f74e18cd070de29e7f1b4a35f20746fa45382c21` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status MISS etag W/"47e-6285f3205aa72" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hisxikVzx2qivqZVTYIk7BBNwHaJLLCo7ghZrAAsA8r%2FKiQZNeZQrp%2BMlG01Q3cDgCXQUnHe5TbweSTcjEN8mmc5%2B3%2B%2BJNmvAneBO8CqW%2B1qsR0B4dG%2FG01424VvGtjQYlAjhjPyLX6i2S5HJvzKTRR7DZlwI8j7"}],"group":"cf-nel","max_age":604800} cf-ray 8ec4897b2c030745-MAN alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=36357&min_rtt=31048&rtt_var=6476&sent=49&recv=36&lost=0&retrans=0&sent_bytes=34554&recv_bytes=8727&delivery_rate=213164&cwnd=18000&unsent_bytes=0&cid=5d290589cf6f22b5&ts=1426&x=1", cfHdrFlush;dur=0 date Tue, 03 Dec 2024 15:19:48 GMT content-type image/x-icon last-modified Tue, 03 Dec 2024 15:19:46 GMT vary Accept-Encoding server cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cfspart.impots.gouv.fr
URL: https://cfspart.impots.gouv.fr/templates//polices/open-sans-latin-ext-regular.woff2

Domain: cfspart.impots.gouv.fr
URL: https://cfspart.impots.gouv.fr/templates/polices/open-sans-latin-ext-regular.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Impots Gouv (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
javascript	error	URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Message: Access to font at 'https://cfspart.impots.gouv.fr/templates//polices/open-sans-latin-ext-regular.woff2' from origin 'https://cfspart-idp-impots-gouv.xcuiqbcha.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cfspart.impots.gouv.fr/templates//polices/open-sans-latin-ext-regular.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://cfspart-idp-impots-gouv.xcuiqbcha.com/oauth2/a3b09/ Message: Access to font at 'https://cfspart.impots.gouv.fr/templates/polices/open-sans-latin-ext-regular.woff' from origin 'https://cfspart-idp-impots-gouv.xcuiqbcha.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cfspart.impots.gouv.fr/templates/polices/open-sans-latin-ext-regular.woff Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

caudsim.com
cfspart-idp-impots-gouv.xcuiqbcha.com
cfspart.impots.gouv.fr
extreme-ip-lookup.com
cfspart.impots.gouv.fr
172.67.140.154
188.114.96.3
2606:4700:3033::6815:4f19
2a06:98c1:3120::3
37.48.65.182
0d0741e418e5fa6fe7a6d2f5f42083d5aec49beb9e2ab2ec93a5c76e88b52381
20172da86df7e51afc06f43c6b313bd2bcc69aaad87bad661959340da9f6956f
2e4751a03f6bae610276711572bef318b0fa4fc5abc0003cff54043b17b78e82
4cf4a799d8e8d76b027cf25800d00d2f0ef7ea8219933af5f57144b126c3c539
4d12b8796dded3fa21ae1cd8142ecadf3fb5e92b64232a6f5b57e4145c9d0d68
7639019193b23e3e493a6cfb780d540c865098afd9b9456a972b2b87c6f18253
90d8552964c8e804a6dea1870bfd34d3114389e6c28b725bcdec63808b75c8a6
990e3dcb5cbb5cd129bdc85c306b69fb50aa47dd3be973609079a2c1979511ad
99af879888a29feeec095725f74e18cd070de29e7f1b4a35f20746fa45382c21
bdcf5e7ac9bbf32218246f5509dd40e70a1962cbca5b1ed2355ca5ae760fdae7
c16470a2ecc8a550fa484c064ae54879e0cff3aad81d3374dfac9d775a963165
c4502e1bffc9155988eeb261ae88885e93211e73cad60005d710ba19ac860b5e
f4498268ffc48f2d932e52d9b46f4acc91aa4c4d5e4a46ab2a3ba6059fb26db1

cfspart-idp-impots-gouv.xcuiqbcha.com Open in urlscan Pro 188.114.96.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

81 %HTTPS

40 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

38 kBTransfer

55 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

5 Console Messages

Indicators

cfspart-idp-impots-gouv.xcuiqbcha.com Open in urlscan Pro
188.114.96.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

81 %
HTTPS

40 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

38 kB
Transfer

55 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!