imp-gvrmnt.yj.fr
Open in
urlscan Pro
199.16.131.246
Malicious Activity!
Public Scan
Effective URL: https://imp-gvrmnt.yj.fr/les-lmpots/LoginAccess.php?op=c&url=kzlq68jxo4i20abgun9hmw3c1fysdvr57pte
Submission: On November 17 via api from BE
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on November 15th 2019. Valid for: 3 months.
This is the only time imp-gvrmnt.yj.fr was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Impots Gouv (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.123.16 167.89.123.16 | 11377 (SENDGRID) (SENDGRID - SendGrid) | |
2 | 2606:4700:30:... 2606:4700:30::681f:4124 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2606:4700::68... 2606:4700::6811:4104 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 2a00:1450:400... 2a00:1450:4001:818::2004 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 104.20.2.47 104.20.2.47 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 1 | 67.199.248.11 67.199.248.11 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD - Google LLC) | |
7 | 199.16.131.246 199.16.131.246 | 53589 (PLANETHOS...) (PLANETHOSTER-8 - PlanetHoster) | |
15 | 6 |
ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789123x16.outbound-mail.sendgrid.net
u10591566.ct.sendgrid.net |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
nullrefer.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ajax.cloudflare.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google.com |
ASN15169 (GOOGLE - Google LLC, US)
www.gstatic.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.statcounter.com | |
c.statcounter.com |
ASN396982 (GOOGLE-PRIVATE-CLOUD - Google LLC, US)
PTR: bit.ly
bit.ly |
ASN53589 (PLANETHOSTER-8 - PlanetHoster, CA)
PTR: world-216.ca.planethoster.net
imp-gvrmnt.yj.fr |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
yj.fr
imp-gvrmnt.yj.fr |
29 KB |
2 |
statcounter.com
www.statcounter.com c.statcounter.com |
12 KB |
2 |
google.com
www.google.com |
851 B |
2 |
nullrefer.com
nullrefer.com |
2 KB |
1 |
bit.ly
1 redirects
bit.ly |
320 B |
1 |
gstatic.com
www.gstatic.com |
91 KB |
1 |
cloudflare.com
ajax.cloudflare.com |
4 KB |
1 |
sendgrid.net
1 redirects
u10591566.ct.sendgrid.net |
255 B |
15 | 8 |
Domain | Requested by | |
---|---|---|
7 | imp-gvrmnt.yj.fr |
imp-gvrmnt.yj.fr
|
2 | www.google.com |
nullrefer.com
www.gstatic.com |
2 | nullrefer.com |
nullrefer.com
|
1 | c.statcounter.com |
www.statcounter.com
|
1 | bit.ly | 1 redirects |
1 | www.statcounter.com |
ajax.cloudflare.com
|
1 | www.gstatic.com |
www.google.com
|
1 | ajax.cloudflare.com |
nullrefer.com
|
1 | u10591566.ct.sendgrid.net | 1 redirects |
15 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-08-10 - 2020-02-16 |
6 months | crt.sh |
www.google.com GTS CA 1O1 |
2019-11-05 - 2020-01-28 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2019-11-05 - 2020-01-28 |
3 months | crt.sh |
imp-gvrmnt.yj.fr Let's Encrypt Authority X3 |
2019-11-15 - 2020-02-13 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://imp-gvrmnt.yj.fr/les-lmpots/LoginAccess.php?op=c&url=kzlq68jxo4i20abgun9hmw3c1fysdvr57pte
Frame ID: 3F24D074ADBBF4587A0EA5CEACBC49E5
Requests: 14 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LftsXMUAAAAALlWG1yUWFRGkwxc7P-ZFroKILkc&co=aHR0cDovL251bGxyZWZlci5jb206ODA.&hl=en&v=75nbHAdFrusJCwoMVGTXoHoM&size=invisible&cb=kyznbdtx4kew
Frame ID: 36478B97A2A62E801F74D0E0F733EF30
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://u10591566.ct.sendgrid.net/wf/click?upn=yTJ3TUbj-2B7wna-2FDmbED0ofi52etRtwNMXeY9Iv9BtQhpyjJteyL7bgzsIel...
HTTP 302
http://nullrefer.com/?https://bit.ly/2QncOCo Page URL
-
https://bit.ly/2QncOCo
HTTP 301
https://imp-gvrmnt.yj.fr/les-lmpots/LoginAccess.php?op=c&url=kzlq68jxo4i20abgun9hmw3c1fysdvr57pte Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u10591566.ct.sendgrid.net/wf/click?upn=yTJ3TUbj-2B7wna-2FDmbED0ofi52etRtwNMXeY9Iv9BtQhpyjJteyL7bgzsIelVK-2Bsb2IC7vMszMEDN25GrLMO5PA-3D-3D_xijIVbw3iDvv4nDu-2FiZJeLZXGaQbbYms1oYofcVjUtbxPxTUGj1rvEeD9x7zDFq-2FLR5fOUlfelSOZfYZeet7XqDe1h1ecW3SmbDc-2BJddWYS4RtqEIy2PCkD9NTJsZYXxfi8Nguuqh6-2BbWPuu5ieOuT913TA3abIcQazgjusN4yZeULs6JOopQJq9TJPbkHpYzV26MVnhKdU0f-2F1dcHja-2BvURbVy-2BLKBuyCIvxvbQvMk-3D
HTTP 302
http://nullrefer.com/?https://bit.ly/2QncOCo Page URL
-
https://bit.ly/2QncOCo
HTTP 301
https://imp-gvrmnt.yj.fr/les-lmpots/LoginAccess.php?op=c&url=kzlq68jxo4i20abgun9hmw3c1fysdvr57pte Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://u10591566.ct.sendgrid.net/wf/click?upn=yTJ3TUbj-2B7wna-2FDmbED0ofi52etRtwNMXeY9Iv9BtQhpyjJteyL7bgzsIelVK-2Bsb2IC7vMszMEDN25GrLMO5PA-3D-3D_xijIVbw3iDvv4nDu-2FiZJeLZXGaQbbYms1oYofcVjUtbxPxTUGj1rvEeD9x7zDFq-2FLR5fOUlfelSOZfYZeet7XqDe1h1ecW3SmbDc-2BJddWYS4RtqEIy2PCkD9NTJsZYXxfi8Nguuqh6-2BbWPuu5ieOuT913TA3abIcQazgjusN4yZeULs6JOopQJq9TJPbkHpYzV26MVnhKdU0f-2F1dcHja-2BvURbVy-2BLKBuyCIvxvbQvMk-3D HTTP 302
- http://nullrefer.com/?https://bit.ly/2QncOCo
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
/
nullrefer.com/ Redirect Chain
|
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
763 B 851 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/75nbHAdFrusJCwoMVGTXoHoM/ |
254 KB 91 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter.js
www.statcounter.com/counter/ |
31 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
LoginAccess.php
imp-gvrmnt.yj.fr/les-lmpots/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
t.php
c.statcounter.com/ |
213 B 551 B |
Other
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/api2/ Frame 3647 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chk_captcha_v3
nullrefer.com/cdn-cgi/l/ |
0 406 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
imp-gvrmnt.yj.fr/les-lmpots/css/ |
3 KB 747 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
peka.svg
imp-gvrmnt.yj.fr/les-lmpots/images/ |
79 KB 21 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pro.png
imp-gvrmnt.yj.fr/les-lmpots/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
part.png
imp-gvrmnt.yj.fr/les-lmpots/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
info.png
imp-gvrmnt.yj.fr/les-lmpots/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cc.png
imp-gvrmnt.yj.fr/les-lmpots/images/ |
773 B 803 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Impots Gouv (Government)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| validate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.cloudflare.com
bit.ly
c.statcounter.com
imp-gvrmnt.yj.fr
nullrefer.com
u10591566.ct.sendgrid.net
www.google.com
www.gstatic.com
www.statcounter.com
104.20.2.47
167.89.123.16
199.16.131.246
2606:4700:30::681f:4124
2606:4700::6811:4104
2a00:1450:4001:818::2004
2a00:1450:4001:81f::2003
67.199.248.11
033c4caa10b2b81394c1c9433bfaf8e588f292d8b48a9f7cac901af1432839f6
0459b07303a9e1dbbb87d66e911a9d00c6f1b19059b9a19e7b1c485bca6ff883
0ce2d88650e9a78d7d8595d124139642fd5073595e7e9cd25502cc0ca9ac368b
592501407b8239cfb332f00e9c100851e2a78c33bb7dad63fd2ab0225d91fd08
7ebb1042972496d60bb6555b9622f7e23201bbfe5d25b33d1096f1b61d659045
9c93677f27df4a84dc3771d115060df797ba330b6d29b9156541500cd40702d9
a6c6607239686eee51a1d661459bd47b2d5324b46e17cc393fa17b5ed7ded6d9
a96a5a294bea7639f791cc1133f90053073558439d9819751ea290b38dcaa64d
e1ad46ba6eddd59d4904e32a54aa7ad9142e42f2977169ed98e9eb22fa276714
f1189f7e91a2ee383d2734b0cd93183d5e4ec58ec6ae696ee836ab0c23e83cb1