dgfip-finances-gouv-fr.imtguvlogin.com
Open in
urlscan Pro
2606:4700:3031::6815:5bc8
Malicious Activity!
Public Scan
Submission: On January 16 via manual from FR — Scanned from FR
Summary
TLS certificate: Issued by GTS CA 1P5 on January 15th 2024. Valid for: 3 months.
This is the only time dgfip-finances-gouv-fr.imtguvlogin.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Impots Gouv (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 2606:4700:303... 2606:4700:3031::6815:5bc8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 2 |
ASN13335 (CLOUDFLARENET, US)
dgfip-finances-gouv-fr.imtguvlogin.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
imtguvlogin.com
dgfip-finances-gouv-fr.imtguvlogin.com |
26 KB |
0 |
impots.gouv.fr
Failed
cfspart.impots.gouv.fr Failed |
|
11 | 2 |
Domain | Requested by | |
---|---|---|
9 | dgfip-finances-gouv-fr.imtguvlogin.com |
dgfip-finances-gouv-fr.imtguvlogin.com
|
0 | cfspart.impots.gouv.fr Failed |
dgfip-finances-gouv-fr.imtguvlogin.com
|
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
imtguvlogin.com GTS CA 1P5 |
2024-01-15 - 2024-04-14 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://dgfip-finances-gouv-fr.imtguvlogin.com/connect/fr/a7a39/
Frame ID: 2EE75001AB13EEE059B835DAF5054CDB
Requests: 11 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
dgfip-finances-gouv-fr.imtguvlogin.com/connect/fr/a7a39/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
dgfip-finances-gouv-fr.imtguvlogin.com/connect/fr/a7a39/css/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logoin1.svg
dgfip-finances-gouv-fr.imtguvlogin.com/connect/fr/a7a39/img/ |
18 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logoin2.svg
dgfip-finances-gouv-fr.imtguvlogin.com/connect/fr/a7a39/img/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wawzeay0.png
dgfip-finances-gouv-fr.imtguvlogin.com/connect/fr/a7a39/img/ |
686 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hmarwaaw1192.png
dgfip-finances-gouv-fr.imtguvlogin.com/connect/fr/a7a39/img/ |
678 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
goospayawa101.png
dgfip-finances-gouv-fr.imtguvlogin.com/connect/fr/a7a39/img/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popopauy1010.png
dgfip-finances-gouv-fr.imtguvlogin.com/connect/fr/a7a39/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
dgfip-finances-gouv-fr.imtguvlogin.com/connect/fr/a7a39/js/ |
666 B 545 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
open-sans-latin-ext-regular.woff2
cfspart.impots.gouv.fr/templates//polices/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
open-sans-latin-ext-regular.woff
cfspart.impots.gouv.fr/templates/polices/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- cfspart.impots.gouv.fr
- URL
- https://cfspart.impots.gouv.fr/templates//polices/open-sans-latin-ext-regular.woff2
- Domain
- cfspart.impots.gouv.fr
- URL
- https://cfspart.impots.gouv.fr/templates/polices/open-sans-latin-ext-regular.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Impots Gouv (Government)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cfspart.impots.gouv.fr
dgfip-finances-gouv-fr.imtguvlogin.com
cfspart.impots.gouv.fr
2606:4700:3031::6815:5bc8
0d0741e418e5fa6fe7a6d2f5f42083d5aec49beb9e2ab2ec93a5c76e88b52381
2e4751a03f6bae610276711572bef318b0fa4fc5abc0003cff54043b17b78e82
4cf4a799d8e8d76b027cf25800d00d2f0ef7ea8219933af5f57144b126c3c539
4d12b8796dded3fa21ae1cd8142ecadf3fb5e92b64232a6f5b57e4145c9d0d68
51536e9183afc18effba7704a3d629980d059ea43e8f3f395950d7ec825add66
7639019193b23e3e493a6cfb780d540c865098afd9b9456a972b2b87c6f18253
90d8552964c8e804a6dea1870bfd34d3114389e6c28b725bcdec63808b75c8a6
c4502e1bffc9155988eeb261ae88885e93211e73cad60005d710ba19ac860b5e
c8a2b949015825c75754bc25f097765f60ed94d2b4cf6ae2fd5fc084aec965df