qjhcjuq.cluster029.hosting.ovh.net Open in urlscan Pro
51.91.236.255  Malicious Activity! Public Scan

URL: http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
Submission: On June 17 via manual from MA — Scanned from FR

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 9 HTTP transactions. The main IP is 51.91.236.255, located in France and belongs to OVH, FR. The main domain is qjhcjuq.cluster029.hosting.ovh.net.
This is the only time qjhcjuq.cluster029.hosting.ovh.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Assurance Maladie (Healthcare)

Domain & IP information

IP Address AS Autonomous System
4 51.91.236.255 16276 (OVH)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2620:0:862:ed... 14907 (WIKIMEDIA)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
9 6
Apex Domain
Subdomains
Transfer
4 ovh.net
qjhcjuq.cluster029.hosting.ovh.net
232 KB
1 gstatic.com
fonts.gstatic.com
17 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67
1 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 686
30 KB
1 wikimedia.org
upload.wikimedia.org — Cisco Umbrella Rank: 2733
36 KB
1 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1083
13 KB
9 6
Domain Requested by
4 qjhcjuq.cluster029.hosting.ovh.net qjhcjuq.cluster029.hosting.ovh.net
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com qjhcjuq.cluster029.hosting.ovh.net
1 code.jquery.com qjhcjuq.cluster029.hosting.ovh.net
1 upload.wikimedia.org qjhcjuq.cluster029.hosting.ovh.net
1 use.fontawesome.com qjhcjuq.cluster029.hosting.ovh.net
9 6

This site contains links to these domains. Also see Links.

Domain
www.impots.gouv.fr
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-06-06 -
2023-06-05
a year crt.sh
*.wikipedia.org
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2021-10-19 -
2022-11-17
a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2021-07-14 -
2022-08-14
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-05-30 -
2022-08-22
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2022-05-30 -
2022-08-22
3 months crt.sh

This page contains 1 frames:

Primary Page: http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
Frame ID: 13B566116A75593D510C50BBC555A6FA
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Veuillez remplir le formulaire

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

56 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

329 kB
Transfer

604 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
46 KB
13 KB
Document
General
Full URL
http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
Protocol
HTTP/1.1
Server
51.91.236.255 , France, ASN16276 (OVH, FR),
Reverse DNS
cluster029.hosting.ovh.net
Software
Apache / PHP/7.4
Resource Hash
656bfd89f851cc3270049753f5930bac0930421479cefca81cd8af050f559d39

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 17 Jun 2022 16:10:54 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
transfer-encoding
chunked
vary
Accept-Encoding
x-iplb-instance
32725
x-iplb-request-id
253BA466:E9D2_335BECFF:0050_62ACA78E_07FD:245C7
x-powered-by
PHP/7.4
all.css
use.fontawesome.com/releases/v5.8.2/css/
54 KB
13 KB
Stylesheet
General
Full URL
https://use.fontawesome.com/releases/v5.8.2/css/all.css
Requested by
Host: qjhcjuq.cluster029.hosting.ovh.net
URL: http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f

Request headers

Referer
http://qjhcjuq.cluster029.hosting.ovh.net/
Origin
http://qjhcjuq.cluster029.hosting.ovh.net
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Fri, 17 Jun 2022 16:10:55 GMT
content-encoding
br
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3281652
access-control-allow-methods
GET
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
0J6K253N06KS2335
x-amz-id-2
bRl2Wcu3N57um9emqAfMMt/VQYOeWG/vBKzj4hGzUGROA73lq53MIQuuZEJ6z72P1R1l/XsfXPY=
last-modified
Wed, 30 Jun 2021 15:47:00 GMT
server
cloudflare
etag
W/"77cbad34e5ce95e70847b074e05faeab"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kj3CRoa%2B7TTm3l88INu6b%2BecQwYQSitNFlHK0p7rmoYxn%2FH3%2B%2BnltlGxuU5871pFEO1BSoTsu4DW6YnupnorBR5HjQTwYHOZaJfH%2F13%2B9bjDmIoK4RDNsTwVlNJNMX1ebmOChDYVCu0SwnE%2B2jIjaGP3"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
cf-ray
71cd0edddbc8406f-CDG
style_v2.css
qjhcjuq.cluster029.hosting.ovh.net/cartevitale/assets/css/
133 KB
20 KB
Stylesheet
General
Full URL
http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/assets/css/style_v2.css
Requested by
Host: qjhcjuq.cluster029.hosting.ovh.net
URL: http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
Protocol
HTTP/1.1
Server
51.91.236.255 , France, ASN16276 (OVH, FR),
Reverse DNS
cluster029.hosting.ovh.net
Software
Apache /
Resource Hash
b52d7753a913d5d2fbecfb724e05d6f86d9707b91c32d7c776abbf73c33aaa70

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Fri, 17 Jun 2022 16:10:51 GMT
content-encoding
gzip
last-modified
Sat, 11 Jun 2022 00:54:28 GMT
server
Apache
x-iplb-request-id
253BA466:E9D2_335BECFF:0050_62ACA78E_0806:245C7
x-iplb-instance
32725
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=900
accept-ranges
bytes
content-length
19933
expires
Fri, 17 Jun 2022 16:25:55 GMT
bootstrap.css
qjhcjuq.cluster029.hosting.ovh.net/cartevitale/assets/css/
37 KB
4 KB
Stylesheet
General
Full URL
http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/assets/css/bootstrap.css
Requested by
Host: qjhcjuq.cluster029.hosting.ovh.net
URL: http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
Protocol
HTTP/1.1
Server
51.91.236.255 , France, ASN16276 (OVH, FR),
Reverse DNS
cluster029.hosting.ovh.net
Software
Apache /
Resource Hash
42765c506334629619e418ee2533b34e0eb4b8c801f070568f9c52a3a40b16e1

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Fri, 17 Jun 2022 16:10:55 GMT
content-encoding
gzip
last-modified
Sat, 11 Jun 2022 00:54:27 GMT
server
Apache
x-iplb-request-id
253BA466:E9EE_335BECFF:0050_62ACA78E_1674:A7D1
x-iplb-instance
32726
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=900
accept-ranges
bytes
content-length
3636
expires
Fri, 17 Jun 2022 16:25:55 GMT
first.PNG
qjhcjuq.cluster029.hosting.ovh.net/cartevitale/assets/images/
194 KB
195 KB
Image
General
Full URL
http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/assets/images/first.PNG
Requested by
Host: qjhcjuq.cluster029.hosting.ovh.net
URL: http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
Protocol
HTTP/1.1
Server
51.91.236.255 , France, ASN16276 (OVH, FR),
Reverse DNS
cluster029.hosting.ovh.net
Software
Apache /
Resource Hash
ea192fcb8d784eab17a9e9c2a40dabf4debdcac48adbfd148b52a8425da118f4

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Fri, 17 Jun 2022 16:10:54 GMT
last-modified
Sat, 11 Jun 2022 00:54:31 GMT
server
Apache
x-iplb-request-id
253BA466:E9F2_335BECFF:0050_62ACA78E_0807:245C7
x-iplb-instance
32725
content-type
image/png
cache-control
max-age=900
accept-ranges
bytes
content-length
199039
expires
Fri, 17 Jun 2022 16:25:55 GMT
600px-ASSURANCE_MALADIE.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/
35 KB
36 KB
Image
General
Full URL
https://upload.wikimedia.org/wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/600px-ASSURANCE_MALADIE.svg.png
Requested by
Host: qjhcjuq.cluster029.hosting.ovh.net
URL: http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),
Reverse DNS
Software
ATS/8.0.8 /
Resource Hash
f14fcff69f0f117056626cb28fe2ee5784d53cdd8e1fa256f429d3addea27183
Security Headers
Name Value
Strict-Transport-Security max-age=106384710; includeSubDomains; preload

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
http://qjhcjuq.cluster029.hosting.ovh.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Fri, 17 Jun 2022 08:06:52 GMT
nel
{ "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0}
age
29042
x-cache-status
hit-front
x-cache
cp3055 hit, cp3061 hit/3
content-disposition
inline;filename*=UTF-8''ASSURANCE_MALADIE.svg.png
server-timing
cache;desc="hit-front", host;desc="cp3061"
content-length
35606
x-client-ip
2001:41d0:8:d154::3
accept-ranges
bytes
last-modified
Sat, 06 Mar 2021 22:22:00 GMT
server
ATS/8.0.8
etag
73e3deb2d3ac39fa8cc211b90f93bfae
strict-transport-security
max-age=106384710; includeSubDomains; preload
report-to
{ "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
permissions-policy
interest-cohort=(),ch-ua-arch=(self "intake-analytics.wikimedia.org"),ch-ua-bitness=(self "intake-analytics.wikimedia.org"),ch-ua-full-version-list=(self "intake-analytics.wikimedia.org"),ch-ua-model=(self "intake-analytics.wikimedia.org"),ch-ua-platform-version=(self "intake-analytics.wikimedia.org")
accept-ch
Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
timing-allow-origin
*
jquery-3.4.1.min.js
code.jquery.com/
86 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.4.1.min.js
Requested by
Host: qjhcjuq.cluster029.hosting.ovh.net
URL: http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

Referer
http://qjhcjuq.cluster029.hosting.ovh.net/
Origin
http://qjhcjuq.cluster029.hosting.ovh.net
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Fri, 17 Jun 2022 16:10:55 GMT
content-encoding
gzip
last-modified
Wed, 16 Feb 2022 10:50:39 GMT
server
nginx
etag
W/"620cd6ff-15851"
vary
Accept-Encoding
x-hw
1655482255.dop026.pa1.t,1655482255.cds236.pa1.hn,1655482255.cds237.pa1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30638
css
fonts.googleapis.com/
3 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext
Requested by
Host: qjhcjuq.cluster029.hosting.ovh.net
URL: http://qjhcjuq.cluster029.hosting.ovh.net/cartevitale/assets/css/style_v2.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
55475f690303f28766cea7ae2214bca689adb1d19426a636ae5f812d30ed88aa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
http://qjhcjuq.cluster029.hosting.ovh.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 17 Jun 2022 14:30:25 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Fri, 17 Jun 2022 16:10:55 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 17 Jun 2022 16:10:55 GMT
memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v29/
16 KB
17 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v29/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9434dddcdf38e072b039bb92f9e90639ec0e0563e8ff51604a60d91830c29289
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
http://qjhcjuq.cluster029.hosting.ovh.net
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Mon, 13 Jun 2022 11:57:13 GMT
x-content-type-options
nosniff
age
360822
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16720
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:25:13 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 13 Jun 2023 11:57:13 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Assurance Maladie (Healthcare)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
qjhcjuq.cluster029.hosting.ovh.net/ Name: PHPSESSID
Value: 7d26de767e5a1b17c242561f0e0c6264