PUBLIC DOSSIER / DATED OBSERVATION

impots.gouv.fr

2026-09-20 19:37 UTC Scope completed

Compare Export PDF ↗New reading

Summary

11/ 12

Documented angles

Reading coverage, not a security grade.

2 public observations are documented in this dossier.

No structuring dependency is highlighted in the current public evidence.

No useful change is retained since the previous reading.

4 points still require confirmation or cannot be observed from outside.

Distinct evidence: 37
Retained signals: 2
Identified products: 2

General information

Domain name: impots.gouv.fr
Reading state: Scope completed
Registered on: 2008-12-10 08:44 UTC
Registrar: OVH
Stated expiration: 2026-12-10 08:44 UTC
Registry outcome: Observed

View information and sources →

Domain registration, not the website or company creation date.

Documentary footprint

S / SCANAPSE

impots.gouv.fr2026-09-20 19:37 UTC

Accueil impots.gouv.fr | impots.gouv.fr

Angles: 11/12
Evidence: 37
Signals: 2

Preview of the retained dossier, not a screenshot of the target.

View observed content →

Estimated countries of observed IPs

View details →

Estimate from the local dataset recorded with this measurement. This country locates neither the organisation nor its data; a proxy or anycast network may represent several points of presence.

4 recorded IP address(es) / 1 country estimate(s) available

193.246.48.80SwitzerlandConnected IP
193.246.48.99SwitzerlandDNS only
2001:918:ffcb::c1f6:3050SwitzerlandDNS only
2001:918:ffcb::c1f6:3063SwitzerlandDNS only

Country-level estimates do not locate an organisation or its stored data.IP Geolocation by DB-IP · 2026-09 · CC BY 4.0. Natural Earth

Technologies and services

View all (2) →

Drupal 10 (https://www.drupal.org)Technology clue DrupalTechnology clue

Key signals

Inspect →

No summary signal retained. This does not mean “no risk”.

Each finding remains linked to its scope, evidence and limitations.

Visible relationships

Explore all →

impots.gouv.fr193.246.48.80resolves to

impots.gouv.fr2001:918:ffcb::c1f6:3050resolves to

impots.gouv.fr2001:918:ffcb::c1f6:3063resolves to

impots.gouv.frDrupal 10 (https://www.drupal.org)uses technology

Retained evidence

Open the record →

2026-09-20 19:37 UTCtechnology 2026-09-20 19:37 UTCmodule_finding 2026-09-20 19:37 UTCdnssec_evidence 2026-09-20 19:37 UTCdns_address

Domain timeline

View history →

2026-09-20 19:36 UTCRetained observation 2026-09-20 19:37 UTCRetained observation

Only retained observations are shown. No earlier event is reconstructed.

The twelve reading angles

Domain identityObserved InfrastructurePartial reading Encryption and transportObserved Mail and trustObserved DNS and governanceObserved External dependenciesObserved Observable technologiesObserved Public exposureObserved Documentary trustObserved Security signalsObserved Evolution over timeUndetermined Evidence and traceabilityObserved

02 / IDENTITY & CONTEXT

The domain, without assumptions

Domain registration

Observed host: impots.gouv.fr
Registry query domain: impots.gouv.fr
Registered on: 2008-12-10 08:44 UTC
Registrar: OVH
Stated expiration: 2026-12-10 08:44 UTC
Collection outcome: Observed

Read RDAP source ↗

2026-09-20 19:37 UTC

Registration is neither the founding of a company nor the first launch of a website. Personal contact details are not reproduced.

Estimated countries of observed IPs

Estimate from the local dataset recorded with this measurement. This country locates neither the organisation nor its data; a proxy or anycast network may represent several points of presence.

4 recorded IP address(es) / 1 country estimate(s) available

193.246.48.80SwitzerlandConnected IP
193.246.48.99SwitzerlandDNS only
2001:918:ffcb::c1f6:3050SwitzerlandDNS only
2001:918:ffcb::c1f6:3063SwitzerlandDNS only

Country-level estimates do not locate an organisation or its stored data.IP Geolocation by DB-IP · 2026-09 · CC BY 4.0. Natural Earth

Context and documentary references

Estimated IP countries and a provider’s context do not establish applicable jurisdiction or compliance.

GDPR

The observed territorial context links the domain to the European Union. Public privacy signals increase the relevance of this framework without proving internal processing practices.

Applicability requires review; not a legal determination.

Documentary source ↗

NIS2

The directive may apply to some entities depending on sector, size and role. Scanapse does not infer those conditions from a domain alone.

Applicability requires review; not a legal determination.

Documentary source ↗

Cyber Resilience Act

This regulation applies to products with digital elements under specific conditions. A public website alone cannot establish whether an entity or product falls within scope.

Applicability requires review; not a legal determination.

Documentary source ↗

DORA

DORA targets financial entities and certain ICT providers within its scope. Without evidence of sector or status, Scanapse keeps it as context only.

Applicability requires review; not a legal determination.

Documentary source ↗

French Data Protection Act

A French context makes this national data-protection law, complementary to GDPR, potentially relevant to personal-data processing.

Applicability requires review; not a legal determination.

Documentary source ↗

Technical hosting, IP addresses, ASNs and CDN locations do not establish the applicable legal jurisdiction by themselves.

A country-code domain is only a contextual clue and does not prove where the organisation is legally established.

03 / TECHNICAL CLUES

Visible technologies and services

A resource or response header is a public clue, not a server inspection.

Drupal 10 (https://www.drupal.org)

Technology fingerprint

HTML generator metadata

2026-09-20 19:37 UTC

Clue source ↗

Rule and scope

2026.09-v3.1

Does not establish effective execution or a server technology that is not exposed.

Drupal

Technology fingerprint

Drupal generator and structural markers

2026-09-20 19:37 UTC

Clue source ↗

Rule and scope

2026.09-v3.1

Does not establish effective execution or a server technology that is not exposed.

04 / WHAT CONNECTS

Visible domain relationships

Technical relationships, not ownership links or assumed partnerships.

impots.gouv.fr193.246.48.80

resolves to

Why this connection?

Recorded technical relationship, not a partnership or ownership link.

30ef8ba1e13f57176ce6 →

Retained structured value

{"id":"3ef589e45eeeb6133ba4630828faa7ca45b531a846fafac4f27a3b31ec2ddff7","subject":"impots.gouv.fr","predicate":"resolves_to","object":"193.246.48.80","state":"observed","evidence_ids":["30ef8ba1e13f57176ce6379e25777f3da90e480ba1042b481a9bd4c92c15e1f7"],"first_seen_at":"2026-09-20T19:37:54+00:00","last_seen_at":"2026-09-20T19:37:54+00:00"}

impots.gouv.fr2001:918:ffcb::c1f6:3050

resolves to

Why this connection?

Recorded technical relationship, not a partnership or ownership link.

fee6ae9564426e922e71 →

Retained structured value

{"id":"8c9b50d9cbce19976d21e20c56b1ac706ea518b2d378967736a9602a7b2880d7","subject":"impots.gouv.fr","predicate":"resolves_to","object":"2001:918:ffcb::c1f6:3050","state":"observed","evidence_ids":["fee6ae9564426e922e7191e3c8dab27f83ea5e75e269aec92cd5584d9b2be841"],"first_seen_at":"2026-09-20T19:37:54+00:00","last_seen_at":"2026-09-20T19:37:54+00:00"}

impots.gouv.fr2001:918:ffcb::c1f6:3063

resolves to

Why this connection?

Recorded technical relationship, not a partnership or ownership link.

9552ca19228f1a9329b9 →

Retained structured value

{"id":"9a56c38b642148d95e5d84c2c8712d8396ba85c44455e1d9507607d68686e1ef","subject":"impots.gouv.fr","predicate":"resolves_to","object":"2001:918:ffcb::c1f6:3063","state":"observed","evidence_ids":["9552ca19228f1a9329b935c08956c5f46ebabe047ef4fd587857f22d567d8eea"],"first_seen_at":"2026-09-20T19:37:54+00:00","last_seen_at":"2026-09-20T19:37:54+00:00"}

impots.gouv.frDrupal 10 (https://www.drupal.org)

uses technology

Why this connection?

Recorded technical relationship, not a partnership or ownership link.

939c61410462c24ac94b →

Retained structured value

{"id":"a16c029cb8ec9f5ce519e2d7cd0ed35b8ad2a9b22fe948efd49661acb4d99ef0","subject":"impots.gouv.fr","predicate":"uses_technology","object":"Drupal 10 (https://www.drupal.org)","state":"observed","evidence_ids":["939c61410462c24ac94be70b0b6079b1b183acb8853155b476ea12aa02171c89"],"first_seen_at":"2026-09-20T19:37:54+00:00","last_seen_at":"2026-09-20T19:37:54+00:00"}

impots.gouv.fr193.246.48.99

resolves to

Why this connection?

Recorded technical relationship, not a partnership or ownership link.

d68977bcaa4861e68e7c →

Retained structured value

{"id":"c0f426a3a5bf1c4e9eb0874e854bc61a17b2699a38d954abc85d5ce15b0bc99c","subject":"impots.gouv.fr","predicate":"resolves_to","object":"193.246.48.99","state":"observed","evidence_ids":["d68977bcaa4861e68e7c3788cb3be1a63dafaed5f6fd88b795c26fb640880e26"],"first_seen_at":"2026-09-20T19:37:54+00:00","last_seen_at":"2026-09-20T19:37:54+00:00"}

impots.gouv.frDrupal

uses technology

Why this connection?

Recorded technical relationship, not a partnership or ownership link.

aac86f03253f52a4b4a8 →

Retained structured value

{"id":"de79dfad4fc34732321b1028e2628ee8ea2183c4c818a6935a633320fad56c62","subject":"impots.gouv.fr","predicate":"uses_technology","object":"Drupal","state":"observed","evidence_ids":["aac86f03253f52a4b4a840f8b62d3ca06ec9aec10bb334563b7f59bb86d5b9a5"],"first_seen_at":"2026-09-20T19:37:54+00:00","last_seen_at":"2026-09-20T19:37:54+00:00"}

05 / POINTS TO EXAMINE

Signals, context and limitations

No summary signal retained. This is not a finding of no risk.

All retained signals (2)

Effective data location cannot be determined

A provider headquarters, an IP address, or a CDN is not proof of data location.

Origin hosting cannot be determined

Edge presence must not be treated as origin hosting.

Retained technical findings and limitations

Network reachability

DNS and email

Insufficient DNS redundancy Fewer than two name servers were observed.

CAA not published No authorized certificate authority is declared in DNS.

DNSSEC not asserted The autonomous engine does not use a third-party resolver and therefore does not infer DNSSEC validation.

{"status":"not_tested","reason":"No external validating resolver is used; cryptographic validation is intentionally not inferred."}

Email trust

Email not advertised No public MX record was detected.

TLS transport

TLS expiry approaching The certificate expires in fewer than fifteen days.

13 days

Security headers

CSP allows unsafe-inline The policy permits inline execution or styling without cryptographic proof.

img-src 'self' impots.gouv.fr *.impots.gouv.fr *.france-services.gouv.fr *.openstreetmap.org *.w3.org *.basemaps.cartocdn.com data: *.w3.org *.data.economie.gouv.fr *.basemaps.cartocdn.com; script-src 'self' impots.gouv.fr *.impots.gouv.fr 'unsafe-eval' 'unsafe-inline'; style-src 'unsafe-eval' 'unsafe-inline' *.impots.gouv.fr 'self';frame-ancestors 'self'; worker-src blob:

CSP allows unsafe-eval The policy permits risky code evaluation APIs.

img-src 'self' impots.gouv.fr *.impots.gouv.fr *.france-services.gouv.fr *.openstreetmap.org *.w3.org *.basemaps.cartocdn.com data: *.w3.org *.data.economie.gouv.fr *.basemaps.cartocdn.com; script-src 'self' impots.gouv.fr *.impots.gouv.fr 'unsafe-eval' 'unsafe-inline'; style-src 'unsafe-eval' 'unsafe-inline' *.impots.gouv.fr 'self';frame-ancestors 'self'; worker-src blob:

nosniff missing The browser may try to interpret a content type differently from the declared type.

Referrer-Policy missing Referrer URLs may be transmitted with uncontrolled granularity.

Permissions-Policy missing Unused browser capabilities are not explicitly disabled.

COOP isolation missing The browsing context is not isolated from cross-origin windows.

CORP missing The cross-origin resource sharing policy is not explicit.

COEP missing Embedded resource isolation is not enabled.

Third-party resource control

External links without explicit isolation Links opened in a new tab do not declare rel=noopener or noreferrer.

Dependencies

Privacy

Technology footprint

Estimated sovereignty

Resilience

Transparency

security.txt missing or incomplete No usable /.well-known/security.txt file with a Contact field was observed.

origin_host

data_location

Full structured details remain in the JSON report. Missing information is not reconstructed.

06 / THE INSPECTED PAGE

Declared public content

Observed title: Accueil impots.gouv.fr | impots.gouv.fr
Description
Declared structured-data types: Not documented

The target’s JavaScript is not executed. A website declaration does not certify its identity.

07 / REVIEWED REFERENCES

Reviewed external references

Sources reviewed in administration, not an exhaustive Internet search. They do not modify the historical measurement.

No reviewed external reference recorded.

08 / PUBLIC RESOURCES

Documents and references

Consulter le guide pratique (PDF)

Reference observed, document not downloaded

https://www.impots.gouv.fr/sites/default/files/media/1_metier/2_professionnel/EV/2_gestion/290_facturation_electronique/guide_pratique_facturation_electronique.pdf

2026-09-20 19:37 UTC

foire aux questions

Reference observed, document not downloaded

https://www.impots.gouv.fr/sites/default/files/media/1_metier/1_particulier/simulateurs/2026/ict_aide_grands_rouleurs/faq_aide_carburant_travailleurs_grands_rouleurs.pdf

2026-09-20 19:37 UTC

pas-à-pas pour faire votre demande

Reference observed, document not downloaded

https://www.impots.gouv.fr/sites/default/files/media/1_metier/1_particulier/simulateurs/2026/ict_aide_grands_rouleurs/pas_a_pas_aide_carburant_travailleurs_grands_rouleurs.pdf

2026-09-20 19:37 UTC

security.txt

Source unavailable

https://www.impots.gouv.fr/.well-known/security.txt

2026-09-20 19:37 UTC

09 / TIME CHANGES THE READING

The domain timeline

Comparison with the previous stored reading.

2026-09-20 19:37 UTC
Displayed reading
Open →
2026-09-20 19:36 UTC
Retained observation
Open →Compare

Open dedicated history →

10 / KEEP THE READING VERIFIABLE

Evidence, not a score

The twelve angles organise the same evidence. An evidence item reused several times does not become several measurements.

Export evidence JSON Full JSON report Methodology

Domain identityObserved

What is being observed and which public markers identify it?

Observed : Dns address : 193.246.48.80 / Observed : Technical finding : Signal importance : high

Dns address Observed

193.246.48.80

dns

Technical finding Observed

Signal importance : high

dns

Technical finding Observed

Evidence : Reason : No external validating resolver is used; cryptographic validation is intentionally not inferred. ; Status : not_tested ; Signal importance : info

dns

Dns address Observed

2001:918:ffcb::c1f6:3063

dns

Dns address Observed

193.246.48.99

dns

Technical finding Observed

Signal importance : low

dns

08a376e225fa1fa7f2f8 30ef8ba1e13f57176ce6 8c051b367b42cf4ebd68 9552ca19228f1a9329b9 d68977bcaa4861e68e7c dd18b02868e014fb6f48 fee6ae9564426e922e71

InfrastructurePartial reading

Which public infrastructures appear to serve the service?

Undetermined : Origin host : Value not available / Undetermined : Data location : Value not available

Origin host Undetermined

Value not available

public_edge_does_not_reveal_origin

Data location Undetermined

Value not available

provider_metadata_does_not_prove_processing_location

Dns address Observed

193.246.48.80

dns

Technical finding Observed

Signal importance : high

dns

Technical finding Observed

Evidence : Reason : No external validating resolver is used; cryptographic validation is intentionally not inferred. ; Status : not_tested ; Signal importance : info

dns

Dns address Observed

2001:918:ffcb::c1f6:3063

dns

08a376e225fa1fa7f2f8 30ef8ba1e13f57176ce6 8c051b367b42cf4ebd68 9552ca19228f1a9329b9 d68977bcaa4861e68e7c dd18b02868e014fb6f48 fee6ae9564426e922e71

Encryption and transportObserved

How are public exchanges protected and presented?

Observed : Tls issuer : C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA OV R36 / Not tested : Post-quantum TLS negotiation : No measurement performed

Tls issuer Observed

C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA OV R36

certificate_observed

Post-quantum TLS negotiation Not tested

No measurement performed

client_capability_unavailable

Technical finding Observed

Signal importance : low

headers

Technical finding Observed

Evidence : img-src 'self' impots.gouv.fr *.impots.gouv.fr *.france-services.gouv.fr *.openstreetmap.org *.w3.org *.basemaps.cartocdn.com data: *.w3.org *.data.economie.gouv.fr *.basemaps.cartocdn.com; script-src 'self' impots.gouv.fr *.impots.gouv.fr 'unsafe-eval' 'unsafe-inline'; style-src 'unsafe-eval' 'unsafe-inline' *.impots.gouv.fr 'self';frame-ancestors 'self'; worker-src blob: ; Signal importance : high

headers

Technical finding Observed

Signal importance : medium

headers

Technical finding Observed

Signal importance : low

headers

070e3dcb7c4d68182110 1d11d0c03102b5a52aef 27d757fc4812e631a359 3ea810e63fe4ca0c8f90 40a608777bc033cb4493 48ac1bf95bc6526112a0 7a9a99611db62fd127b9 80ad21656ae037abb121 881aa2079d0e3b571993 a1b91240e9b508961ada bcc6a65a4117972848ab da77a821be1812ae1a8a db673a75a08a881dc628 f4794994cb81c7796ab1

Mail and trustObserved

Which mail protections and policies are publicly observable?

Observed : SPF policy : missing / Observed : Dns address : 193.246.48.80

SPF policy Observed

missing

mail_policy_observed

Dns address Observed

193.246.48.80

dns

Mail policy flag Observed

mail_trust

Technical finding Observed

Signal importance : high

dns

Technical finding Observed

Signal importance : info

mail_trust

Technical finding Observed

Evidence : Reason : No external validating resolver is used; cryptographic validation is intentionally not inferred. ; Status : not_tested ; Signal importance : info

dns

05f7ff09f6e7c6aa20fa 08a376e225fa1fa7f2f8 10cafdbae5038002855f 30ef8ba1e13f57176ce6 331a192ac491a3bf94f8 4bb18e57de62c121858d 7caf9d481a3d8d0dad3a 8c051b367b42cf4ebd68 9552ca19228f1a9329b9 d68977bcaa4861e68e7c dd18b02868e014fb6f48 fee6ae9564426e922e71

DNS and governanceObserved

Which public DNS controls are visible and what remains undetermined?

Observed : Dns address : 193.246.48.80 / Observed : Mail policy flag : No

Dns address Observed

193.246.48.80

dns

Mail policy flag Observed

mail_trust

Technical finding Observed

Signal importance : high

dns

Technical finding Observed

Signal importance : info

mail_trust

Technical finding Observed

Evidence : Reason : No external validating resolver is used; cryptographic validation is intentionally not inferred. ; Status : not_tested ; Signal importance : info

dns

Mail policy flag Observed

mail_trust

External dependenciesObserved

Which external domains, providers or resources does the site visibly depend on?

Observed : Dns address : 193.246.48.80 / Observed : Technical finding : Signal importance : high

Dns address Observed

193.246.48.80

dns

Technical finding Observed

Signal importance : high

dns

Technical finding Observed

Evidence : Reason : No external validating resolver is used; cryptographic validation is intentionally not inferred. ; Status : not_tested ; Signal importance : info

dns

Technical finding Observed

Evidence : 3 ; Signal importance : low

supply_chain

Dns address Observed

2001:918:ffcb::c1f6:3063

dns

Dns address Observed

193.246.48.99

dns

08a376e225fa1fa7f2f8 30ef8ba1e13f57176ce6 6523d083ab08fac927ce 8c051b367b42cf4ebd68 9552ca19228f1a9329b9 d68977bcaa4861e68e7c dd18b02868e014fb6f48 fee6ae9564426e922e71

Observable technologiesObserved

Which technologies can reasonably be inferred from public traces?

Observed : Technology : Name : Drupal 10 (https://www.drupal.org) ; Version exposed : No / Observed : Technical finding : Signal importance : low

Technology Observed

Name : Drupal 10 (https://www.drupal.org) ; Version exposed : No

technology

Technical finding Observed

Signal importance : low

headers

Technical finding Observed

headers

Technical finding Observed

Signal importance : medium

headers

Technical finding Observed

Signal importance : low

headers

Http header Observed

img-src 'self' impots.gouv.fr *.impots.gouv.fr *.france-services.gouv.fr *.openstreetmap.org *.w3.org *.basemaps.cartocdn.com data: *.w3.org *.data.economie.gouv.fr *.basemaps.cartocdn.com; script-src 'self' impots.gouv.fr *.impots.gouv.fr 'unsafe-eval' 'unsafe-inline'; style-src 'unsafe-eval' 'unsafe-inline' *.impots.gouv.fr 'self';frame-ancestors 'self'; worker-src blob:

headers

070e3dcb7c4d68182110 1d11d0c03102b5a52aef 27d757fc4812e631a359 3ea810e63fe4ca0c8f90 40a608777bc033cb4493 48ac1bf95bc6526112a0 7a9a99611db62fd127b9 80ad21656ae037abb121 881aa2079d0e3b571993 939c61410462c24ac94b a1b91240e9b508961ada aac86f03253f52a4b4a8 f4794994cb81c7796ab1

Public exposureObserved

Which elements, endpoints or artefacts are publicly exposed?

To confirm : Canary statement detected : No / Observed : Technical finding : Signal importance : low

Canary statement detected To confirm

no_known_passive_signature_observed

Technical finding Observed

Signal importance : low

headers

Technical finding Observed

Evidence : 200 ; Signal importance : medium

transparency

Technical finding Observed

headers

Technical finding Observed

Signal importance : medium

headers

Technical finding Observed

Signal importance : high

dns

070e3dcb7c4d68182110 08a376e225fa1fa7f2f8 10cafdbae5038002855f 1d11d0c03102b5a52aef 27d757fc4812e631a359 3ea810e63fe4ca0c8f90 40a608777bc033cb4493 48ac1bf95bc6526112a0 6523d083ab08fac927ce 7a9a99611db62fd127b9 80ad21656ae037abb121 881aa2079d0e3b571993 8c051b367b42cf4ebd68 a1b91240e9b508961ada db673a75a08a881dc628 dd18b02868e014fb6f48 ea87afcb68667e5c13e3 f4794994cb81c7796ab1

Documentary trustObserved

Which public documents and transparency mechanisms are present?

Observed : Technical finding : Signal importance : low / Observed : Technical finding : Evidence : 200 ; Signal importance : medium

Technical finding Observed

Signal importance : low

headers

Technical finding Observed

Evidence : 200 ; Signal importance : medium

transparency

Technical finding Observed

headers

Technical finding Observed

Signal importance : medium

headers

Technical finding Observed

Signal importance : high

dns

Technical finding Observed

Signal importance : info

mail_trust

Security signalsObserved

Which protections or situations deserve particular attention?

Not tested : Post-quantum TLS negotiation : No measurement performed / To confirm : Canary statement detected : No

Post-quantum TLS negotiation Not tested

No measurement performed

client_capability_unavailable

Canary statement detected To confirm

no_known_passive_signature_observed

Technical finding Observed

Signal importance : low

headers

Dns address Observed

193.246.48.80

dns

Technical finding Observed

Evidence : 200 ; Signal importance : medium

transparency

Technical finding Observed

headers

Evolution over timeUndetermined

What appeared, disappeared, changed or remained stable since earlier scans?

The available evidence does not yet describe this pillar

Evidence and traceabilityObserved

Which evidence, methods, dates and limitations support the displayed conclusions?

Observed : Technology : Name : Drupal 10 (https://www.drupal.org) ; Version exposed : No / Observed : Technical finding : Signal importance : low

Technology Observed

Name : Drupal 10 (https://www.drupal.org) ; Version exposed : No

technology

Technical finding Observed

Signal importance : low

headers

Dnssec evidence Observed

Chain consistency : Reason : insufficient_record_evidence ; State : untested ; Dnskey : Query supported : No ; State : untested ; Ds : Query supported : No ; State : untested ; Validation : Reason : no_validating_resolver ; State : untested

dnssec_depth

Dns address Observed

193.246.48.80

dns

Technical finding Observed

Evidence : 200 ; Signal importance : medium

transparency

Technical finding Observed

headers

Evidence record

The filter changes the display. Exports retain all evidence.

http_header070e3dcb7c4d681821

Observed value: ["SAMEORIGIN"]
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: headers
Method: HTTP response-header inspection
Limitations: A header being present does not prove it is optimal or that the application has no vulnerabilities.

spf_policy4bb18e57de62c12185

Observed value: missing
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: mail_trust
Method: Public DNS and policy endpoint inspection
Limitations: They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

module_finding6523d083ab08fac927

Observed value: {"evidence":3,"severity":"low"}
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: supply_chain
Method: Public page resource and integrity-attribute inspection
Limitations: Missing SRI does not mean a resource is malicious, and static parsing may miss dynamic loads.

dns_address9552ca19228f1a9329

Observed value: 2001:918:ffcb::c1f6:3063
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: dns
Method: Standard DNS resolution and record parsing
Limitations: Public DNS does not prove physical server location, contracts, or global availability.

module_finding3ea810e63fe4ca0c8f

Observed value: {"evidence":"img-src 'self' impots.gouv.fr *.impots.gouv.fr *.france-services.gouv.fr *.openstreetmap.org *.w3.org *.basemaps.cartocdn.com data: *.w3.org *.data.economie.gouv.fr *.basemaps.cartocdn.com; script-src 'self' impots.gouv.fr *.impots.gouv.fr 'unsafe-eval' 'unsafe-inline'; style-src 'unsafe-eval' 'unsafe-inline' *.impots.gouv.fr 'self';frame-ancestors 'self'; worker-src blob:","severity":"high"}
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: headers
Method: HTTP response-header inspection
Limitations: A header being present does not prove it is optimal or that the application has no vulnerabilities.

canary_signal207d4cf3d53d3dcc59

Observed value: {"matches":[],"reason":"no_known_passive_signature_observed","signature_version":"2026.09.1","state":"not_observed"}
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: canary_passive
Method: Public observation
Limitations: A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

mail_policy_flag05f7ff09f6e7c6aa20

Observed value: false
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: mail_trust
Method: Public DNS and policy endpoint inspection
Limitations: They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

http_header881aa2079d0e3b5719

Observed value: ["max-age=34560000; includeSubDomains"]
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: headers
Method: HTTP response-header inspection
Limitations: A header being present does not prove it is optimal or that the application has no vulnerabilities.

module_findingdb673a75a08a881dc6

Observed value: {"evidence":"13 days","severity":"high"}
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: tls
Method: TLS handshake and public certificate inspection
Limitations: Strong TLS does not prove application security or origin-server security behind a CDN or reverse proxy.

mail_transport_evidence512374c9ec3b0e96f8

Observed value: {"bimi":{"records":[],"state":"not_observed"},"dane_tlsa":{"query_supported":false,"reason":"tlsa_query_not_available","records":[],"state":"untested"},"dkim":{"reason":"no_selector_bruteforce","state":"untested"},"mta_sts":{"policy":null,"policy_state":"untested","records":[],"state":"not_observed"},"tls_rpt":{"records":[],"state":"not_observed"}}
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: mail_transport
Method: Public observation
Limitations: A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

module_finding40a608777bc033cb44

Observed value: {"evidence":null,"severity":"low"}
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: headers
Method: HTTP response-header inspection
Limitations: A header being present does not prove it is optimal or that the application has no vulnerabilities.

dns_addressd68977bcaa4861e68e

Observed value: 193.246.48.99
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: dns
Method: Standard DNS resolution and record parsing
Limitations: Public DNS does not prove physical server location, contracts, or global availability.

module_findingdd18b02868e014fb6f

Observed value: {"evidence":null,"severity":"low"}
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: dns
Method: Standard DNS resolution and record parsing
Limitations: Public DNS does not prove physical server location, contracts, or global availability.

technologyaac86f03253f52a4b4

Observed value: {"name":"Drupal","version":"","version_exposed":false}
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: technology
Method: Public observation
Limitations: A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

post_quantum_tls6eb821a11905e36690

Observed value: {"capability":{"capable":false,"groups":[],"reason":"proc_open_unavailable"},"group":null,"reason":"client_capability_unavailable","state":"untested"}
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: pq_tls_probe
Method: Public observation
Limitations: A positive result does not make a site “post-quantum”, and a negative result does not prove no other client could negotiate it.

module_finding48ac1bf95bc6526112

Observed value: {"evidence":null,"severity":"info"}
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: headers
Method: HTTP response-header inspection
Limitations: A header being present does not prove it is optimal or that the application has no vulnerabilities.

dns_addressfee6ae9564426e922e

Observed value: 2001:918:ffcb::c1f6:3050
Source: release_fallback
Date: 2026-09-20T19:37:54+00:00
Collector: dns
Method: Standard DNS resolution and record parsing
Limitations: Public DNS does not prove physical server location, contracts, or global availability.

An explainable reading, not artificial certainty.

Public access, collection budgets and available sources limit this dossier. A hash or signature is not certification of its conclusions.

Report an error or request clarification ↗

Dossier overview

Summary

General information

Documentary footprint

Estimated countries of observed IPs

Technologies and services

Key signals

Visible relationships

Retained evidence

Domain timeline

The domain, without assumptions

Domain registration

Estimated countries of observed IPs

GDPR

NIS2

Cyber Resilience Act

DORA

French Data Protection Act

Visible technologies and services

Drupal 10 (https://www.drupal.org)

Drupal

Visible domain relationships

Signals, context and limitations

Effective data location cannot be determined

Origin hosting cannot be determined

Network reachability

DNS and email

Email trust

TLS transport

Security headers

Third-party resource control

Dependencies

Privacy

Technology footprint

Estimated sovereignty

Resilience

Transparency

Declared public content

Reviewed external references

Documents and references

Consulter le guide pratique (PDF)

foire aux questions

pas-à-pas pour faire votre demande

security.txt

The domain timeline

Evidence, not a score

Evidence record