Report - app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/

Report Overview

Visited public
2025-02-11 12:30:21
Tags
government tax france phishing
URL
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Finishing URL
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
IP / ASN
35.242.243.226
#396982 GOOGLE-CLOUD-PLATFORM
Title
Site officiel unique de télépaiement | Amendes.gouv.fr
Phishing - French Tax Agency

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
code.jquery.com	634	2005-12-10	2012-05-21	2025-02-05	499 B	32 kB	151.101.130.137
www.amendes.gouv.fr	unknown	2003-10-12	2012-07-25	2025-02-10	1.6 kB	33 kB	185.8.53.118
app-676d5442c1ac180c5039fe37.closte.com	unknown	2015-01-15	2025-02-08	2025-02-08	5.6 kB	210 kB	35.242.243.226
cdnjs.cloudflare.com	235	2009-02-17	2012-05-23	2025-02-05	473 B	3.3 kB	104.17.24.14

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	From	Size	First Seen	Last Seen
	app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/	ScriptElement	59 B	2025-02-11	2025-02-12
Pretty URL app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/ IP 35.242.243.226 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML true Observations First Seen2025-02-11 08:58 Last Seen2025-02-12 18:27 Times Seen4 Hash c8dca2b7e27d2fa2b64e731340a67e64 281797e1dd879064aba5d171b64bacdd0ac56d84 09193fc446c6a7376d710ffd239dfb98f64718cfc2a7c1035fa6e4d453b6abe2 Loading...

	app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/	ScriptElement	94 B	2023-03-14	2025-05-18
Pretty URL app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/ IP 35.242.243.226 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-14 03:47 Last Seen2025-05-18 09:59 Times Seen262 Hash 4bdb363c83b9a3aedce67c75fa543087 6ea3c1658bf5dad03f0cdf2f0719199682d934a2 e027cfe2ad260a5a4de9ad3a60ae08a3ed629b91baaea379ed4597cf7c95e428 Loading...

	code.jquery.com/jquery-3.6.3.min.js	ScriptElement	90 kB	2023-03-10	2025-05-18
Pretty URL code.jquery.com/jquery-3.6.3.min.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 04:24 Last Seen2025-05-18 13:11 Times Seen9357 Hash cf2fbbf84281d9ecbffb4993203d543b 832a6a4e86daf38b1975d705c5de5d9e5f5844bc a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575 Loading...

	cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.11.2/jquery.mask.min.js	ScriptElement	5.8 kB	2023-03-07	2025-05-18
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.11.2/jquery.mask.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:03 Last Seen2025-05-18 09:59 Times Seen370 Hash f757a9aa0bddb4d33e32ba706b94790f dc5e6f6e29da89457e3b313003bfaf49c799b208 a17f2e9528214109ad7194958c1c3ba5367166dc7163f630d5c02c04a7623ef6 Loading...

	app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/	ScriptElement	64 B	2023-03-14	2025-05-18
Pretty URL app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/ IP 35.242.243.226 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-14 03:47 Last Seen2025-05-18 09:59 Times Seen394 Hash d245a4c7f9b1676e8bf7a084577cb175 96b1e6c649c4a614baf7b2b93877bd091f3d1413 bc4de9ff8d3defae9652ed9d9b0055c42d25b141546a6a6b6b3d07c24f43db60 Loading...

HTTP Transactions (14)

URL IP Response Size

app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/

35.242.243.226

200 OK

13 kB

URL User Request GET HTTP/2
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
IP
35.242.243.226:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Certificate
IssuerSectigo Limited
Subject*.closte.com
Fingerprint8E:69:D4:9B:6C:23:5E:09:6B:A2:C4:0E:54:32:E4:60:01:92:61:53
ValidityMon, 27 May 2024 00:00:00 GMT - Fri, 27 Jun 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (46861)
Size
13 kB (12721 bytes)
Hash
79923df0915fafdc8972cb48bfeefdac
a3155e77bf99f7f860345e7e6df2b0036d63e268
8a2c12791c4769613b5285108bddf8994c09c079d7dba6a343da0db86447c31b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - French Tax Agency

HTTP Headers

GET /DOSSIER/AMA/12/infospage.php/ HTTP/1.1
Host: app-676d5442c1ac180c5039fe37.closte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
set-cookie: PHPSESSID=d2d32d6deeb0a06252d2f76d9f1c1c34; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 12721
content-encoding: br
vary: Accept-Encoding
date: Tue, 11 Feb 2025 12:29:51 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.11.2/jquery.mask.min.js

104.17.24.14

200 OK

2.2 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.11.2/jquery.mask.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT

File type
JavaScript source, ASCII text, with very long lines (545)
Size
2.2 kB (2243 bytes)
Hash
f757a9aa0bddb4d33e32ba706b94790f
dc5e6f6e29da89457e3b313003bfaf49c799b208
a17f2e9528214109ad7194958c1c3ba5367166dc7163f630d5c02c04a7623ef6

HTTP Headers

GET /ajax/libs/jquery.mask/1.11.2/jquery.mask.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://app-676d5442c1ac180c5039fe37.closte.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 11 Feb 2025 12:29:51 GMT
content-type: application/javascript; charset=utf-8
content-length: 2243
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec3-16bb"
last-modified: Mon, 04 May 2020 16:11:47 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1266050
expires: Sun, 01 Feb 2026 12:29:51 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WHIe7Du5EJ%2B3AK8NwOQ4NH9j8nd1NZf3JCKwjiNUQWSXukE%2FfjjwOn4E8a7ME%2B4M%2BJoavnfPOdVAAC%2FpwiyxXl8gGE8lE2hhJBs321WHCRnL6anhg%2Fm8QGHPQQQlGezAOElBWqUC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 910458cfec5e5685-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.3.min.js

151.101.130.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.3.min.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (31046 bytes)
Hash
cf2fbbf84281d9ecbffb4993203d543b
832a6a4e86daf38b1975d705c5de5d9e5f5844bc
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575

HTTP Headers

GET /jquery-3.6.3.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://app-676d5442c1ac180c5039fe37.closte.com
DNT: 1
Connection: keep-alive
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15f5b"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 11 Feb 2025 12:29:52 GMT
age: 1892585
x-served-by: cache-lga13623-LGA, cache-hel1410031-HEL
x-cache: HIT, HIT
x-cache-hits: 41, 39053
x-timer: S1739276992.001361,VS0,VE0
vary: Accept-Encoding
content-length: 31046
X-Firefox-Spdy: h2

app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/styles.572738d2b631b3d66c72.css

35.242.243.226

200 OK

13 kB

URL GET HTTP/3
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/styles.572738d2b631b3d66c72.css
IP
35.242.243.226:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerSectigo Limited
Subject*.closte.com
Fingerprint8E:69:D4:9B:6C:23:5E:09:6B:A2:C4:0E:54:32:E4:60:01:92:61:53
ValidityMon, 27 May 2024 00:00:00 GMT - Fri, 27 Jun 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (46861)
Size
13 kB (12721 bytes)
Hash
79923df0915fafdc8972cb48bfeefdac
a3155e77bf99f7f860345e7e6df2b0036d63e268
8a2c12791c4769613b5285108bddf8994c09c079d7dba6a343da0db86447c31b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - French Tax Agency

HTTP Headers

GET /DOSSIER/AMA/12/infospage.php/infos_files/styles.572738d2b631b3d66c72.css HTTP/1.1
Host: app-676d5442c1ac180c5039fe37.closte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Cookie: PHPSESSID=d2d32d6deeb0a06252d2f76d9f1c1c34
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 12721
content-encoding: br
vary: Accept-Encoding
date: Tue, 11 Feb 2025 12:29:52 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/logo-amendes-gouv.svg

35.242.243.226

200 OK

13 kB

URL GET HTTP/3
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/logo-amendes-gouv.svg
IP
35.242.243.226:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerSectigo Limited
Subject*.closte.com
Fingerprint8E:69:D4:9B:6C:23:5E:09:6B:A2:C4:0E:54:32:E4:60:01:92:61:53
ValidityMon, 27 May 2024 00:00:00 GMT - Fri, 27 Jun 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (46861)
Size
13 kB (12721 bytes)
Hash
79923df0915fafdc8972cb48bfeefdac
a3155e77bf99f7f860345e7e6df2b0036d63e268
8a2c12791c4769613b5285108bddf8994c09c079d7dba6a343da0db86447c31b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - French Tax Agency

HTTP Headers

GET /DOSSIER/AMA/12/infospage.php/infos_files/logo-amendes-gouv.svg HTTP/1.1
Host: app-676d5442c1ac180c5039fe37.closte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Cookie: PHPSESSID=d2d32d6deeb0a06252d2f76d9f1c1c34
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 12721
content-encoding: br
vary: Accept-Encoding
date: Tue, 11 Feb 2025 12:29:52 GMT
server: LiteSpeed

app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/main-es2017.8d2eb497bdf1e092bf40.js

35.242.243.226

200 OK

13 kB

URL GET HTTP/3
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/main-es2017.8d2eb497bdf1e092bf40.js
IP
35.242.243.226:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerSectigo Limited
Subject*.closte.com
Fingerprint8E:69:D4:9B:6C:23:5E:09:6B:A2:C4:0E:54:32:E4:60:01:92:61:53
ValidityMon, 27 May 2024 00:00:00 GMT - Fri, 27 Jun 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (46861)
Size
13 kB (12721 bytes)
Hash
79923df0915fafdc8972cb48bfeefdac
a3155e77bf99f7f860345e7e6df2b0036d63e268
8a2c12791c4769613b5285108bddf8994c09c079d7dba6a343da0db86447c31b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - French Tax Agency

HTTP Headers

GET /DOSSIER/AMA/12/infospage.php/infos_files/main-es2017.8d2eb497bdf1e092bf40.js HTTP/1.1
Host: app-676d5442c1ac180c5039fe37.closte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Cookie: PHPSESSID=d2d32d6deeb0a06252d2f76d9f1c1c34
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 12721
content-encoding: br
vary: Accept-Encoding
date: Tue, 11 Feb 2025 12:29:52 GMT
server: LiteSpeed

www.amendes.gouv.fr/assets/fonts/open-sans/open-sans-bold.woff2

185.8.53.118

200 OK

15 kB

URL GET HTTP/1.1
www.amendes.gouv.fr/assets/fonts/open-sans/open-sans-bold.woff2
IP
185.8.53.118:443
ASN
#47957 Worldline IGSA SA

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerDHIMYOTIS
Subjectwww.amendes.gouv.fr
Fingerprint85:2D:87:9E:F7:F2:AB:68:36:CB:50:70:0D:95:21:F5:A0:C5:95:87
ValiditySun, 27 Oct 2024 23:00:00 GMT - Fri, 28 Nov 2025 22:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 14880, version 1.0
Size
15 kB (14908 bytes)
Hash
819af3d3abdc9f135d49b80a91e2ff4c
0fd9f29faa386a9c8de328f799d2698948ed3d25
1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc

HTTP Headers

GET /assets/fonts/open-sans/open-sans-bold.woff2 HTTP/1.1
Host: www.amendes.gouv.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/
Origin: https://app-676d5442c1ac180c5039fe37.closte.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Tue, 11 Feb 2025 12:29:52 GMT
content-type: font/woff2
last-modified: Wed, 29 Jan 2025 09:50:59 GMT
vary: Accept-Encoding
etag: W/"6799fa03-3a20"
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-encoding: gzip
transfer-encoding: chunked
strict-transport-security: max-age=16000000; includeSubDomains; preload;

www.amendes.gouv.fr/assets/fonts/open-sans/open-sans-regular.woff2

185.8.53.118

200 OK

14 kB

URL GET HTTP/1.1
www.amendes.gouv.fr/assets/fonts/open-sans/open-sans-regular.woff2
IP
185.8.53.118:443
ASN
#47957 Worldline IGSA SA

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerDHIMYOTIS
Subjectwww.amendes.gouv.fr
Fingerprint85:2D:87:9E:F7:F2:AB:68:36:CB:50:70:0D:95:21:F5:A0:C5:95:87
ValiditySun, 27 Oct 2024 23:00:00 GMT - Fri, 28 Nov 2025 22:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 14380, version 1.0
Size
14 kB (14408 bytes)
Hash
33543c5cc5d88f5695dd08c87d280dfd
600db9374e47e4f73a59ccc0a99bcc42f4a3e02a
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52

HTTP Headers

GET /assets/fonts/open-sans/open-sans-regular.woff2 HTTP/1.1
Host: www.amendes.gouv.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/
Origin: https://app-676d5442c1ac180c5039fe37.closte.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Tue, 11 Feb 2025 12:29:52 GMT
content-type: font/woff2
last-modified: Wed, 29 Jan 2025 09:50:59 GMT
vary: Accept-Encoding
etag: W/"6799fa03-382c"
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-encoding: gzip
transfer-encoding: chunked
strict-transport-security: max-age=16000000; includeSubDomains; preload;

app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/runtime-es2017.d8ae961f0555d440b720.js

35.242.243.226

200 OK

13 kB

URL GET HTTP/3
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/runtime-es2017.d8ae961f0555d440b720.js
IP
35.242.243.226:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerSectigo Limited
Subject*.closte.com
Fingerprint8E:69:D4:9B:6C:23:5E:09:6B:A2:C4:0E:54:32:E4:60:01:92:61:53
ValidityMon, 27 May 2024 00:00:00 GMT - Fri, 27 Jun 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (46861)
Size
13 kB (12721 bytes)
Hash
79923df0915fafdc8972cb48bfeefdac
a3155e77bf99f7f860345e7e6df2b0036d63e268
8a2c12791c4769613b5285108bddf8994c09c079d7dba6a343da0db86447c31b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - French Tax Agency

HTTP Headers

GET /DOSSIER/AMA/12/infospage.php/infos_files/runtime-es2017.d8ae961f0555d440b720.js HTTP/1.1
Host: app-676d5442c1ac180c5039fe37.closte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Cookie: PHPSESSID=d2d32d6deeb0a06252d2f76d9f1c1c34
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 12721
content-encoding: br
vary: Accept-Encoding
date: Tue, 11 Feb 2025 12:29:52 GMT
server: LiteSpeed

app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/libs.js

35.242.243.226

200 OK

13 kB

URL GET HTTP/3
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/libs.js
IP
35.242.243.226:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerSectigo Limited
Subject*.closte.com
Fingerprint8E:69:D4:9B:6C:23:5E:09:6B:A2:C4:0E:54:32:E4:60:01:92:61:53
ValidityMon, 27 May 2024 00:00:00 GMT - Fri, 27 Jun 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (46861)
Size
13 kB (12721 bytes)
Hash
79923df0915fafdc8972cb48bfeefdac
a3155e77bf99f7f860345e7e6df2b0036d63e268
8a2c12791c4769613b5285108bddf8994c09c079d7dba6a343da0db86447c31b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - French Tax Agency

HTTP Headers

GET /DOSSIER/AMA/12/infospage.php/infos_files/libs.js HTTP/1.1
Host: app-676d5442c1ac180c5039fe37.closte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Cookie: PHPSESSID=d2d32d6deeb0a06252d2f76d9f1c1c34
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 12721
content-encoding: br
vary: Accept-Encoding
date: Tue, 11 Feb 2025 12:29:52 GMT
server: LiteSpeed

app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/polyfills-es2017.533ebfade82697eddcf6.js

35.242.243.226

200 OK

13 kB

URL GET HTTP/3
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/infos_files/polyfills-es2017.533ebfade82697eddcf6.js
IP
35.242.243.226:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerSectigo Limited
Subject*.closte.com
Fingerprint8E:69:D4:9B:6C:23:5E:09:6B:A2:C4:0E:54:32:E4:60:01:92:61:53
ValidityMon, 27 May 2024 00:00:00 GMT - Fri, 27 Jun 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (46861)
Size
13 kB (12721 bytes)
Hash
79923df0915fafdc8972cb48bfeefdac
a3155e77bf99f7f860345e7e6df2b0036d63e268
8a2c12791c4769613b5285108bddf8994c09c079d7dba6a343da0db86447c31b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - French Tax Agency

HTTP Headers

GET /DOSSIER/AMA/12/infospage.php/infos_files/polyfills-es2017.533ebfade82697eddcf6.js HTTP/1.1
Host: app-676d5442c1ac180c5039fe37.closte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Cookie: PHPSESSID=d2d32d6deeb0a06252d2f76d9f1c1c34
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 12721
content-encoding: br
vary: Accept-Encoding
date: Tue, 11 Feb 2025 12:29:52 GMT
server: LiteSpeed

app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/assets/fonts/open-sans/open-sans-regular.woff2

35.242.243.226

200 OK

59 kB

URL GET HTTP/3
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/assets/fonts/open-sans/open-sans-regular.woff2
IP
35.242.243.226:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerSectigo Limited
Subject*.closte.com
Fingerprint8E:69:D4:9B:6C:23:5E:09:6B:A2:C4:0E:54:32:E4:60:01:92:61:53
ValidityMon, 27 May 2024 00:00:00 GMT - Fri, 27 Jun 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (46861)
Size
59 kB (58590 bytes)
Hash
79923df0915fafdc8972cb48bfeefdac
a3155e77bf99f7f860345e7e6df2b0036d63e268
8a2c12791c4769613b5285108bddf8994c09c079d7dba6a343da0db86447c31b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - French Tax Agency

HTTP Headers

GET /DOSSIER/AMA/12/infospage.php/assets/fonts/open-sans/open-sans-regular.woff2 HTTP/1.1
Host: app-676d5442c1ac180c5039fe37.closte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Cookie: PHPSESSID=d2d32d6deeb0a06252d2f76d9f1c1c34
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 58590
date: Tue, 11 Feb 2025 12:29:53 GMT
server: LiteSpeed

www.amendes.gouv.fr/favicon.ico

185.8.53.118

200 OK

2.2 kB

URL GET HTTP/1.1
www.amendes.gouv.fr/favicon.ico
IP
185.8.53.118:443
ASN
#47957 Worldline IGSA SA

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerDHIMYOTIS
Subjectwww.amendes.gouv.fr
Fingerprint85:2D:87:9E:F7:F2:AB:68:36:CB:50:70:0D:95:21:F5:A0:C5:95:87
ValiditySun, 27 Oct 2024 23:00:00 GMT - Fri, 28 Nov 2025 22:59:59 GMT

File type
MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel
Size
2.2 kB (2238 bytes)
Hash
2f34a3977599611db24405c819cb116f
4568ce43171f2a05903b38462891cd064ecc32e2
dd57f113a2eaa7ba3e6b1c507d22910ecd42437f9fef9577cfb8f4719cde59aa

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.amendes.gouv.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Tue, 11 Feb 2025 12:29:53 GMT
content-type: image/x-icon
content-length: 2238
last-modified: Wed, 29 Jan 2025 09:50:59 GMT
etag: "6799fa03-8be"
expires: Tue, 11 Feb 2025 13:29:53 GMT
cache-control: max-age=3600
accept-ranges: bytes
strict-transport-security: max-age=16000000; includeSubDomains; preload;

app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/assets/fonts/open-sans/open-sans-bold.woff2

35.242.243.226

200 OK

59 kB

URL GET HTTP/3
app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/assets/fonts/open-sans/open-sans-bold.woff2
IP
35.242.243.226:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Certificate
IssuerSectigo Limited
Subject*.closte.com
Fingerprint8E:69:D4:9B:6C:23:5E:09:6B:A2:C4:0E:54:32:E4:60:01:92:61:53
ValidityMon, 27 May 2024 00:00:00 GMT - Fri, 27 Jun 2025 23:59:59 GMT

File type
data
Size
59 kB (59094 bytes)
Hash
0f452551076870998488f109f0ceee05
fe52d2cc4f717747b5a0b34ec9cb8a30b63bbbde
46bf484c6d6c8f9ba6cfa58f9c354248f57af878402a8bce59cf73cd66da803f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - French Tax Agency

HTTP Headers

GET /DOSSIER/AMA/12/infospage.php/assets/fonts/open-sans/open-sans-bold.woff2 HTTP/1.1
Host: app-676d5442c1ac180c5039fe37.closte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://app-676d5442c1ac180c5039fe37.closte.com/DOSSIER/AMA/12/infospage.php/
Cookie: PHPSESSID=d2d32d6deeb0a06252d2f76d9f1c1c34
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
date: Tue, 11 Feb 2025 12:29:52 GMT
server: LiteSpeed

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (14)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate