secures9-ameli.fr Open in urlscan Pro
212.192.246.46 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://secures9-ameli.fr/
Effective URL:
https://secures9-ameli.fr/
Submission: On July 19 via manual (July 19th 2022, 11:12:16 am UTC) from US — Scanned from FR

Summary HTTP 11 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 11 HTTP transactions. The main IP is 212.192.246.46, located in Germany and belongs to AS-SERVERION, US. The main domain is secures9-ameli.fr.
TLS certificate: Issued by R3 on July 16th 2022. Valid for: 3 months.

This is the only time secures9-ameli.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Assurance Maladie (Healthcare)

Domain & IP information

	IP Address	AS Autonomous System
1 8	212.192.246.46 212.192.246.46	399471 (AS-SERVERION) (AS-SERVERION)
1	2606:4700:303... 2606:4700:3033::6815:3f36	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (STACKPATH...) (STACKPATH-CDN)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
11	5

8 212.192.246.46 (Germany) 1 redirects

ASN399471 (AS-SERVERION, US)

secures9-ameli.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::6815:3f36 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	secures9-ameli.fr 1 redirects secures9-ameli.fr	456 KB
1	gstatic.com fonts.gstatic.com	17 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 81	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 695	30 KB
1	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1112	13 KB
11	5

	Domain	Requested by
8	secures9-ameli.fr	1 redirects secures9-ameli.fr
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	secures9-ameli.fr
1	code.jquery.com	secures9-ameli.fr
1	use.fontawesome.com	secures9-ameli.fr
11	5

This site contains links to these domains. Also see Links.

Domain
www.impots.gouv.fr

Subject Issuer	Validity	Valid
secures9-ameli.fr R3	`2022-07-16` - `2022-10-14`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-06` - `2023-06-05`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://secures9-ameli.fr/
Frame ID: 7B5D071E0FB18D93EACC89EF14885F51
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Veuillez remplir le formulaire

Page URL History Show full URLs

http://secures9-ameli.fr/ HTTP 301
https://secures9-ameli.fr/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

517 kB
Transfer

786 kB
Size

1
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.impots.gouv.fr/portail/actualite/publication-de-la-brochure-pratique-impots-locaux-2021
Title: Publication de la brochure pratique Impôts locaux 2021

Search URL Search Domain Scan URL

URL: https://www.impots.gouv.fr/portail/actualite/experimentation-du-foncier-innovant
Title: Expérimentation du Foncier innovant

Search URL Search Domain Scan URL

URL: https://www.impots.gouv.fr/portail/actualite/decouvrez-le-nouveau-service-de-declaration-de-don-en-ligne-0
Title: Découvrez le nouveau service de déclaration de don en ligne

Search URL Search Domain Scan URL

URL: https://www.impots.gouv.fr/portail/actualite/rapport-dactivite-2020-de-la-dgfip
Title: Rapport d'activité 2020 de la DGFiP

Search URL Search Domain Scan URL

URL: https://www.impots.gouv.fr/portail/actualite/decouvrez-la-nouvelle-app-impotsgouv
Title: Découvrez la nouvelle app impots.gouv !

Search URL Search Domain Scan URL

URL: https://www.impots.gouv.fr/portail/actualite/vente-aux-encheres-de-prestige-des-10-ans-de-lagrasc
Title: Vente aux enchères de prestige des 10 ans de l'AGRASC

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://secures9-ameli.fr/ HTTP 301
https://secures9-ameli.fr/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
secures9-ameli.fr/
Redirect Chain

http://secures9-ameli.fr/
https://secures9-ameli.fr/

17 KB
3 KB

725ms
675ms

Document
text/html

212.192.246.46
AS-SERVERION

General

Check archive.org

Show headers Download Go to

Full URL: https://secures9-ameli.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.192.246.46 , Germany, ASN399471 (AS-SERVERION, US),
Reverse DNS
Software: nginx / PHP/7.4.30 PleskLin
Resource Hash: ce12d608dfeaa176b16c92d24c3ff718815d73ffa93922563792b854fcc2af7a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 19 Jul 2022 11:12:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
x-powered-by: PHP/7.4.30 PleskLin

Redirect headers

Connection: keep-alive
Content-Length: 162
Content-Type: text/html
Date: Tue, 19 Jul 2022 11:12:11 GMT
Location: https://secures9-ameli.fr/
Server: nginx

GET
H2 200 all.css
use.fontawesome.com/releases/v5.8.2/css/ 54 KB
13 KB 96ms
38ms Stylesheet
text/css 2606:4700:3033::6815:3f36
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.8.2/css/all.css
Requested by: Host: secures9-ameli.fr
URL: https://secures9-ameli.fr/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:3f36 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f

Request headers

Referer: https://secures9-ameli.fr/
Origin: https://secures9-ameli.fr
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 11:12:12 GMT
content-encoding: br
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2271
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: AC17X2SCK8H2EMHH
x-amz-id-2: kboHmMY4f9VbltFlW9RJvNQYPSzoLdbx9JzK7NkMo9/I752nqkK+wbcCsK+HzqTZVbJjpk97XO4=
last-modified: Wed, 30 Jun 2021 15:47:00 GMT
server: cloudflare
etag: W/"77cbad34e5ce95e70847b074e05faeab"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mjkh8R37%2FD%2B7DHFX2e2ZZ8Bo6WIktfNUH3NAW6Nb63G8s4kLGQy9%2Bw8Wa1eaIcJkTl0Zec72AWSpx4cFbLI3LI4PGZCG4n1YwTv7NscVgHz5cNXBQ4KNqtY28VIA5953tgtnyqk822wpv1QEmTZd3lK4"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 72d3054c8a26b74c-AMS

GET
H2 200 style_v2.css
secures9-ameli.fr/assets/css/ 141 KB
18 KB 60ms
59ms Stylesheet
text/css 212.192.246.46
AS-SERVERION

General

Check archive.org

Show headers Download Go to

Full URL: https://secures9-ameli.fr/assets/css/style_v2.css
Requested by: Host: secures9-ameli.fr
URL: https://secures9-ameli.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.192.246.46 , Germany, ASN399471 (AS-SERVERION, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: d1d1b719bd3f553322c73203cb8422eb911225158d53c2f99b8167d90c63696d

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://secures9-ameli.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 11:12:12 GMT
content-encoding: br
etag: W/"6163ef16-232da"
last-modified: Mon, 11 Oct 2021 08:00:22 GMT
server: nginx
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 bootstrap.css
secures9-ameli.fr/assets/css/ 39 KB
3 KB 37ms
37ms Stylesheet
text/css 212.192.246.46
AS-SERVERION

General

Check archive.org

Show headers Download Go to

Full URL: https://secures9-ameli.fr/assets/css/bootstrap.css
Requested by: Host: secures9-ameli.fr
URL: https://secures9-ameli.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.192.246.46 , Germany, ASN399471 (AS-SERVERION, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 24422be1c6a2f4f68b24ea47154cac4295988c55d842d952b621a50e84b3f675

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://secures9-ameli.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 11:12:12 GMT
content-encoding: br
etag: W/"6163ef50-9af2"
last-modified: Mon, 11 Oct 2021 08:01:20 GMT
server: nginx
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 head2.png
secures9-ameli.fr/assets/images/ 208 KB
208 KB 72ms
71ms Image
image/png 212.192.246.46
AS-SERVERION

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secures9-ameli.fr/assets/images/head2.png
Requested by: Host: secures9-ameli.fr
URL: https://secures9-ameli.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.192.246.46 , Germany, ASN399471 (AS-SERVERION, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: aa385edce58286ef1f1f5f0e71925823cffba3accd8c9780e332710575ac5b86

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://secures9-ameli.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 11:12:12 GMT
last-modified: Mon, 11 Oct 2021 08:02:58 GMT
server: nginx
x-powered-by: PleskLin
etag: "6163efb2-33f21"
content-type: image/png
accept-ranges: bytes
content-length: 212769

GET
H2 200 header.png
secures9-ameli.fr/assets/images/ 96 KB
97 KB 60ms
59ms Image
image/png 212.192.246.46
AS-SERVERION

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secures9-ameli.fr/assets/images/header.png
Requested by: Host: secures9-ameli.fr
URL: https://secures9-ameli.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.192.246.46 , Germany, ASN399471 (AS-SERVERION, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 194cfb7b7cf206d11fc070edfb1653a03ad72df0653b2a90c7594b3d1aecc6ad

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://secures9-ameli.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 11:12:12 GMT
last-modified: Mon, 11 Oct 2021 08:01:48 GMT
server: nginx
x-powered-by: PleskLin
etag: "6163ef6c-181e4"
content-type: image/png
accept-ranges: bytes
content-length: 98788

GET
H2 200 spinner.gif
secures9-ameli.fr/ 79 KB
79 KB 72ms
71ms Image
image/gif 212.192.246.46
AS-SERVERION

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secures9-ameli.fr/spinner.gif
Requested by: Host: secures9-ameli.fr
URL: https://secures9-ameli.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.192.246.46 , Germany, ASN399471 (AS-SERVERION, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 00b08f443ca519bfc5617297ae8ffbb45e3698030e9413b2f308144aa34485db

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://secures9-ameli.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 11:12:12 GMT
last-modified: Thu, 05 May 2022 21:57:48 GMT
server: nginx
x-powered-by: PleskLin
etag: "6274485c-13c95"
content-type: image/gif
accept-ranges: bytes
content-length: 81045

GET
H2 200 jquery-3.4.1.min.js Show response
code.jquery.com/ 86 KB
30 KB 64ms
21ms Script
application/javascript 2001:4de0:ac18::1:a:1b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.1.min.js
Requested by: Host: secures9-ameli.fr
URL: https://secures9-ameli.fr/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

Referer: https://secures9-ameli.fr/
Origin: https://secures9-ameli.fr
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 11:12:12 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15851"
vary: Accept-Encoding
x-hw: 1658229132.dop028.pa1.t,1658229132.cds244.pa1.hn,1658229132.cds237.pa1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30638

GET
H2 200 css
fonts.googleapis.com/ 3 KB
1 KB 97ms
35ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext

Requested by

Host: secures9-ameli.fr
URL: https://secures9-ameli.fr/assets/css/style_v2.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

55475f690303f28766cea7ae2214bca689adb1d19426a636ae5f812d30ed88aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://secures9-ameli.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Jul 2022 10:55:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 19 Jul 2022 11:12:12 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 19 Jul 2022 11:12:12 GMT

GET
H2 200 back.png
secures9-ameli.fr/assets/images/ 48 KB
48 KB 33ms
32ms Image
image/png 212.192.246.46
AS-SERVERION

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secures9-ameli.fr/assets/images/back.png
Requested by: Host: secures9-ameli.fr
URL: https://secures9-ameli.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.192.246.46 , Germany, ASN399471 (AS-SERVERION, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 9d69d665f1b65ee6912152258b522980974a2be88a63d9b857a92df553dff301

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://secures9-ameli.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 11:12:12 GMT
last-modified: Mon, 11 Oct 2021 07:59:22 GMT
server: nginx
x-powered-by: PleskLin
etag: "6163eeda-be01"
content-type: image/png
accept-ranges: bytes
content-length: 48641

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v29/ 16 KB
17 KB 87ms
26ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9434dddcdf38e072b039bb92f9e90639ec0e0563e8ff51604a60d91830c29289

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://secures9-ameli.fr
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 11:57:13 GMT
x-content-type-options: nosniff
age: 83699
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16720
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 18 Jul 2023 11:57:13 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Assurance Maladie (Healthcare)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			secures9-ameli.fr/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7dm3lhra4vvpj7mg5iuqahq0hd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
secures9-ameli.fr
use.fontawesome.com
2001:4de0:ac18::1:a:1b
212.192.246.46
2606:4700:3033::6815:3f36
2a00:1450:4001:80b::2003
2a00:1450:4001:828::200a
00b08f443ca519bfc5617297ae8ffbb45e3698030e9413b2f308144aa34485db
06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
194cfb7b7cf206d11fc070edfb1653a03ad72df0653b2a90c7594b3d1aecc6ad
24422be1c6a2f4f68b24ea47154cac4295988c55d842d952b621a50e84b3f675
55475f690303f28766cea7ae2214bca689adb1d19426a636ae5f812d30ed88aa
9434dddcdf38e072b039bb92f9e90639ec0e0563e8ff51604a60d91830c29289
9d69d665f1b65ee6912152258b522980974a2be88a63d9b857a92df553dff301
aa385edce58286ef1f1f5f0e71925823cffba3accd8c9780e332710575ac5b86
ce12d608dfeaa176b16c92d24c3ff718815d73ffa93922563792b854fcc2af7a
d1d1b719bd3f553322c73203cb8422eb911225158d53c2f99b8167d90c63696d

secures9-ameli.fr Open in urlscan Pro 212.192.246.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

517 kBTransfer

786 kBSize

1 Cookies

6 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

Indicators

secures9-ameli.fr Open in urlscan Pro
212.192.246.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

517 kB
Transfer

786 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!