fr.gouvcontravention-service.com Open in urlscan Pro
193.143.1.177 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://fr.gouvcontravention-service.com/
Effective URL:
https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a4...
Submission: On April 17 via automatic, source certstream-suspicious (April 17th 2024, 6:16:00 am UTC) — Scanned from DE

Summary HTTP 18 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 3 domains to perform 18 HTTP transactions. The main IP is 193.143.1.177, located in Moscow, Russian Federation and belongs to PROTON66, RU. The main domain is fr.gouvcontravention-service.com.
TLS certificate: Issued by R3 on April 17th 2024. Valid for: 3 months.

This is the only time fr.gouvcontravention-service.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: FR Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
2 9	193.143.1.177 193.143.1.177	198953 (PROTON66) (PROTON66)
5	160.92.148.108 160.92.148.108	47957 (ING-AS) (ING-AS)
1	2606:4700:440... 2606:4700:4400::6812:2844	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700:303... 2606:4700:3034::6815:1adf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
18	5

9 193.143.1.177 (Moscow, Russian Federation) 2 redirects

ASN198953 (PROTON66, RU)

fr.gouvcontravention-service.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 160.92.148.108 (France)

ASN47957 (ING-AS, FR)
PTR: prod-tai-tfi-as.ca-zne-tlp.as8677.net

www.amendes.gouv.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2844 (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3034::6815:1adf (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	gouvcontravention-service.com 2 redirects fr.gouvcontravention-service.com	12 KB
5	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1784 ka-f.fontawesome.com — Cisco Umbrella Rank: 4272	35 KB
5	amendes.gouv.fr www.amendes.gouv.fr	76 KB
18	3

	Domain	Requested by
9	fr.gouvcontravention-service.com	2 redirects fr.gouvcontravention-service.com
5	www.amendes.gouv.fr	fr.gouvcontravention-service.com www.amendes.gouv.fr
4	ka-f.fontawesome.com	kit.fontawesome.com
1	kit.fontawesome.com	fr.gouvcontravention-service.com
18	4

This site contains links to these domains. Also see Links.

Domain
www.antai.gouv.fr
stationnement.gouv.fr
www.service-public.fr
www.legifrance.gouv.fr

Subject Issuer	Validity	Valid
fr.gouvcontravention-service.com R3	`2024-04-17` - `2024-07-16`	3 months	crt.sh
www.amendes.gouv.fr Certigna Services CA	`2024-03-21` - `2024-11-18`	8 months	crt.sh
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-04` - `2025-01-03`	a year	crt.sh
ka-f.fontawesome.com GTS CA 1P5	`2024-03-05` - `2024-06-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd
Frame ID: F5D20E7DEC82B8E550FE3D97B2AE0CF2
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Site officiel unique de télépaiement | Amendes.gouv.fr

Page URL History Show full URLs

https://fr.gouvcontravention-service.com/ HTTP 302
https://fr.gouvcontravention-service.com/regularisation/index.php HTTP 302
https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Page Statistics

18
Requests

94 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

5
IPs

3
Countries

122 kB
Transfer

293 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.antai.gouv.fr/
Title: ANTAI : Agence nationale de traitement automatisé des infractions

Search URL Search Domain Scan URL

URL: https://stationnement.gouv.fr/
Title: Forfait post-stationnement

Search URL Search Domain Scan URL

URL: https://www.service-public.fr/
Title: Service-public.fr

Search URL Search Domain Scan URL

URL: https://www.legifrance.gouv.fr/
Title: Legifrance.gouv.fr

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://fr.gouvcontravention-service.com/ HTTP 302
https://fr.gouvcontravention-service.com/regularisation/index.php HTTP 302
https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request start.php Show response fr.gouvcontravention-service.com/regularisation/ Redirect Chain https://fr.gouvcontravention-service.com/ https://fr.gouvcontravention-service.com/regularisation/index.php https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd	61 KB 10 KB	54ms 54ms	Document text/html	193.143.1.177 PROTON66
General Check archive.org Show headers Download Go to Full URL https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.143.1.177 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software nginx / Resource Hash `c4cc680ba01c6100e6449856bffb64c2c5f761423391dac07dd7e1195ac16568` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 10434 content-type text/html; charset=UTF-8 date Wed, 17 Apr 2024 06:15:56 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding Redirect headers cache-control no-store, no-cache, must-revalidate content-length 0 content-type text/html; charset=UTF-8 date Wed, 17 Apr 2024 06:15:56 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd pragma no-cache server nginx
GET H2	404	open-sans-regular.woff2 fr.gouvcontravention-service.com/regularisation/assets/fonts/open-sans/	0 0	52ms 51ms	Font text/html	193.143.1.177 PROTON66
General Check archive.org Show headers Download Go to Full URL https://fr.gouvcontravention-service.com/regularisation/assets/fonts/open-sans/open-sans-regular.woff2 Requested by Host: fr.gouvcontravention-service.com URL: https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.143.1.177 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software nginx / Resource Hash Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Origin https://fr.gouvcontravention-service.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT content-encoding gzip last-modified Wed, 17 Apr 2024 06:12:51 GMT server nginx etag W/"b96-61644be93940c" vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	404	open-sans-bold.woff2 fr.gouvcontravention-service.com/regularisation/assets/fonts/open-sans/	0 0	53ms 52ms	Font text/html	193.143.1.177 PROTON66
General Check archive.org Show headers Download Go to Full URL https://fr.gouvcontravention-service.com/regularisation/assets/fonts/open-sans/open-sans-bold.woff2 Requested by Host: fr.gouvcontravention-service.com URL: https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.143.1.177 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software nginx / Resource Hash Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Origin https://fr.gouvcontravention-service.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT content-encoding gzip last-modified Wed, 17 Apr 2024 06:12:51 GMT server nginx etag W/"b96-61644be93940c" vary Accept-Encoding content-type text/html; charset=utf-8
GET H/1.1	200 OK	styles.ca90e67067b9e58f552b.css www.amendes.gouv.fr/	17 KB 6 KB	113ms 30ms	Stylesheet text/css	160.92.148.108 ING-AS
General Check archive.org Show headers Download Go to Full URL https://www.amendes.gouv.fr/styles.ca90e67067b9e58f552b.css Requested by Host: fr.gouvcontravention-service.com URL: https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.92.148.108 , France, ASN47957 (ING-AS, FR), Reverse DNS prod-tai-tfi-as.ca-zne-tlp.as8677.net Software / Resource Hash `30b4c3e2e9c389e284aef425ab4c06b00ff7720a6f2bf560351614279bd72bb8` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT content-encoding gzip last-modified Wed, 22 Nov 2023 15:57:38 GMT etag W/"655e24f2-453c" vary Accept-Encoding Transfer-Encoding chunked content-type text/css cache-control max-age=31536000, public, immutable expires Thu, 17 Apr 2025 06:15:56 GMT
GET		styles.b4a4b31c4a1da914e394.css www.amendes.gouv.fr/	0 0

GET H/1.1	200 OK	logo-amendes-gouv.svg www.amendes.gouv.fr/assets/img/design/	23 KB 23 KB	76ms 28ms	Image image/svg+xml	160.92.148.108 ING-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.amendes.gouv.fr/assets/img/design/logo-amendes-gouv.svg Requested by Host: fr.gouvcontravention-service.com URL: https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.92.148.108 , France, ASN47957 (ING-AS, FR), Reverse DNS prod-tai-tfi-as.ca-zne-tlp.as8677.net Software / Resource Hash `5932743bf769427d05289e72fb2bdb7cd1a5bc46f01248be159eb820fe27271d` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 last-modified Wed, 22 Nov 2023 15:58:36 GMT accept-ranges bytes etag "655e252c-5cbd" content-length 23741 content-type image/svg+xml
GET H2	200	45c4af5118.js Show response kit.fontawesome.com/	12 KB 5 KB	559ms 526ms	Script text/javascript	2606:4700:4400::6812:2844 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kit.fontawesome.com/45c4af5118.js Requested by Host: fr.gouvcontravention-service.com URL: https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fcc647447abd2ca896404eefdc6c87935a839ac4cc3f2d27315dd585cd55d711` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/ Origin https://fr.gouvcontravention-service.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT content-encoding gzip cf-cache-status MISS server cloudflare vary origin, accept-encoding, access-control-request-headers, access-control-request-method access-control-max-age 3000 access-control-allow-methods GET, OPTIONS access-control-allow-origin * content-type text/javascript cache-control max-age=60, public, stale-while-revalidate=30 cf-ray 875a48907bc19295-FRA access-control-allow-headers accept, accept-langauge, content-language, content-type, fa-kit-token x-request-id F8b8s6Eo6oSI8b4qblej
GET H2	404	runtime-es2017.cf3238a554b19a10cb82.js fr.gouvcontravention-service.com/regularisation/	0 0	51ms 50ms	Script text/html	193.143.1.177 PROTON66
General Check archive.org Show headers Download Go to Full URL https://fr.gouvcontravention-service.com/regularisation/runtime-es2017.cf3238a554b19a10cb82.js Requested by Host: fr.gouvcontravention-service.com URL: https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.143.1.177 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software nginx / Resource Hash Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Origin https://fr.gouvcontravention-service.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT content-encoding gzip last-modified Wed, 17 Apr 2024 06:12:51 GMT server nginx etag W/"b96-61644be93940c" vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	404	polyfills-es2017.533ebfade82697eddcf6.js fr.gouvcontravention-service.com/regularisation/	0 0	52ms 51ms	Script text/html	193.143.1.177 PROTON66
General Check archive.org Show headers Download Go to Full URL https://fr.gouvcontravention-service.com/regularisation/polyfills-es2017.533ebfade82697eddcf6.js Requested by Host: fr.gouvcontravention-service.com URL: https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.143.1.177 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software nginx / Resource Hash Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Origin https://fr.gouvcontravention-service.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT content-encoding gzip last-modified Wed, 17 Apr 2024 06:12:51 GMT server nginx etag W/"b96-61644be93940c" vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	404	main-es2017.3f346dd5d8d0c431d6e2.js fr.gouvcontravention-service.com/regularisation/	0 0	53ms 52ms	Script text/html	193.143.1.177 PROTON66
General Check archive.org Show headers Download Go to Full URL https://fr.gouvcontravention-service.com/regularisation/main-es2017.3f346dd5d8d0c431d6e2.js Requested by Host: fr.gouvcontravention-service.com URL: https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.143.1.177 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software nginx / Resource Hash Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Origin https://fr.gouvcontravention-service.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT content-encoding gzip last-modified Wed, 17 Apr 2024 06:12:51 GMT server nginx etag W/"b96-61644be93940c" vary Accept-Encoding content-type text/html; charset=utf-8
GET H/1.1	200 OK	bg-intro.9630b0c4c57c3d72d3ec.jpg www.amendes.gouv.fr/	40 KB 40 KB	26ms 25ms	Image image/jpeg	160.92.148.108 ING-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.amendes.gouv.fr/bg-intro.9630b0c4c57c3d72d3ec.jpg Requested by Host: www.amendes.gouv.fr URL: https://www.amendes.gouv.fr/styles.ca90e67067b9e58f552b.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.92.148.108 , France, ASN47957 (ING-AS, FR), Reverse DNS prod-tai-tfi-as.ca-zne-tlp.as8677.net Software / Resource Hash `a1fa2ccd5301b72338e02e3b1955b7c3347a27dcc6617bb1b0fcb1fac7069a86` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://www.amendes.gouv.fr/styles.ca90e67067b9e58f552b.css Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT last-modified Wed, 22 Nov 2023 15:57:38 GMT etag "655e24f2-9f08" content-type image/jpeg cache-control max-age=31536000, public, immutable accept-ranges bytes content-length 40712 expires Thu, 17 Apr 2025 06:15:56 GMT
GET H/1.1	200 OK	banner.f9855031892baad8a497.svg www.amendes.gouv.fr/	6 KB 6 KB	50ms 25ms	Image image/svg+xml	160.92.148.108 ING-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.amendes.gouv.fr/banner.f9855031892baad8a497.svg Requested by Host: www.amendes.gouv.fr URL: https://www.amendes.gouv.fr/styles.ca90e67067b9e58f552b.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.92.148.108 , France, ASN47957 (ING-AS, FR), Reverse DNS prod-tai-tfi-as.ca-zne-tlp.as8677.net Software / Resource Hash `7e9f3dfeca57ef07d745b277027de295bab063f6fbab867b10dc6cd519a0a262` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://www.amendes.gouv.fr/styles.ca90e67067b9e58f552b.css Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 last-modified Wed, 22 Nov 2023 15:57:38 GMT accept-ranges bytes etag "655e24f2-1635" content-length 5685 content-type image/svg+xml
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v6.5.2/css/	101 KB 23 KB	62ms 38ms	Fetch text/css	2606:4700:3034::6815:1adf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.5.2/css/free.min.css?token=45c4af5118 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/45c4af5118.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:1adf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3e9c73fa687cd4110688668977a7caa87f5a1dee0d11f03687bd4871deedf1c1` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT via 1.1 103eb504d36d97c9f30550032223d996.cloudfront.net (CloudFront) content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop FRA56-C2 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Tue, 02 Apr 2024 15:26:25 GMT server cloudflare etag W/"7f29cd8c97789aa298af8c61623ca28b" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eNUT27s0xSrbjO0Cm0d7rupOll6yruxL3tCaFckNY03hVrLmY42TLqXISDxoQLD4haKp7rZ4G1E0WPCeMlM9LqlqX0Wt36PXMEtMSXb8QELBTYPSRxSqR1AkGOFnWfiZcMQrkCwD08zKDrmCjrssc6M%2Fsg%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 875a4893ea781c13-FRA access-control-allow-headers fa-kit-token x-amz-cf-id 3sc1ZWQrZCYnDjnVxohvx0KeYq088pGRayTnZGvNHnSHNClPF_pPhQ==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v6.5.2/css/	27 KB 5 KB	55ms 31ms	Fetch text/css	2606:4700:3034::6815:1adf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.5.2/css/free-v4-shims.min.css?token=45c4af5118 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/45c4af5118.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:1adf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f4e953827930889e844103c3a6771bd2e9de17d091b36378c40362271858e075` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT via 1.1 8e83c42d247a31c5b365c08a0352d8f8.cloudfront.net (CloudFront) content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop FRA56-C2 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Tue, 02 Apr 2024 15:26:25 GMT server cloudflare etag W/"940b066040a876fa1dc7b2ee2d222a58" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IDLIt%2FAwrtWYHrlCaT%2BGSmyIk42LJRi6TyLjFSIpddAxlievYWgwCG0gCT63Ru8ToWv940Pqrwk%2Fr0ovqYFv1y8jR5zp56oD8ydIINhNbtL8r9nxHTcvLIf%2FnUBh7wkqx1H9QLDh76C4s9ZOTQtw2hIt6g%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 875a4893ea751c13-FRA access-control-allow-headers fa-kit-token x-amz-cf-id WvNu07rHMG88vZzttIsScmspnNKmzKpb_z4gHVhbiEy5w_5wyxJlLA==
GET H2	200	free-v5-font-face.min.css Show response ka-f.fontawesome.com/releases/v6.5.2/css/	823 B 1 KB	54ms 30ms	Fetch text/css	2606:4700:3034::6815:1adf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.5.2/css/free-v5-font-face.min.css?token=45c4af5118 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/45c4af5118.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:1adf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e1dc27b700a62c005e4521b670cac08fb0b4b3e02a73c1ac44e7f9a9784bd672` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT via 1.1 103eb504d36d97c9f30550032223d996.cloudfront.net (CloudFront) content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop FRA56-C2 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Tue, 02 Apr 2024 15:26:25 GMT server cloudflare etag W/"a3d53e21a02e37af6cbc00ac63b3cc1e" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4MKj%2BSWOBOjKjXRNWN6jEmalwW7BX3Q5pjvY9F8tCY1rG5el5nDV%2B0E%2Baohfg3gnyogXV8iY4wWQMGKFAqBNOOckZ0KEQ1uWq0cBHYqJzmMWFL%2FwtK8JaTrxvN3YyURbyhe003D6RawMBWWuuQJcq%2FjHaA%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 875a4893ea741c13-FRA access-control-allow-headers fa-kit-token x-amz-cf-id ZdLpFqeLvLTnA-CQana_f9Dyf9D7WFejz3IYiP9fh3QTXmddcagaZw==
GET H2	200	free-v4-font-face.min.css Show response ka-f.fontawesome.com/releases/v6.5.2/css/	2 KB 1 KB	59ms 34ms	Fetch text/css	2606:4700:3034::6815:1adf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.5.2/css/free-v4-font-face.min.css?token=45c4af5118 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/45c4af5118.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:1adf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9699b18200a9d40ed7859411c33cfa2194174a4746d466123107f888d93dc878` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT via 1.1 22b9ddafebf39d72780d68dad970d218.cloudfront.net (CloudFront) content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop FRA56-C2 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Tue, 02 Apr 2024 15:26:25 GMT server cloudflare etag W/"9c9f596493867f0e7ef5f9fe99103fce" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j6p%2FiehITl8XT2kYBDMHICY6MI5QkJwi3xCRoBYF7vWUXMvKN0lx9gOrnPcwRzdDz5OTz95ikjISg4As3yG7HXG8T6MFIG%2FfKxm9Q8TfPCvzOdfGPjUI%2BnJ%2FAFtwbWh17SJ%2B%2BMzcva3DQxYPff8kuY4E9Q%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 875a4893ea711c13-FRA access-control-allow-headers fa-kit-token x-amz-cf-id clsNuIWroEQVP-TD2uHf3UpYJczlQduhjxDjmDZKKJUfcPJRpeQcHw==
GET H/1.1	200 OK	lock.d72c3b80536f448a52ed.svg www.amendes.gouv.fr/	364 B 641 B	26ms 25ms	Image image/svg+xml	160.92.148.108 ING-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.amendes.gouv.fr/lock.d72c3b80536f448a52ed.svg Requested by Host: www.amendes.gouv.fr URL: https://www.amendes.gouv.fr/styles.ca90e67067b9e58f552b.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.92.148.108 , France, ASN47957 (ING-AS, FR), Reverse DNS prod-tai-tfi-as.ca-zne-tlp.as8677.net Software / Resource Hash `cd3b3531417ed9f2290c79f7ee98f9848883309b0f7aeaa4684a96a4d1018795` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://www.amendes.gouv.fr/styles.ca90e67067b9e58f552b.css Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 last-modified Wed, 22 Nov 2023 15:57:38 GMT accept-ranges bytes etag "655e24f2-16c" content-length 364 content-type image/svg+xml
GET DATA	200 OK	truncated /	312 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `cb329aaa1cb453b411a5da821dab1a6fb3c31bdc236f3fc51828436c8080e9e3` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	404	favicon.ico fr.gouvcontravention-service.com/regularisation/	3 KB 1 KB	50ms 50ms	Other text/html	193.143.1.177 PROTON66
General Check archive.org Show headers Download Go to Full URL https://fr.gouvcontravention-service.com/regularisation/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.143.1.177 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software nginx / Resource Hash `d9cd6dfca94282619431285858508adf7a4552a70c2bb6dc4f30b0c83d9b1615` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fr.gouvcontravention-service.com/regularisation/start.php?&enc=14e76878541a09df43ae486cc969e627&p=0&dispatch=322bdd10e8373526f4a47a748db84013c01febcd Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 06:15:56 GMT content-encoding gzip last-modified Wed, 17 Apr 2024 06:12:51 GMT server nginx etag W/"b96-61644be93940c" vary Accept-Encoding content-type text/html; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.amendes.gouv.fr
URL: https://www.amendes.gouv.fr/styles.b4a4b31c4a1da914e394.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: FR Government (Government)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| checkValue function| date_reformat_dd object| FontAwesomeKitConfig

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			fr.gouvcontravention-service.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 68l1oe2k2bdckn6nrheg14a9kl

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://fr.gouvcontravention-service.com/regularisation/assets/fonts/open-sans/open-sans-regular.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://fr.gouvcontravention-service.com/regularisation/assets/fonts/open-sans/open-sans-bold.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://fr.gouvcontravention-service.com/regularisation/runtime-es2017.cf3238a554b19a10cb82.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://fr.gouvcontravention-service.com/regularisation/polyfills-es2017.533ebfade82697eddcf6.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://fr.gouvcontravention-service.com/regularisation/main-es2017.3f346dd5d8d0c431d6e2.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://fr.gouvcontravention-service.com/regularisation/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fr.gouvcontravention-service.com
ka-f.fontawesome.com
kit.fontawesome.com
www.amendes.gouv.fr
www.amendes.gouv.fr
160.92.148.108
193.143.1.177
2606:4700:3034::6815:1adf
2606:4700:4400::6812:2844
30b4c3e2e9c389e284aef425ab4c06b00ff7720a6f2bf560351614279bd72bb8
3e9c73fa687cd4110688668977a7caa87f5a1dee0d11f03687bd4871deedf1c1
5932743bf769427d05289e72fb2bdb7cd1a5bc46f01248be159eb820fe27271d
7e9f3dfeca57ef07d745b277027de295bab063f6fbab867b10dc6cd519a0a262
9699b18200a9d40ed7859411c33cfa2194174a4746d466123107f888d93dc878
a1fa2ccd5301b72338e02e3b1955b7c3347a27dcc6617bb1b0fcb1fac7069a86
c4cc680ba01c6100e6449856bffb64c2c5f761423391dac07dd7e1195ac16568
cb329aaa1cb453b411a5da821dab1a6fb3c31bdc236f3fc51828436c8080e9e3
cd3b3531417ed9f2290c79f7ee98f9848883309b0f7aeaa4684a96a4d1018795
d9cd6dfca94282619431285858508adf7a4552a70c2bb6dc4f30b0c83d9b1615
e1dc27b700a62c005e4521b670cac08fb0b4b3e02a73c1ac44e7f9a9784bd672
f4e953827930889e844103c3a6771bd2e9de17d091b36378c40362271858e075
fcc647447abd2ca896404eefdc6c87935a839ac4cc3f2d27315dd585cd55d711

fr.gouvcontravention-service.com Open in urlscan Pro 193.143.1.177 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

94 %HTTPS

50 %IPv6

3 Domains

4 Subdomains

5 IPs

3 Countries

122 kBTransfer

293 kBSize

1 Cookies

4 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

6 Console Messages

Indicators

fr.gouvcontravention-service.com Open in urlscan Pro
193.143.1.177 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

94 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

5
IPs

3
Countries

122 kB
Transfer

293 kB
Size

1
Cookies

18 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!