antai-contravention-reglementation.net Open in urlscan Pro
185.221.67.30  Malicious Activity! Public Scan

URL: https://antai-contravention-reglementation.net/app/pages/index.php
Submission: On November 28 via api from US — Scanned from US

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 185.221.67.30, located in Amsterdam, Netherlands and belongs to AS-SUISSE, SC. The main domain is antai-contravention-reglementation.net.
TLS certificate: Issued by R3 on November 27th 2023. Valid for: 3 months.
This is the only time antai-contravention-reglementation.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: FR Government (Government)

Domain & IP information

IP Address AS Autonomous System
2 185.221.67.30 211760 (AS-SUISSE)
2 2
Domain Requested by
2 antai-contravention-reglementation.net antai-contravention-reglementation.net
2 1

This site contains links to these domains. Also see Links.

Domain
www.amendes.gouv.fr
Subject Issuer Validity Valid
antai-contravention-reglementation.net
R3
2023-11-27 -
2024-02-25
3 months crt.sh

This page contains 1 frames:

Primary Page: https://antai-contravention-reglementation.net/app/pages/index.php
Frame ID: CB46B8F7A45A053D2041C8C760F6B6A9
Requests: 6 HTTP requests in this frame

Screenshot

Page Title

Site officiel unique de télépaiement | Amendes.gouv.fr

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

84 kB
Transfer

206 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.php
antai-contravention-reglementation.net/app/pages/
137 KB
60 KB
Document
General
Full URL
https://antai-contravention-reglementation.net/app/pages/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.221.67.30 Amsterdam, Netherlands, ASN211760 (AS-SUISSE, SC),
Reverse DNS
Software
nginx / PHP/8.1.25 PleskLin
Resource Hash
9d1811cf796045d03dfb06b94900983613fe357676b5274f67f86609b9b6f3b2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 28 Nov 2023 00:38:24 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.1.25 PleskLin
logo-amendes-gouv.svg
antai-contravention-reglementation.net/app/pages/assets/
23 KB
23 KB
Image
General
Full URL
https://antai-contravention-reglementation.net/app/pages/assets/logo-amendes-gouv.svg
Requested by
Host: antai-contravention-reglementation.net
URL: https://antai-contravention-reglementation.net/app/pages/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.221.67.30 Amsterdam, Netherlands, ASN211760 (AS-SUISSE, SC),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
5932743bf769427d05289e72fb2bdb7cd1a5bc46f01248be159eb820fe27271d

Request headers

accept-language
en-US,en;q=0.9
Referer
https://antai-contravention-reglementation.net/app/pages/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 28 Nov 2023 00:38:24 GMT
last-modified
Tue, 07 Feb 2023 17:42:50 GMT
server
nginx
etag
"63e28d9a-5cbd"
x-powered-by
PleskLin
content-type
image/svg+xml
accept-ranges
bytes
content-length
23741
truncated
/
40 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a1fa2ccd5301b72338e02e3b1955b7c3347a27dcc6617bb1b0fcb1fac7069a86

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7e9f3dfeca57ef07d745b277027de295bab063f6fbab867b10dc6cd519a0a262

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
364 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cd3b3531417ed9f2290c79f7ee98f9848883309b0f7aeaa4684a96a4d1018795

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
312 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cb329aaa1cb453b411a5da821dab1a6fb3c31bdc236f3fc51828436c8080e9e3

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: FR Government (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

1 Cookies

Domain/Path Name / Value
antai-contravention-reglementation.net/ Name: PHPSESSID
Value: aaov2sunu3c2qs236ruvt8bhp4

2 Console Messages

Source Level URL
Text
other warning URL: https://antai-contravention-reglementation.net/app/pages/index.php(Line 138)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://antai-contravention-reglementation.net/app/pages/index.php(Line 139)
Message:
<link rel=preload> has an invalid `href` value