ameliconnect.dns-dynamic.net Open in urlscan Pro
139.64.247.40 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale
Effective URL:
https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/
Submission: On October 23 via api (October 23rd 2024, 12:01:24 am UTC) from US — Scanned from CA

Summary HTTP 11 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 7 domains to perform 11 HTTP transactions. The main IP is 139.64.247.40, located in Canada and belongs to DATACITY, CA. The main domain is ameliconnect.dns-dynamic.net.
TLS certificate: Issued by R11 on October 17th 2024. Valid for: 3 months.

This is the only time ameliconnect.dns-dynamic.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Assurance Maladie (Healthcare)

Domain & IP information

	IP Address	AS Autonomous System
1 6	139.64.247.40 139.64.247.40	31798 (DATACITY) (DATACITY)
1	2606:4700:303... 2606:4700:3036::6815:1b98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2620:0:861:ed... 2620:0:861:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
1	2607:f8b0:400... 2607:f8b0:400d:c1d::5f	15169 (GOOGLE) (GOOGLE)
1	173.194.66.94 173.194.66.94	15169 (GOOGLE) (GOOGLE)
11	7

6 139.64.247.40 (Canada) 1 redirects

ASN31798 (DATACITY, CA)
PTR: c999963694-cloudpro-482860658.cloudatcost.com

ameliconnect.dns-dynamic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::6815:1b98 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:861:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c1d::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.194.66.94 (United States)

ASN15169 (GOOGLE, US)
PTR: qo-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	dns-dynamic.net 1 redirects ameliconnect.dns-dynamic.net	220 KB
1	gstatic.com fonts.gstatic.com	18 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	2 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 791	30 KB
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 3371	36 KB
1	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1222	13 KB
0	web-carte-vitale.fr Failed web-carte-vitale.fr Failed
11	7

	Domain	Requested by
6	ameliconnect.dns-dynamic.net	1 redirects ameliconnect.dns-dynamic.net
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	ameliconnect.dns-dynamic.net
1	code.jquery.com	ameliconnect.dns-dynamic.net
1	upload.wikimedia.org	ameliconnect.dns-dynamic.net
1	use.fontawesome.com	ameliconnect.dns-dynamic.net
0	web-carte-vitale.fr Failed
11	7

This site contains links to these domains. Also see Links.

Domain
www.impots.gouv.fr

Subject Issuer	Validity	Valid
ameliconnect.dns-dynamic.net R11	`2024-10-17` - `2025-01-15`	3 months	crt.sh
use.fontawesome.com WE1	`2024-09-09` - `2024-12-09`	3 months	crt.sh
*.wikipedia.org E6	`2024-10-15` - `2025-01-13`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
upload.video.google.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.gstatic.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/
Frame ID: F935E18E16D427813ACC6B5852142361
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Veuillez remplir le formulaire

Page URL History Show full URLs

http://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale HTTP 307
https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale HTTP 301
https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

91 %
HTTPS

67 %
IPv6

7
Domains

7
Subdomains

7
IPs

2
Countries

319 kB
Transfer

590 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.impots.gouv.fr/portail/actualite/publication-de-la-brochure-pratique-impots-locaux-2024
Title: Publication de la brochure pratique Impôts locaux 2024

Search URL Search Domain Scan URL

URL: https://www.impots.gouv.fr/portail/actualite/ouverture-de-lapplication-correction-en-ligne
Title: Ouverture de l'application « Correction en ligne »

Search URL Search Domain Scan URL

URL: https://www.impots.gouv.fr/portail/actualite/resultats-de-lenquete-de-satisfaction-realisee-aupres-dusagers-particuliers-de-la-dgfip-1
Title: Résultats de l’enquête de satisfaction réalisée auprès d’usagers particuliers de la DGFIP en 2024

Search URL Search Domain Scan URL

URL: https://www.impots.gouv.fr/portail/actualite/rapport-dactivite-2024-de-la-dgfip
Title: Rapport d'activité 2024 de la DGFiP

Search URL Search Domain Scan URL

URL: https://www.impots.gouv.fr/portail/actualite/paiement-de-proximite-aupres-des-buralistes-report-de-la-generalisation
Title: Paiement de proximité auprès des buralistes : report de la généralisation

Search URL Search Domain Scan URL

URL: https://www.impots.gouv.fr/portail/actualite/covid-19-attention-aux-arnaques-par-courriel
Title: COVID-19 : attention aux arnaques par courriel !

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale HTTP 307
https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale HTTP 301
https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/
Redirect Chain

http://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale
https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale
https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/

17 KB
3 KB

38ms
37ms

Document
text/html

139.64.247.40
DATACITY

General

Check archive.org

Show headers Download Go to

Full URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 139.64.247.40 , Canada, ASN31798 (DATACITY, CA),
Reverse DNS: c999963694-cloudpro-482860658.cloudatcost.com
Software: nginx / PleskLin
Resource Hash: 6a24d8e34c70ca44bdb83683bc21c7712b2245de757fa4b5b2c91b36c81acf70

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-type: text/html
date: Wed, 23 Oct 2024 00:01:14 GMT
etag: W/"6693983c-4235"
last-modified: Sun, 14 Jul 2024 09:19:56 GMT
server: nginx
x-powered-by: PleskLin

Redirect headers

content-length: 273
content-type: text/html; charset=iso-8859-1
date: Wed, 23 Oct 2024 00:01:14 GMT
location: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/
server: nginx
x-powered-by: PleskLin

GET
H2 200 all.css
use.fontawesome.com/releases/v5.8.2/css/ 54 KB
13 KB 197ms
146ms Stylesheet
text/css 2606:4700:3036::6815:1b98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.8.2/css/all.css
Requested by: Host: ameliconnect.dns-dynamic.net
URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://ameliconnect.dns-dynamic.net
Referer: https://ameliconnect.dns-dynamic.net/

Response headers

cache-control: max-age=31556926
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
etag: W/"77cbad34e5ce95e70847b074e05faeab"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mN3ltXR8yh8Qw5mBphxuUDqQNIBwxjPsrlcDFtp4nExmiyqTt5aYcH15h1gzFzIG%2F6r%2BAD1PsMXg48%2FyrimvM27XS07%2BiX7XMiJG0nMmsux1Kj9hjUe64PMUOg2N4tdm8EbBa6rCOjjqgLpJ0fVihbx%2B"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d6d73afca2ca266-YUL
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=21293&sent=8&recv=12&lost=0&retrans=0&sent_bytes=4005&recv_bytes=2279&delivery_rate=242445&cwnd=254&unsent_bytes=0&cid=bdcb9366112911f1&ts=161&x=0"
date: Wed, 23 Oct 2024 00:01:19 GMT
content-type: text/css
last-modified: Fri, 22 Sep 2023 01:45:57 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 style_v2.css
ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/assets/css/ 141 KB
18 KB 74ms
71ms Stylesheet
text/css 139.64.247.40
DATACITY

General

Check archive.org

Show headers Download Go to

Full URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/assets/css/style_v2.css
Requested by: Host: ameliconnect.dns-dynamic.net
URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 139.64.247.40 , Canada, ASN31798 (DATACITY, CA),
Reverse DNS: c999963694-cloudpro-482860658.cloudatcost.com
Software: nginx / PleskLin
Resource Hash: ad0829c53fe8120c373f463a596cae1004a8346a9892076b1f15dc8e2cdf0791

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/

Response headers

content-encoding: br
date: Wed, 23 Oct 2024 00:01:14 GMT
etag: W/"62990220-23226"
content-type: text/css
last-modified: Thu, 02 Jun 2022 18:32:00 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 bootstrap.css
ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/assets/css/ 39 KB
3 KB 46ms
44ms Stylesheet
text/css 139.64.247.40
DATACITY

General

Check archive.org

Show headers Download Go to

Full URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/assets/css/bootstrap.css
Requested by: Host: ameliconnect.dns-dynamic.net
URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 139.64.247.40 , Canada, ASN31798 (DATACITY, CA),
Reverse DNS: c999963694-cloudpro-482860658.cloudatcost.com
Software: nginx / PleskLin
Resource Hash: 24422be1c6a2f4f68b24ea47154cac4295988c55d842d952b621a50e84b3f675

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/

Response headers

content-encoding: br
date: Wed, 23 Oct 2024 00:01:14 GMT
etag: W/"61639af0-9af2"
content-type: text/css
last-modified: Mon, 11 Oct 2021 02:01:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 first.PNG
ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/assets/images/ 194 KB
195 KB 105ms
103ms Image
image/png 139.64.247.40
DATACITY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/assets/images/first.PNG
Requested by: Host: ameliconnect.dns-dynamic.net
URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 139.64.247.40 , Canada, ASN31798 (DATACITY, CA),
Reverse DNS: c999963694-cloudpro-482860658.cloudatcost.com
Software: nginx / PleskLin
Resource Hash: ea192fcb8d784eab17a9e9c2a40dabf4debdcac48adbfd148b52a8425da118f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/

Response headers

etag: "61aacdf6-3097f"
accept-ranges: bytes
content-length: 199039
date: Wed, 23 Oct 2024 00:01:14 GMT
content-type: image/png
last-modified: Sat, 04 Dec 2021 02:09:58 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 600px-ASSURANCE_MALADIE.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/ 35 KB
36 KB 231ms
84ms Image
image/png 2620:0:861:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/1/1f/ASSURANCE_MALADIE.svg/600px-ASSURANCE_MALADIE.svg.png

Requested by

Host: ameliconnect.dns-dynamic.net
URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:861:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/9.2.5 /

Resource Hash

11325c3d10908b33a3249bfa0524658c18c1b3a0861b717872d67e62c8e33d45

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ameliconnect.dns-dynamic.net/

Response headers

access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
etag: 1c0f6a975af7f9f284f791941dbbe5bd
age: 11369
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
x-content-type-options: nosniff
server-timing: cache;desc="hit-front", host;desc="cp1107"
x-cache: cp1107 hit, cp1107 hit/2
date: Tue, 22 Oct 2024 20:51:50 GMT
content-type: image/png
content-disposition: inline;filename*=UTF-8''ASSURANCE_MALADIE.svg.png
last-modified: Sat, 29 Jun 2024 06:42:25 GMT
x-client-ip: 2607:5300:60:7867::14
x-cache-status: hit-front
strict-transport-security: max-age=106384710; includeSubDomains; preload
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 35625
server: ATS/9.2.5

GET
H2 200 jquery-3.4.1.min.js Show response
code.jquery.com/ 86 KB
30 KB 108ms
18ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.1.min.js
Requested by: Host: ameliconnect.dns-dynamic.net
URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://ameliconnect.dns-dynamic.net
Referer: https://ameliconnect.dns-dynamic.net/

Response headers

content-encoding: gzip
etag: W/"28feccc0-15851"
age: 4890916
x-cache: HIT, HIT
date: Wed, 23 Oct 2024 00:01:19 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 165507, 30891
x-served-by: cache-lga21965-LGA, cache-yul1970059-YUL
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1729641679.424001,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30638
server: nginx

GET
H2 200 css
fonts.googleapis.com/ 6 KB
2 KB 130ms
52ms Stylesheet
text/css 2607:f8b0:400d:c1d::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext

Requested by

Host: ameliconnect.dns-dynamic.net
URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/assets/css/style_v2.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c1d::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5780dcb011235f74ebd060a2e1d7e214e3bd12e13982bf4bd7fbe052d3d55f63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ameliconnect.dns-dynamic.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 23 Oct 2024 00:01:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 00:01:19 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 23 Oct 2024 00:01:19 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v40/ 18 KB
18 KB 87ms
44ms Font
font/woff2 173.194.66.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.66.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qo-in-f94.1e100.net

Software

sffe /

Resource Hash

e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://ameliconnect.dns-dynamic.net
Referer: https://fonts.googleapis.com/

Response headers

age: 492132
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 17 Oct 2025 07:19:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 07:19:07 GMT
last-modified: Thu, 14 Dec 2023 02:00:39 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18668
x-xss-protection: 0
server: sffe

GET fav.png
web-carte-vitale.fr/public/ 0
0

GET
H2 404 fav.ico
ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/ 808 B
501 B 39ms
37ms Other
text/html 139.64.247.40
DATACITY

General

Check archive.org

Show headers Download Go to

Full URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/fav.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 139.64.247.40 , Canada, ASN31798 (DATACITY, CA),
Reverse DNS: c999963694-cloudpro-482860658.cloudatcost.com
Software: nginx /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/

Response headers

content-encoding: br
date: Wed, 23 Oct 2024 00:01:15 GMT
etag: W/"328-624a53b0453ad"
content-type: text/html
last-modified: Thu, 17 Oct 2024 05:12:18 GMT
server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: web-carte-vitale.fr
URL: https://web-carte-vitale.fr/public/fav.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Assurance Maladie (Healthcare)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://web-carte-vitale.fr/public/fav.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://ameliconnect.dns-dynamic.net/assureameli.fr-carte-vitale/fav.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ameliconnect.dns-dynamic.net
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
upload.wikimedia.org
use.fontawesome.com
web-carte-vitale.fr
web-carte-vitale.fr
139.64.247.40
173.194.66.94
2606:4700:3036::6815:1b98
2607:f8b0:400d:c1d::5f
2620:0:861:ed1a::2:b
2a04:4e42::649
06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
11325c3d10908b33a3249bfa0524658c18c1b3a0861b717872d67e62c8e33d45
24422be1c6a2f4f68b24ea47154cac4295988c55d842d952b621a50e84b3f675
5780dcb011235f74ebd060a2e1d7e214e3bd12e13982bf4bd7fbe052d3d55f63
6a24d8e34c70ca44bdb83683bc21c7712b2245de757fa4b5b2c91b36c81acf70
ad0829c53fe8120c373f463a596cae1004a8346a9892076b1f15dc8e2cdf0791
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6
ea192fcb8d784eab17a9e9c2a40dabf4debdcac48adbfd148b52a8425da118f4

ameliconnect.dns-dynamic.net Open in urlscan Pro 139.64.247.40 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

91 %HTTPS

67 %IPv6

7 Domains

7 Subdomains

7 IPs

2 Countries

319 kBTransfer

590 kBSize

0 Cookies

6 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

ameliconnect.dns-dynamic.net Open in urlscan Pro
139.64.247.40 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

91 %
HTTPS

67 %
IPv6

7
Domains

7
Subdomains

7
IPs

2
Countries

319 kB
Transfer

590 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!