recouveclients.fr
Open in
urlscan Pro
87.121.87.39
Malicious Activity!
Public Scan
Effective URL: https://recouveclients.fr/antai/search.php?session=a0dfaedede9b35dc542d1b2e94f4e6e5
Submission: On January 16 via api from US — Scanned from FR
Summary
TLS certificate: Issued by R3 on January 14th 2024. Valid for: 3 months.
This is the only time recouveclients.fr was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: FR Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 8 | 87.121.87.39 87.121.87.39 | 215862 (SOUZA-AS) (SOUZA-AS) | |
1 | 2a04:4e42:600... 2a04:4e42:600::649 | 54113 (FASTLY) (FASTLY) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 160.92.148.108 160.92.148.108 | 47957 (ING-AS) (ING-AS) | |
23 | 5 |
ASN215862 (SOUZA-AS, BR)
PTR: pppoe-87-121-87-39.citybs.net
recouveclients.fr |
ASN47957 (ING-AS, FR)
PTR: prod-tai-tfi-as.ca-zne-tlp.as8677.net
www.amendes.gouv.fr |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
recouveclients.fr
2 redirects
recouveclients.fr |
71 KB |
4 |
amendes.gouv.fr
www.amendes.gouv.fr Failed |
49 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225 |
3 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 760 |
31 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
23 | 5 |
Domain | Requested by | |
---|---|---|
8 | recouveclients.fr |
2 redirects
recouveclients.fr
|
4 | www.amendes.gouv.fr |
recouveclients.fr
|
1 | cdnjs.cloudflare.com |
recouveclients.fr
|
1 | code.jquery.com |
recouveclients.fr
|
0 | aegnopegbbhjeeiganiajffnalhlkkjb Failed |
recouveclients.fr
|
23 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
recouveclients.fr R3 |
2024-01-14 - 2024-04-13 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
www.amendes.gouv.fr Certigna Services CA |
2023-11-08 - 2024-11-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://recouveclients.fr/antai/search.php?session=a0dfaedede9b35dc542d1b2e94f4e6e5
Frame ID: 3ADCE86C26F24BA631C41725A4632844
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
Site officiel unique de télépaiement | Amendes.gouv.frPage URL History Show full URLs
-
http://recouveclients.fr/
HTTP 301
https://recouveclients.fr/ HTTP 302
https://recouveclients.fr/antai/search.php?session=a0dfaedede9b35dc542d1b2e94f4e6e5 Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://recouveclients.fr/
HTTP 301
https://recouveclients.fr/ HTTP 302
https://recouveclients.fr/antai/search.php?session=a0dfaedede9b35dc542d1b2e94f4e6e5 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
search.php
recouveclients.fr/antai/ Redirect Chain
|
70 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
open-sans-regular.woff2
www.amendes.gouv.fr/assets/fonts/open-sans/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
open-sans-bold.woff2
www.amendes.gouv.fr/assets/fonts/open-sans/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.b4a4b31c4a1da914e394.css
recouveclients.fr/files/ |
17 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-amendes-gouv.svg
recouveclients.fr/files/ |
23 KB 23 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.3.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.11.2/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
custom.css
aegnopegbbhjeeiganiajffnalhlkkjb/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ut-pro-logo.png
aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-sync.svg
aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-success.svg
aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-key2.svg
aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-alert.svg
aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-feedback.svg
aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-intro.9630b0c4c57c3d72d3ec.jpg
www.amendes.gouv.fr/ |
40 KB 40 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banner.f9855031892baad8a497.svg
www.amendes.gouv.fr/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lock.d72c3b80536f448a52ed.svg
recouveclients.fr/files/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
open-sans-regular.woff2
recouveclients.fr/files/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
open-sans-bold.woff2
recouveclients.fr/files/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-sync.svg
aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-success.svg
aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
moyen-app.e6b1c8e9e8920b4b6aa6.svg
www.amendes.gouv.fr/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
moyen-tel.980753f2b4b0302466cb.svg
www.amendes.gouv.fr/ |
971 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
312 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.amendes.gouv.fr
- URL
- https://www.amendes.gouv.fr/assets/fonts/open-sans/open-sans-regular.woff2
- Domain
- www.amendes.gouv.fr
- URL
- https://www.amendes.gouv.fr/assets/fonts/open-sans/open-sans-bold.woff2
- Domain
- aegnopegbbhjeeiganiajffnalhlkkjb
- URL
- chrome-extension://aegnopegbbhjeeiganiajffnalhlkkjb/css/custom.css
- Domain
- aegnopegbbhjeeiganiajffnalhlkkjb
- URL
- chrome-extension://aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/ut-pro-logo.png
- Domain
- aegnopegbbhjeeiganiajffnalhlkkjb
- URL
- chrome-extension://aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/icon-sync.svg
- Domain
- aegnopegbbhjeeiganiajffnalhlkkjb
- URL
- chrome-extension://aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/icon-success.svg
- Domain
- aegnopegbbhjeeiganiajffnalhlkkjb
- URL
- chrome-extension://aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/icon-key2.svg
- Domain
- aegnopegbbhjeeiganiajffnalhlkkjb
- URL
- chrome-extension://aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/icon-alert.svg
- Domain
- aegnopegbbhjeeiganiajffnalhlkkjb
- URL
- chrome-extension://aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/icon-feedback.svg
- Domain
- aegnopegbbhjeeiganiajffnalhlkkjb
- URL
- chrome-extension://aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/icon-sync.svg
- Domain
- aegnopegbbhjeeiganiajffnalhlkkjb
- URL
- chrome-extension://aegnopegbbhjeeiganiajffnalhlkkjb/img/assets/icon-success.svg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: FR Government (Government)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
recouveclients.fr/ | Name: PHPSESSID Value: uqqq7f661o8c8ctp3964pb0jeb |
16 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aegnopegbbhjeeiganiajffnalhlkkjb
cdnjs.cloudflare.com
code.jquery.com
recouveclients.fr
www.amendes.gouv.fr
aegnopegbbhjeeiganiajffnalhlkkjb
www.amendes.gouv.fr
160.92.148.108
2606:4700::6811:180e
2a04:4e42:600::649
87.121.87.39
1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc
2621f5b43c8de1a78e51e82e862ee48a034025da57e124c84c0f3246ed824714
5720f1d86c00fa008e822e683979effd9b17260602fbbd442cbb881afa5f3207
5932743bf769427d05289e72fb2bdb7cd1a5bc46f01248be159eb820fe27271d
7e9f3dfeca57ef07d745b277027de295bab063f6fbab867b10dc6cd519a0a262
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
a17f2e9528214109ad7194958c1c3ba5367166dc7163f630d5c02c04a7623ef6
a1fa2ccd5301b72338e02e3b1955b7c3347a27dcc6617bb1b0fcb1fac7069a86
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
cb329aaa1cb453b411a5da821dab1a6fb3c31bdc236f3fc51828436c8080e9e3
dc05212122fca7f6b0ff3937b9e14885d69a5c8b42dbbe347d2ad52b0b5e4c6d
e23925afe29514a3ff8b99eaa9bbd5bd2103f3d5a7833a6d8ae7b75306c2547e