WEBSITE ANALYSIS REPORT

https://app-bbe4ddd5-796b-43d3-9877-33d87e8fa3f7.cleverapps.io/ANTAI/am/paiement.php/

13 Jul 2026 · 07:03:16.000 UTCpublic

Report tags: government tax france phishing
Submit tags: openphish

Request review

Phishing detected

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

07:02:39.298 GET 200 document 56.4 KB 345 ms 3 alerts

07:02:40.068 GET 200 font 14.0 KB 206 ms —

07:02:40.070 GET 200 font 14.5 KB 492 ms —

07:02:40.072 GET 200 stylesheet 56.4 KB 72 ms 3 alerts

07:02:40.074 GET 200 script 87.8 KB 41 ms —

07:02:40.076 GET 200 script 5.7 KB 26 ms —

07:02:40.078 GET 200 script 0 B 0 ms 3 alerts

07:02:40.080 GET 200 script 0 B 0 ms 3 alerts

07:02:40.082 GET 200 script 0 B 0 ms 3 alerts

07:02:40.086 GET 200 img 20.7 KB 136 ms 3 alerts

07:02:40.088 GET No response img 0 B 0 ms —

07:02:40.176 GET 200 font 56.4 KB 94 ms 3 alerts

07:02:40.178 GET 200 font 56.4 KB 211 ms 3 alerts

Transaction #07

Request / response

URL

GET HTTPS

https://app-bbe4ddd5-796b-43d3-9877-33d87e8fa3f7.cleverapps.io/ANTAI/am/paiement.php/assets/fonts/open-sans/open-sans-bold.woff2

IP / ASN

91.208.207.142

AS43424 · Squark Sarl

Requested by: https://app-bbe4ddd5-796b-43d3-9877-33d87e8fa3f7.cleverapps.io/ANTAI/am/paiement.php/

Resource information

File type: HTML document, Unicode text, UTF-8 text, with very long lines (46861)
MIME type: text/html; charset=UTF-8
First seen (UTC): 12 Jul 2026 · 08:46:15.222 UTC
Last seen (UTC): 13 Jul 2026 · 10:16:02.680 UTC
Times seen: 5

Size: 56.4 KB (57784 bytes)
MD5: e28ee3e3c4e0c0f9c94c0a45981d8016
SHA1: f0dcee195535607cffc59f5d82a4ab2d7c08c3f8
SHA256: d5002f0916890aa74dbaa33108861a4c17bb715af9751f25245d837e8465ab98

Certificate information

Issuer: Let's Encrypt · YR2
Subject: *.cleverapps.io
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 69:91:C1:F3:6E:05:22:0D:2B:03:87:29:D1:FA:D6:6F:7A:59:BA:82
Valid from: Sun, 05 Jul 2026 12:08:53 GMT
Valid until: Sat, 03 Oct 2026 12:08:52 GMT

Technology fingerprints

jQuery:3.6.3 (JavaScript libraries)
cdnjs (CDN)
Cloudflare (CDN)
Apache HTTP Server (Web servers)
jQuery CDN (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - French Tax Agency	medium	Phishing
DNS4EU Sinkholed	medium	Malicious
Quad9 DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /ANTAI/am/paiement.php/assets/fonts/open-sans/open-sans-bold.woff2 HTTP/1.1
Host: app-bbe4ddd5-796b-43d3-9877-33d87e8fa3f7.cleverapps.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: identity
Sec-GPC: 1
Connection: keep-alive
Referer: https://app-bbe4ddd5-796b-43d3-9877-33d87e8fa3f7.cleverapps.io/ANTAI/am/paiement.php/
Cookie: PHPSESSID=cjg8p4mj4168fnnj6cg4tv2qgk
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
date: Mon, 13 Jul 2026 07:02:40 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
sozu-id: 01KXD4HYSZW6S5S5CE1CKTX61P
X-Firefox-Spdy: h2

07:02:40.666 GET 200 img 2.2 KB 51 ms —

https://app-bbe4ddd5-796b-43d3-9877-33d87e8fa3f7.cleverapps.io/ANTAI/am/paiement.php/

Domain graph

Hostnames

Connections