amandes-gouv[.]r-antai[.]com

Analysis of the domain amandes-gouv.r-antai.com indicates a phishing campaign targeting French government entities, specifically mimicking the Agence Nationale de Traitement Automatisé des Infractions (ANTAI). The domain was registered on February 21, 2026, through NameSilo, LLC, and is currently offline with an HTTP 403 status. It resolves to IP 188.114.96.3, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare services. Detection data shows the domain is flagged by 12 of 91 security vendors on VirusTotal, though the specific detection rules or payloads are not detailed.

It appears on a single security blocklist, specifically PhishDestroy, suggesting recent or limited detection coverage. The page title, 'amandes-gouv.r-antai.com,' directly references the targeted brand, reinforcing the phishing classification. No evidence of a known phishing kit or additional infrastructure links is present in the available data. Infrastructure analysis reveals the use of Cloudflare nameservers (stevie.ns.cloudflare.com and zac.ns.cloudflare.com) and technologies such as Cloudflare Browser Insights and HTTP/3, which are consistent with both legitimate and malicious sites leveraging Cloudflare's proxy services.

The domain's creation date (February 2026) and its current offline status may indicate a short-lived campaign or takedown action. Defenders should treat this domain as malicious and block it at the DNS and network levels. Given the targeting of a government entity, monitoring for related domains using similar naming conventions (e.g., variations of 'amandes-gouv' or 'r-antai') is recommended. No further content analysis is available, as the site is offline and no payload or page structure details were provided.