# PhishDestroy domain threat record: gratuit-5087888.webadorsite.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gratuit-5087888.webadorsite.com/
Machine-readable companion: https://phishdestroy.io/domain/gratuit-5087888.webadorsite.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-27 23:37:53 UTC
- Stored record updated: 2026-10-28 01:00:17 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 34.90.225.198
- Registrar in stored WHOIS data: Hosting Concepts B.V. d/b/a Registrar.eu
- Last stored HTTP status: 200
- Registration date (registry RDAP, webadorsite.com): 2019-11-21 11:21:06 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019f694d-c23a-72ff-a6ae-bca12bd83cf1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gratuit-5087888.webadorsite.com
- Certificate Transparency search: https://crt.sh/?q=%25.gratuit-5087888.webadorsite.com
- Web Archive lookup: https://web.archive.org/web/*/https://gratuit-5087888.webadorsite.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy's intake AI classified the site as malicious because it impersonates the French government invoicing service SERVICE FACTURATION CHORUS and displays the phrase “CONSULTER MA FACTURE FOURNISSEUR” to entice credential entry. The domain was first observed by PhishDestroy on 2026-10-28 and returned an HTTP 200 response at that time. Google Safe Browsing checked the URL on the same day and did not flag it.

How the scam works
In this type of phishing campaign the attacker creates a replica of a trusted invoicing portal, uses official‑sounding branding, and prompts visitors to log in or provide invoice details. Victims who enter credentials may have those details harvested for unauthorized access to financial or personal accounts. No malicious payload was observed on the page, but the impersonation alone constitutes a credential‑theft risk.

Evidence
VirusTotal scanned the domain on 2026-10-22 and reported 15 detections from 92 engines, with 14 labeled malicious and 1 suspicious (vendors include BitDefender, ESET, Fortinet, G‑Data, and others). Google Safe Browsing checked on 2026-10-28 and returned no flag. urlscan.io captured the page on 2026-07-16; its overall verdict was clean but its engine analysis marked it malicious with a score of 63. Cloudflare Radar scanned on 2026-10-28 and assigned a phishing verdict. OTX listed zero pulses. PhishDestroy’s internal blocklist contains the domain, while external blocklists showed no entries as of 2026-10-27.

Infrastructure
The subdomain gratuit-5087888.webadorsite.com was recorded as a CNAME to editor.jouwweb.nl and resolved to the IP 34.90.225.198, which was identified as belonging to Google LLC in the Netherlands. The TLS certificate is issued by Let’s Encrypt, valid from 2026-09-23 to 2026-12-22. The domain and its apex are 761 days old. No additional infrastructure details indicate operator identity.

What to do
Users who may have entered credentials should change any associated passwords and monitor accounts for suspicious activity. Organizations should block the domain at the network perimeter and add it to threat‑intelligence feeds. Security teams should review web proxy and authentication logs for accesses to this URL and consider tightening email filters for messages referencing SERVICE FACTURATION CHORUS.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019f694d-c23a-72ff-a6ae-bca12bd83cf1/
Cloudflare Radar report: https://radar.cloudflare.com/scan/149e27dc-b7a9-4603-bbed-eef1daf2c930
Stored capture screenshot: https://urlscan.io/screenshots/019f694d-c23a-72ff-a6ae-bca12bd83cf1.png
Cloudflare Radar screenshot (2026-10-27T23:42:17Z): https://screenshots.phishdestroy.io/cf/149e27dc-b7a9-4603-bbed-eef1daf2c930.png
URLScan screenshot (2025-12-19T12:27:43Z): https://screenshots.phishdestroy.io/us/019b3694-7972-7389-ba0f-2f64db8fe4ed.png
URLScan capture report: https://urlscan.io/result/019b3694-7972-7389-ba0f-2f64db8fe4ed/
URLScan screenshot (2025-12-24T01:50:05Z): https://screenshots.phishdestroy.io/us/019b4e0c-81b6-7146-847e-f0efbc68ba24.png
URLScan capture report: https://urlscan.io/result/019b4e0c-81b6-7146-847e-f0efbc68ba24/
URLScan screenshot (2025-12-24T07:39:18Z): https://screenshots.phishdestroy.io/us/019b4f4c-38be-7053-bea4-020bed83b690.png
URLScan capture report: https://urlscan.io/result/019b4f4c-38be-7053-bea4-020bed83b690/
URLScan screenshot (2026-03-02T06:25:56Z): https://screenshots.phishdestroy.io/us/019cad39-78e6-723f-9c87-7319776b5ffc.png
URLScan capture report: https://urlscan.io/result/019cad39-78e6-723f-9c87-7319776b5ffc/
URLScan screenshot (2026-03-21T06:19:40Z): https://screenshots.phishdestroy.io/us/019d0f0c-8f30-7480-ae59-93ea2df3049c.png
URLScan capture report: https://urlscan.io/result/019d0f0c-8f30-7480-ae59-93ea2df3049c/
VirusTotal report: https://www.virustotal.com/gui/domain/gratuit-5087888.webadorsite.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gratuit-5087888.webadorsite.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 23:46:21 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019f694d-c23a-72ff-a6ae-bca12bd83cf1.png
  Captured: 2026-10-27 23:37:53 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/019f694d-c23a-72ff-a6ae-bca12bd83cf1.png
  Source report: https://urlscan.io/result/019f694d-c23a-72ff-a6ae-bca12bd83cf1/
- URLScan · 2025-12-19: https://screenshots.phishdestroy.io/us/019b3694-7972-7389-ba0f-2f64db8fe4ed.png
  Captured: 2025-12-19 12:27:43 UTC
  Source report: https://urlscan.io/result/019b3694-7972-7389-ba0f-2f64db8fe4ed/
  SHA-256: ef7d6661b2c491e2d7cabcf9a5fd32f8125ac94fc00bc5cf93d249376f4e1574
- URLScan · 2025-12-24: https://screenshots.phishdestroy.io/us/019b4e0c-81b6-7146-847e-f0efbc68ba24.png
  Captured: 2025-12-24 01:50:05 UTC
  Source report: https://urlscan.io/result/019b4e0c-81b6-7146-847e-f0efbc68ba24/
  SHA-256: ef7d6661b2c491e2d7cabcf9a5fd32f8125ac94fc00bc5cf93d249376f4e1574
- URLScan · 2025-12-24: https://screenshots.phishdestroy.io/us/019b4f4c-38be-7053-bea4-020bed83b690.png
  Captured: 2025-12-24 07:39:18 UTC
  Source report: https://urlscan.io/result/019b4f4c-38be-7053-bea4-020bed83b690/
  SHA-256: ef7d6661b2c491e2d7cabcf9a5fd32f8125ac94fc00bc5cf93d249376f4e1574
- URLScan · 2026-03-02: https://screenshots.phishdestroy.io/us/019cad39-78e6-723f-9c87-7319776b5ffc.png
  Captured: 2026-03-02 06:25:56 UTC
  Source report: https://urlscan.io/result/019cad39-78e6-723f-9c87-7319776b5ffc/
  SHA-256: 1bfdde03e639c3b3ea2c15f07d202927bbfdad43e84a31e7640a0a81c545b2c0
- URLScan · 2026-03-21: https://screenshots.phishdestroy.io/us/019d0f0c-8f30-7480-ae59-93ea2df3049c.png
  Captured: 2026-03-21 06:19:40 UTC
  Source report: https://urlscan.io/result/019d0f0c-8f30-7480-ae59-93ea2df3049c/
  SHA-256: 1bfdde03e639c3b3ea2c15f07d202927bbfdad43e84a31e7640a0a81c545b2c0
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/149e27dc-b7a9-4603-bbed-eef1daf2c930.png
  Captured: 2026-10-27 23:42:17 UTC
  Source report: https://radar.cloudflare.com/scan/149e27dc-b7a9-4603-bbed-eef1daf2c930
  SHA-256: 667bb7d8d2655513524408f7e4bb503b8768d3be3296ab1f0fd38f63797561c6

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T23:45:30Z",
        "uuid": "019f694d-c23a-72ff-a6ae-bca12bd83cf1",
        "scanned_at": "2026-07-16T05:02:17Z",
        "final_url": "https://gratuit-5087888.webadorsite.com/",
        "status": 200,
        "ip": "34.90.225.198",
        "ptr": "198.225.90.34.bc.googleusercontent.com",
        "domains": [
            "assets.jwwb.nl",
            "primary.jwwb.nl",
            "gfonts.jwwb.nl",
            "plausible.io"
        ],
        "ips": [
            "151.101.1.55",
            "151.101.129.55",
            "151.101.193.91",
            "2400:52e0:1e00:2::1331:1",
            "34.90.225.198"
        ],
        "asns": [
            "54113",
            "60068",
            "396982"
        ],
        "countries": [
            "US",
            "DE",
            "NL"
        ],
        "link_domains": [
            "espaceclientscompte.com",
            "www.webador.fr"
        ],
        "doc_hash": "c3b325959baaed9ed717f528672de76c0e7c0b611b36070602812083584d7ded",
        "globals": [
            "JOUWWEB",
            "backgroundElement",
            "plausible",
            "webpackChunkjouwweb",
            "clearImmediate",
            "setImmediate",
            "$",
            "jQuery"
        ],
        "cookies": [
            "JwStickySession"
        ],
        "tls": {
            "san": [
                "*.webadorsite.com",
                "webadorsite.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "*.webadorsite.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-09-03T23:04:53Z",
            "valid_from": "2026-06-05T23:04:54Z"
        },
        "domain_age_days": 761,
        "apex_age_days": 761,
        "tls_age_days": 40,
        "tls_valid_days": 89,
        "requests": 20,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 63,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8",
            "content-security-policy": "frame-ancestors 'self'",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T23:45:33Z",
        "uuid": "149e27dc-b7a9-4603-bbed-eef1daf2c930",
        "scanned_at": "2026-10-27T23:42:17Z",
        "final_url": "https://gratuit-5087888.webadorsite.com/",
        "status": 200,
        "history": [
            {
                "url": "https://gratuit-5087888.webadorsite.com/",
                "status": 200
            }
        ],
        "dom_hash": "35b5d0f2b52eab8cb2a999d00ea598e9128f5bbbb643ad8cba165ac049bdf160",
        "doc_hash": "615a3cf051015398600c7f006ca2b08be8159f4c2910321b927771949ee66cc0",
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gratuit-5087888.webadorsite.com",
                "type": "CNAME",
                "value": "editor.jouwweb.nl"
            },
            {
                "name": "gratuit-5087888.webadorsite.com",
                "type": "CNAME",
                "value": "editor.jouwweb.nl"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.23",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "created": "2019-11-21T11:21:06Z",
            "updated": "2025-12-08T18:51:28Z",
            "expires": "2026-11-21T11:21:06Z",
            "nameservers": [
                "ns-cloud-e1.googledomains.com",
                "ns-cloud-e2.googledomains.com",
                "ns-cloud-e3.googledomains.com",
                "ns-cloud-e4.googledomains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T23:40:57Z",
        "analysis_at": "2026-10-22T19:13:25Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 14,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "phishing",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "created": "2019-11-21T00:00:00Z",
        "updated": "2025-12-08T00:00:00Z",
        "first_seen": "2024-06-14T13:24:41Z",
        "dns": [
            {
                "ttl": 10123,
                "type": "A",
                "value": "34.90.225.198"
            },
            {
                "ttl": 10800,
                "type": "CNAME",
                "value": "editor.jouwweb.nl"
            }
        ],
        "dns_at": "2026-10-22T19:13:47Z",
        "jarm": "29d3fd00029d29d00042d43d0000000464fb8c6842ac133bede81390a48134",
        "cert": {
            "san": [
                "*.webadorsite.com",
                "webadorsite.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "65d156b8c8d8b57bf38dc1735f120580409",
            "sha256": "b57fa96865b3e7d69e3fe106e9fce1c04d84e3d51fcf92999178bd76c6efa5af",
            "subject": "*.webadorsite.com",
            "valid_to": "2026-12-22T23:05:05Z",
            "valid_from": "2026-09-23T23:05:06Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T23:45:46Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "gratuit-5087888.webadorsite.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-27T23:41:21Z",
            "first": "2026-10-27T23:41:21Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 6797
        },
        "robots_txt": {
            "present": true,
            "sitemaps": [
                "https://gratuit-5087888.webadorsite.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 1
        },
        "security_txt": {
            "present": true,
            "found_in": "/.well-known/security.txt"
        },
        "social_tags": {
            "ogUrl": "https://gratuit-5087888.webadorsite.com/",
            "title": "SERVICE FACTURATION CHORUS",
            "ogImage": "https://primary.jwwb.nl/public/y/o/j/temp-lcaexnqwufrgpkstssts/capture-d-cran-2024-03-22-195311-high.png",
            "ogTitle": "SERVICE FACTURATION CHORUS",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://gratuit-5087888.webadorsite.com/"
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Plausible Analytics",
                    "company": "Plausible Insights",
                    "country": "EE",
                    "category": "Utilities",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://plausible.io/js/script.manual.js",
                "https://assets.jwwb.nl/assets/website-rendering-i18n/fr-FR.js",
                "https://assets.jwwb.nl/assets/website-rendering/runtime.a2455a67aab510c8778e.js",
                "https://assets.jwwb.nl/assets/website-rendering/964.a958855da07340f5fab3.js",
                "https://assets.jwwb.nl/assets/website-rendering/main.097ce86a1f530b9c0e8b.js"
            ],
            "third_party_scripts": 5
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 252,
                "tls": 51,
                "wait": 126,
                "connect": 30,
                "download": 19
            },
            "response_ms": 478
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 27397,
            "co2_grams": 0.001,
            "cleaner_than": 50
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "216.239.32.110",
                    "host": "ns-cloud-e1.googledomains.com"
                },
                {
                    "ip": "216.239.36.110",
                    "host": "ns-cloud-e3.googledomains.com"
                },
                {
                    "ip": "216.239.34.110",
                    "host": "ns-cloud-e2.googledomains.com"
                },
                {
                    "ip": "216.239.38.110",
                    "host": "ns-cloud-e4.googledomains.com"
                }
            ],
            "zone": "webadorsite.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "JwStickySession",
                    "secure": true,
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "34.90.225.198",
            "asn": "396982",
            "org": "Google LLC",
            "city": "Groningen",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "*.webadorsite.com"
        },
        "dns": {
            "A": [
                "34.90.225.198"
            ],
            "CNAME": [
                "editor.jouwweb.nl"
            ]
        },
        "dnssec": {
            "ds": true,
            "rrsig": false,
            "dnskey": true
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "frame-ancestors 'self'",
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "34.90.225.198",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://gratuit-5087888.webadorsite.com"
            ]
        },
        "linked_pages": {
            "external": [
                "https://espaceclientscompte.com/messagerie/orange",
                "https://www.webador.fr/",
                "https://www.webador.fr/"
            ],
            "external_count": 3,
            "internal_count": 2
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html; charset=UTF-8",
                "content-security-policy": "frame-ancestors 'self'",
                "x-content-type-options": "nosniff"
            }
        }
    }
}
```