connectassures[.]flazio[.]de

This domain, connectassures.flazio.de, is an active phishing site impersonating the French health insurance service CPAM (Caisse Primaire d'Assurance Maladie). The page title is 'home - Votre Compte CPAM', directly targeting French-speaking users seeking to access their CPAM accounts. The domain is hosted on a Google LLC IP address in the United States (35.190.27.135, AS396982) and uses a Let's Encrypt SSL certificate. Security scanners show broad consensus of maliciousness: 15 out of 95 security vendors on VirusTotal flag the domain, Gridinsoft gives it a trust score of 0 out of 100, and Scamadviser assigns a trust score of 1 out of 100. It appears on two security blocklists and is already blocked by PhishDestroy and PhishingDB. The HTTP status is 403, indicating the server may restrict direct access or the site is configured to only serve phishing pages under specific conditions. Nameservers point to ns1.systemdns.com, ns2.systemdns.com, and ns3.systemdns.com, suggesting a third-party DNS provider. Defenders should block this domain at the DNS and email gateway levels, and monitor for subdomains or related domains on the same DNS infrastructure. The exact phishing kit or data collection mechanism has not yet been analyzed, but the site is known to be actively serving a CPAM-branded credential theft page. Users who may have entered credentials should be advised to change their CPAM passwords immediately and enable multi-factor authentication if available.