mon-paiement-cpam[.]info

PhishDestroy has identified mon-paiement-cpam.info as a high-risk phishing domain currently active and targeting users with a fraudulent login page designed to steal credentials. The site impersonates the French health insurance organization CPAM (Caisse Primaire d'Assurance Maladie), tricking victims into entering sensitive personal and financial information under the guise of payment management. This is a classic credential harvesting attack, where the stolen data can be used for identity theft, unauthorized transactions, or sold on dark web markets.

The evidence against this domain is overwhelming. VirusTotal analysis shows that 12 out of 95 security vendors flag mon-paiement-cpam.info as malicious, a clear indicator of its dangerous nature. The domain was registered on June 15, 2026, through Dynadot Inc, a registrar often abused for phishing operations. Despite being a relatively new domain, it already appears on 1 security blocklist, and its SSL certificate, issued by Let's Encrypt, gives it a false veneer of legitimacy. The site resolves to IP address 85.121.176.173 and currently displays a Plesk Obsidian 18.0.78 default page, suggesting it may be under construction or used for multiple phishing campaigns.

If you have visited mon-paiement-cpam.info or entered any information, take immediate action. Change the passwords for any accounts you may have used, especially if you reused credentials. Contact your bank and credit card companies to monitor for fraudulent transactions. Enable two-factor authentication on all important accounts. Report the incident to local authorities and consider placing a fraud alert on your credit file. Always verify the legitimacy of official websites by typing the URL directly into your browser rather than clicking links from emails or messages. For more information on phishing threats, visit PhishDestroy.