kpsservices[.]fr

The domain kpsservices.fr was observed on 12 July 2026 delivering a high‑risk generic phishing page that mimics the editorial layout of Mediapart. The page title returned by the server reads "Mediapart – Actualité, enquêtes et dossiers d’investigation en toute indépendance", indicating a deliberate attempt to confuse readers of the French investigative news outlet. The site returns HTTP 200, suggesting the content is fully accessible to victims.

Domain registration was performed through the SCALEWAY platform on 21 February 2026. Authoritative name servers are ns1.o2switch.net and ns2.o2switch.net, both typical of shared‑hosting environments. DNS resolution points to 151.101.130.132, an address owned by AS54113 Fastly, Inc. located in the United States. The site is protected by a Let\'s Encrypt certificate (R12), which provides a valid TLS handshake but does not imply legitimacy.

Security‑vendor analysis on VirusTotal shows that 10 of 95 scanners flag the domain as malicious, reflecting a moderate level of consensus among AV engines. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one public blocklist. It is also listed as blocked by the PhishDestroy service, corroborating its classification as a phishing infrastructure.

Defenders should block DNS resolution for kpsservices.fr at the network perimeter and add the IP address 151.101.130.132 to any relevant deny lists. Email filtering solutions should be updated to recognize URLs that resolve to this host, and users should be warned that any request for Mediapart credentials originating from this domain is likely fraudulent. Continuous monitoring of the associated nameservers and certificate renewals is advised, as adversaries may shift hosting while retaining the same domain registration.