55embedilekitcdn[.]flazio[.]site

This domain, 55embedilekitcdn.flazio.site, operates as a credential theft site specifically targeting users of Ameli, the French national health insurance portal. Analysis of the page title, 'home - Votre compte ameli,' confirms the domain impersonates the legitimate Ameli login interface to harvest user credentials. The site employs social engineering tactics, presenting a fraudulent login form designed to mimic the authentic portal, thereby tricking victims into submitting sensitive personal and authentication data. Infrastructure analysis reveals multiple indicators of malicious activity. The domain is registered through Tucows Domains Inc. and was created on February 20, 2020. It resolves to the IP address 35.190.27.135, hosted on AS396982 (Google LLC) in the United States. Security vendors have flagged the domain on VirusTotal, with 17 out of 95 engines detecting it as malicious. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt, identified by the serial number E8, which is commonly observed in both legitimate and malicious domains. Users who have visited 55embedilekitcdn.flazio.site or entered credentials on the site should take immediate action to mitigate risk. Affected individuals must change their Ameli account passwords without delay and enable multi-factor authentication if available. Monitoring for unauthorized access or transactions on associated accounts is strongly advised. If financial or personally identifiable information was submitted, users should report the incident to relevant authorities and consider credit monitoring services to detect potential identity theft. Organizations should update their security blocklists to include this domain and its associated IP address to prevent further exposure.