amandes-gov[.]com

The domain amandes-gov.com was registered on 21 December 2025 through Web Commerce Communications Limited and is currently taken offline. DNS resolution points to the IPv4 address 194.163.164.13, which belongs to AS51167 (Contabo GmbH) located in France. The domain is hosted on Cloudflare name servers darl.ns.cloudflare.com and sara.ns.cloudflare.com, but no SSL certificate is presented, leaving the HTTP service unencrypted. The page title observed during analysis reads “Particuliers | authentification”, and the campaign is classified as a brand‑impersonation attempt targeting the French tax authority Impots Gouv. Reputation services assign extremely low trust scores: Scamadviser rates the site 1/100 and Gridinsoft 0/100, indicating a high likelihood of malicious intent.

The domain appears on one security blocklist and has been blocked by the PhishDestroy service. In the AlienVault Open Threat Exchange, the domain is referenced in a single threat‑intel pulse. VirusTotal analysis shows that 18 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion. The combination of a recent registration, low reputation scores, lack of TLS, and multiple detections suggests an active phishing infrastructure.

However, the offline status prevents real‑time verification of the payload or credential‑harvesting mechanisms, and no sample of the hosted content is available. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor for any resurgence of the domain or related C2 infrastructure. Additional investigation of the hosting provider Contabo GmbH may reveal other associated domains. Continuous threat‑intel correlation with the observed indicators—IP address, nameservers, and detection counts—will aid in early detection of similar impersonation campaigns.