ma-carte-renouvellement[.]com

This domain, ma-carte-renouvellement.com, poses a high-risk brand impersonation threat targeting users of Assurance Maladie, the French national health insurance service. The site replicates the official ameli.fr login portal, presenting a fraudulent interface designed to harvest credentials from unsuspecting victims. The page title, "ameli, le site de l’Assurance Maladie en ligne | ameli.fr | Assuré," directly mirrors the legitimate service, increasing the likelihood of successful deception. Such impersonation attacks are commonly used to facilitate identity theft, unauthorized access to personal health data, or financial fraud through subsequent exploitation of compromised accounts.

Analysis of the domain’s infrastructure reveals multiple indicators of malicious activity. The domain was registered on February 23, 2026, through Global Domain Group LLC, a registrar frequently associated with fraudulent registrations. It resolves to the IP address 185.99.98.8, hosted on AS205397 (69HOST LLC) in the Netherlands, a network with a history of hosting phishing and malware distribution sites. VirusTotal reports that 17 out of 95 security vendors flag this domain as malicious, while Google Safe Browsing explicitly classifies it as a phishing site. Additionally, the domain appears on one security blocklist and was previously blocked by enterprise threat intelligence feeds. The SSL certificate, issued by Let’s Encrypt (R13), provides encryption but does not validate legitimacy, as threat actors commonly abuse free certificate authorities to lend a false sense of security to their fraudulent sites.

Users who visited ma-carte-renouvellement.com or entered credentials on the site should take immediate action to mitigate potential compromise. First, reset passwords for Assurance Maladie accounts and any other services where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor financial and health-related accounts for suspicious activity, such as unauthorized transactions or changes to personal information. If sensitive data was submitted, consider reporting the incident to relevant authorities, such as the French national cybersecurity agency (ANSSI) or local law enforcement. Finally, scan the device used to access the domain for malware, as phishing sites may deploy additional payloads to maintain persistence or exfiltrate data.