DomainMediumSignal 12/100
amazon-login-php.fr
Location
FranceFirst Seen
Mar 12, 2025
Last Seen
Aug 10, 2025
Found in 3 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
12%
Signal Score
12 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Feed Intelligence Summary
3 reports12% confidence
3
Source reports
12%
Confidence score
Category tags
botnetcommand and controldata exfiltrationdgadistributed attackseuropefrancefraud domainsfraudulent websitesindicatormalicious domainmalicious softwaremalwaremalware distribution domainsmalware domainsnetworkphishing domainsprocess injectionred flag domainsresearchedt1055t1071t1071.001t1105t1189t1486t1496t1499.002t1499.003t1565t1566t1566.001t1583t1583.001t1588t1591
Activity Timeline
Aug 10Aug 10
Threat Activity Heatmap
· Peak: 2025-08-10LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Intelligence SummaryAI Generated
The domain **amazon-login-php.fr**, originating from France, has been identified as a critical indicator of compromise (IOC) associated with botnet and malware activities. First observed on March
Threat ScoreLow Risk
12
SIGNAL
Signal Score
12%
Confidence
3
Reports
First seenMar 12, 2025
Last seenAug 10, 2025
VirusTotal
Not checked
WHOIS
- registrar
- AMEN / Agence des Médias Numériques
- description
- Entries from https://red.flag.domains/ - malicious domains targeting french citizens. Auto-updated each day.
- domain rank
- -1
- raw
- Expiry Date: 2025-01-14T00:56:14.035049Z changed: 2024-02-03T09:29:22.957034Z country: FR created: 2023-01-14T00:56:14.055217Z domain: amazon-login-php.fr e-mail: [email protected] eligstatus: not identified eppstatus: active eppstatus: associated last-update: 2024-01-14T01:05:08.170856Z nic-hdl: AF307-FRNIC nic-hdl: ANO00-FRNIC nserver: ns1.amenworld.com nserver: ns2.amenworld.com reachstatus: not identified registered: 1999-01-11T00:00:00Z registrar: AMEN / Agence des Médias Numériques source: FRNIC status: ACTIVE status: autoRenewPeriod type: ORGANIZATION type: PERSON
- references
- https://threatintel.cybsec.fr/2023IOCs4_cybsec.txt, https://dl.red.flag.domains/red.flag.domains.txt, https://www.trendmicro.com/en_us/research/23/i/cybercriminals-exploit-the-moroccan-tragedy-in-new-scam-campaign.html
- subdomains count
- 0
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 10 months ago
Appeared in 3 threat reports