Fake French Registry — Punycode Impersonation Charges €198.87 via Shopify Using Real SIREN Data

The operation uses two separately registered punycode .fr domains: one as the user-facing site (now frozen by AFNIC), one as the API backend (still fully active). The backend domain was registered 24 days before the primary site, indicating it is the original infrastructure — the primary domain was a newer alias. Cloudflare continues to serve the frozen primary domain because AFNIC's serverHold only blocks DNS propagation changes and renewals; Cloudflare's authoritative nameservers, already configured, are unaffected.

The /api/lookup/{code} endpoint returns full victim company data including personal name, SIREN, SIRET, registered address, legal form, and APE activity code — all without any authentication. Any actor who knows or guesses a valid 6-character alphanumeric code can enumerate and harvest this data. The 6-character alphanumeric space (36^6 = ~2.2 billion combinations) is theoretically large, but victim-specific URLs delivered via physical post indicate codes are assigned sequentially or semi-predictably per mailing batch.

The payment flow runs through Shopify Checkout, confirmed via a live API probe (/api/payment-status returns provider:"shopify"). The pricing function hardcoded in the page JS targets recently created companies at a higher price — a deliberate signal that the operator is aware new business owners are less familiar with publication légale requirements and are more likely to pay without verifying legitimacy.

The primary lure is a physical letter or official-looking email sent to the registered address of French company directors. The letter cites the victim's real company name and references their legal publication obligation, directing them to visit a personalized URL containing their unique "personal code". On arrival, the page shows the victim's actual company data — confirming their identity — and presents a demand for €198.87 to "complete" a publication légale or registry listing. The page is designed to look indistinguishable from INFOGREFFE, BODACC, or the official RCS portal.

This operation maps cleanly to the MITRE ATT&CK for Enterprise framework across resource development, initial access, collection, and impact phases. No malware is deployed; the attack is entirely social engineering + payment fraud.