infos5-agricole[.]com

Analysis of the domain infos5-agricole.com indicates it was operational as a generic phishing site targeting users of agricultural or financial services, though the exact brand impersonated remains unconfirmed due to limited content analysis. The domain, registered on December 12, 2025, through CNOBIN INFORMATION TECHNOLOGY LIMITED, resolved to the IP address 193.24.123.162, hosted within the Russian autonomous system AS200593 (PROSPERO OOO). No SSL certificate was detected, increasing the risk of unencrypted data interception. Nameservers were provided by Cloudflare (keyla.ns.cloudflare.com and newt.ns.cloudflare.com), a common infrastructure choice for both legitimate and malicious actors. Detection data reveals moderate but inconsistent flagging: five of 95 security vendors on VirusTotal identified the domain as malicious, while it appeared on a single security blocklist (PhishDestroy).

AlienVault OTX included the domain in one threat intelligence pulse, suggesting limited but active tracking by defenders. The domain is currently offline, returning a 404 page title, which may indicate takedown or temporary suspension. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk classification. Defenders should treat this domain as part of a broader phishing campaign targeting agricultural or financial sectors, particularly given its naming convention.

The use of Cloudflare nameservers and Russian hosting, combined with the absence of SSL, aligns with common phishing infrastructure patterns. While the domain is no longer resolving, historical DNS and WHOIS records should be preserved for forensic analysis. Organizations in relevant sectors should monitor for similar domains registered through the same registrar or resolving to the same IP range, as these may represent follow-up campaigns.