rappel3-agricole[.]com

Analysis indicates that the domain rappel3-agricole.com was registered on 11 December 2025 through CNOBIN INFORMATION TECHNOLOGY LIMITED. The domain resolves to the IPv4 address 193.24.123.162, which is assigned to AS200593 PROSPERO OOO and geolocated to the Russian Federation. No TLS certificate is presented, and HTTP requests return a 404 page title, suggesting the site is no longer serving content. The domain is currently listed as offline by the reporting system. Security telemetry shows that six of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist.

The PhishDestroy feed has already blocked the domain, and the Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious use. Nameserver records point to ns1.ezydomain.com and ns2.ezydomain.com, which are commonly used by low‑cost registrars. The available data classify the activity as generic phishing, though the specific lure or credential‑harvesting vector has not been observed. Because the site returns a 404 title, the exact malicious page content cannot be verified, and no SSL/TLS fingerprint is available for further correlation.

The lack of active content limits the ability to confirm the exact phishing kit or payload. Defenders should continue to block the domain at perimeter and endpoint solutions, update URL filtering lists with the observed IP address and nameserver hosts, and monitor for any re‑activation of the domain or related subdomains. Threat intelligence platforms should record the registration details, hosting ASN, and the six vendor detections to aid correlation with future incidents. Continuous observation of the IP 193.24.123.162 for anomalous traffic is recommended, as the address may be reused for other malicious campaigns.