infos6-agricole[.]com

Analysis of the domain infos6-agricole.com, created on 12 December 2025 and currently taken offline, shows it was used in a generic phishing campaign. The domain resolves to the IPv4 address 193.24.123.162, which is allocated to AS200593 PROSPERO OOO in the Russian Federation. No TLS certificate was observed, and HTTP requests return a 404 page title, indicating the site is no longer serving content. The authoritative nameservers are simone.ns.cloudflare.com and tosana.ns.cloudflare.com, both operated by Cloudflare, suggesting the attacker leveraged a reputable DNS provider to obscure location.

Registration was performed through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar that appears in other abuse reports, though no further affiliation is evident. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, reflecting extreme risk. Four of ninety‑five VirusTotal scanners flagged the domain, and it is listed on a single security blocklist. PhishDestroy has already blocked the domain, and the same indicator appears in the internal blocklist used by the reporting organization.

The limited detection footprint—four vendor detections and a single blocklist entry—implies that the campaign was either short‑lived or not widely distributed. Defenders should continue to monitor DNS queries for the domain and the associated IP address, enforce outbound filtering for connections to 193.24.123.162, and incorporate the indicator into URL and email filtering rules. Because the site is offline, active takedown is not applicable, but threat‑intel sharing platforms should be updated with the indicator to aid correlation with future campaigns that reuse the same registrar or hosting infrastructure.