selfcare-caa[.]wirk[.]io

This domain, selfcare-caa.wirk.io, is identified as a credential harvesting phishing site targeting customers of Crédit Agricole Assurances. The page title, 'Crédit Agricole Assurances - Selfcare Wirk KYC,' mimics legitimate self-service portals to deceive users into submitting sensitive authentication credentials, including multi-factor authentication tokens and personal identification documents. Analysis indicates the site employs social engineering tactics to exploit trust in financial institutions, particularly during know-your-customer (KYC) verification processes. Infrastructure analysis reveals the domain was registered through OVH SAS on February 21, 2026, an anomalous future-dated registration suggesting potential domain spoofing or registrar manipulation. The site resolves to IP address 172.67.72.44 and is served via Cloudflare, leveraging HTTP/3 and HSTS to enhance perceived legitimacy. Detection metrics show 2 out of 95 security engines on VirusTotal flag the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services, and the site utilizes Microsoft ASP.NET, jQuery, and Cloudflare Browser Insights, further obscuring its true nature. Users who accessed selfcare-caa.wirk.io should immediately revoke any submitted credentials and monitor associated financial accounts for unauthorized activity. It is recommended to reset passwords using a trusted device and enable additional authentication layers, such as hardware tokens or biometric verification. Organizations should update internal blocklists to include the domain and IP 172.67.72.44, and report the incident to relevant cybersecurity authorities for further investigation. The domain has since been taken offline, but similar campaigns may emerge using comparable infrastructure.