service-assistance-cliente-info[.]surge[.]sh

This domain, service-assistance-cliente-info.surge.sh, was observed hosting a page titled “Accès à votre caisse régionale - Crédit Agricole,” explicitly referencing the French banking brand Credit Agricole. The page title, combined with the listed impersonation target, confirms the intent to masquerade as an official Credit Agricole portal. The site was served from the Surge.sh hosting platform, as indicated by the registrar entry and the authoritative name servers ns1.surge.sh and ns2.surge.sh. Network resolution points to the IPv4 address 188.166.132.94, which belongs to the DigitalOcean, LLC network (AS14061) located in the Netherlands.

The TLS certificate presented is a Sectigo RSA Domain Validation certificate issued by Sectigo Limited, which is typical for generic cloud‑hosted sites and does not provide any brand‑specific validation. An HTTP request returned a 404 status, suggesting that the malicious landing page is no longer reachable. Nevertheless, the domain was listed on the PhishDestroy blocklist, and VirusTotal recorded detections from 13 of 95 scanning engines, indicating that multiple security products have flagged the domain as malicious. The current offline status reduces immediate exposure, but the infrastructure—public cloud hosting, a generic SSL certificate, and a domain registered through a free‑tier service—remains reusable for future impersonation campaigns.

Defenders should continue to block the domain at perimeter filters, monitor for any re‑registration or new subdomains under the same hosting provider, and correlate any outbound connections to the IP 188.166.132.94 with internal user activity. Logging DNS queries for the surge.sh namespace can aid early detection of similar campaigns. Because the page content has not been captured, analysts should treat the lack of visible payload as an open question and consider requesting a forensic capture if the domain reappears.