service-info-ca[.]surge[.]sh

Analysis of service-info-ca.surge.sh shows a confirmed brand‑impersonation campaign targeting Credit Agricole. The domain resolves to 138.197.235.123, an IP owned by DigitalOcean (AS14061) located in the United States. Hosting is provided through the Surge.sh platform, as indicated by the authoritative nameservers ns1.surge.sh and ns2.surge.sh, and the registration footprint lists Surge.sh as the registrar. The site presents a TLS certificate issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA, confirming that HTTPS is available but offering no additional trust signals beyond standard domain validation.

A page title retrieved from the live endpoint – "Accès à votre caisse régionale - Crédit Agricole" – directly references the targeted brand, reinforcing the impersonation intent. VirusTotal scans have flagged the domain in 13 of 95 security vendor engines, and the URL appears on at least one public blocklist, where it has been actively blocked by PhishDestroy. Current HTTP response is 404, and the site is reported offline, suggesting that the phishing infrastructure may have been taken down or is in a dormant state.

Defenders should continue to block the domain at the DNS and URL filtering layers, add the hosting IP to network‑level deny lists, and monitor other Surge.sh subdomains for similar patterns. Because the content of the page was not captured beyond the title, further forensic collection of any cached pages or request logs would be advisable to confirm the presence of credential‑harvesting forms or additional malicious payloads. Ongoing vigilance is recommended, as the hosting provider’s shared infrastructure could be reused for future impersonation campaigns.