animated-chaja-75d73e[.]netlify[.]app

Analysis dated July 25, 2026 flags the domain animated-chaja-75d73e.netlify.app as a brand-impersonation site targeting Credit Agricole. The page title returned from the server, “Accès à votre caisse régionale – Crédit Agricole,” directly references the financial institution, confirming the impersonation intent. The domain is hosted on Netlify infrastructure; DNS resolution points to the IP address 63.176.8.218, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The SSL certificate presented is issued by DigiCert Inc., specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, indicating the use of a legitimate certificate to increase perceived trustworthiness. HTTP response code 404 suggests the content has been removed, and the overall status is recorded as offline.

Reputation services corroborate the malicious assessment. Scamadviser assigns a trust score of 1 / 100, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the domain, and VirusTotal reports that 14 of 95 scanning engines flagged the host as malicious. The site’s technology fingerprint includes Netlify, HSTS enforcement, and the DigiCert certificate. Nameserver configuration uses dns1.p04.nsone.net and dns2.p04.nsone.net, consistent with Netlify’s default DNS routing.

While the exact payload or credential‑harvesting mechanism cannot be confirmed without a live page snapshot, the combination of a convincing French‑language title, a reputable SSL certificate, and multiple vendor detections indicates a high likelihood of credential‑stealing activity aimed at Credit Agricole customers. Defenders should add the domain to internal blocklists, monitor DNS queries for the associated IP and nameservers, and update web‑filtering rules to deny traffic to the Netlify sub‑domain pattern. Continuous observation of VirusTotal and other threat‑intel feeds is recommended to capture any resurgence or related infrastructure reuse.