service-assistance-client-ca[.]surge[.]sh

The domain service-assistance-client-ca.surge.sh was observed hosting a site that presented the page title “Accès à votre caisse régionale - Crédit Agricole”, indicating a clear attempt to impersonate the French banking brand Credit Agricole. The domain resolves to the IPv4 address 138.197.235.123, which is allocated to DigitalOcean, LLC (AS14061) and geolocated to the United States. The hosting provider is listed as Surge.sh, and the authoritative nameservers are ns1.surge.sh and ns2.surge.sh. An SSL certificate issued by Sectigo Limited, under the Sectigo RSA Domain Validation Secure Server CA, was detected, confirming that the site was served over HTTPS. HTTP requests to the site returned a 404 status code, suggesting that the malicious landing page may have been removed or is otherwise inaccessible at the time of analysis.

Detection data shows that 13 of 95 security vendors on VirusTotal flagged the domain as malicious, and the site is listed on one external security blocklist. PhishDestroy has also taken action to block the domain. No additional intelligence such as malware payloads, credential‑stealing forms, or redirect behavior has been disclosed, and the exact content of the page beyond the title remains unverified. Given the observed brand impersonation, the presence of a valid TLS certificate, and multiple vendor detections, security teams should add the domain and its associated IP address to web‑filter and firewall blocklists.

Continuous monitoring of the IP range owned by DigitalOcean, AS14061, is advisable, as the infrastructure could be reused for future campaigns. Analysts should also watch for any new DNS records or similar subdomains that reference the same hosting provider, as attackers often recycle assets. The current offline status does not guarantee cessation of activity; threat actors may reactivate the domain or relocate the payload to a new host.