sms1-credit-agricole[.]com

The domain sms1-credit-agricole.com was observed as an offline endpoint associated with a generic phishing campaign targeting the Credit Agricole brand. The domain was registered on 13 December 2025 through CNOBIN INFORMATION TECHNOLOGY LIMITED and is hosted on the IP address 193.24.123.162, which belongs to ASN 200593 (PROSPERO OOO) located in Russia. Cloudflare authoritative nameservers casey.ns.cloudflare.com and lily.ns.cloudflare.com resolve the domain, but the site does not present an SSL certificate, indicating that any communication would occur over plain HTTP. An HTTP request to the root URL returned a 404 page title, suggesting that the malicious landing page has been removed or the site has been taken down.

VirusTotal analysis shows that one of ninety‑five security vendors flagged the domain, providing a single detection signal. The domain is listed on a security blocklist maintained by PhishDestroy and appears on one additional blocklist, while Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. The limited detection footprint, combined with the low trust score and blocklist presence, supports an elevated risk rating.

Uncertainty remains regarding the specific phishing kit or payload used, as no further content analysis is available. Defenders should block DNS resolution for sms1-credit-agricole.com, add the associated IP 193.24.123.162 to network‑level deny lists, and monitor for any outbound traffic to the domain or IP. Continuous re‑scanning with multi‑engine services is recommended to capture any future re‑activation, and security teams should alert users of potential credential‑harvesting attempts that reference the Credit Agricole brand.