rappel5-agricole[.]com

This domain, rappel5-agricole.com, operates as an active credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. The site mimics legitimate agricultural or financial service portals, presenting fraudulent login interfaces that capture usernames, passwords, and potentially multi-factor authentication codes. Users who interact with this domain risk unauthorized account access, financial fraud, and identity theft, as stolen credentials are frequently exploited for further malicious activities, including unauthorized transactions or lateral movement within compromised networks. Analysis indicates the domain was registered on December 11, 2025, through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar historically associated with high volumes of suspicious domains. The domain resolves to the IP address 198.18.1.88, which has been observed in prior phishing campaigns targeting sector-specific services. As of the latest assessment, 6 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while it also appears on at least one security blocklist. Notably, the domain lacks an SSL certificate, increasing the likelihood of interception of submitted data and further confirming its fraudulent nature. Users who have visited rappel5-agricole.com or entered credentials on the site should immediately take corrective action. First, revoke any active sessions and change passwords for all accounts where the same credentials may have been reused. Enable multi-factor authentication on critical accounts to mitigate unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions. If organizational credentials were exposed, notify internal security teams to initiate incident response protocols. Finally, report the domain to relevant cybersecurity authorities or threat intelligence platforms to aid in broader mitigation efforts.