infos3-agricole[.]com

The domain infos3-agricole.com was registered on 12 December 2025 through CNOBIN INFORMATION TECHNOLOGY LIMITED and is currently resolved to the IPv4 address 193.24.123.162, which belongs to AS200593 PROSPERO OOO located in Russia. The authoritative name servers are ned.ns.cloudflare.com and ollie.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No TLS certificate is associated with the host, and an HTTP request returns a 404 page title, suggesting that the site is no longer serving legitimate content. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service.

VirusTotal analysis shows that four of ninety‑five scanning engines have flagged the domain, providing a modest level of detection across independent vendors. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. AlienVault OTX reports the domain in one threat‑intelligence pulse, confirming its presence in external monitoring feeds. The available evidence points to a short‑lived generic phishing campaign that has since been taken offline.

However, the lack of a TLS certificate, the 404 title, and the limited number of detections leave some uncertainty regarding the current activity of the infrastructure. Defenders should continue to block the domain at the DNS and network layers, monitor the associated IP address for any re‑use, and update detection signatures to incorporate the observed indicators, including the registrar, name server pair, and the specific IP range. Ongoing correlation with threat‑intel platforms such as OTX and VirusTotal will help to capture any resurgence of the campaign.