credit-agricole-mise-a-jourc[.]surge[.]sh

The domain credit-agricole-mise-a-jourc.surge.sh was observed hosting a page titled “Accès à votre caisse régionale - Crédit Agricole”, indicating a direct attempt to impersonate the French banking brand Credit Agricole. The site was provisioned through the free‑hosting platform Surge.sh, as reflected by the registrar information and the authoritative name servers ns1.surge.sh and ns2.surge.sh. DNS resolution points to the IPv4 address 188.166.132.94, which belongs to Autonomous System AS14061 operated by DigitalOcean, LLC and is geolocated in the Netherlands. An SSL certificate for the domain was issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA, confirming the presence of a valid TLS certificate despite the malicious intent. HTTP probing returned a 404 status code, and the site is currently taken offline, but historical snapshots indicate that the page was reachable before removal.

Threat intelligence aggregators have flagged the domain: Google Safe Browsing classifies it as a social‑engineering threat, and PhishDestroy lists it as blocked. VirusTotal recorded twelve detections out of ninety‑five scanned engines, reinforcing the malicious reputation. The domain appears on a single external blocklist, and Scamadviser assigned a trust score of 1 out of 100, the lowest possible rating. Given the high‑risk classification and the confirmed brand impersonation, defenders should add the fully qualified domain name and its resolving IP address to outbound and inbound filtering rules.

Network‑level controls that block traffic to AS14061 or to the Netherlands‑based IP range can reduce exposure. Security appliances that ingest Google Safe Browsing or VirusTotal feeds will already flag the domain, but explicit rule creation ensures coverage even if external feeds lag. Continuous monitoring of Surge.