credit-agricole-filtre-exagone[.]iceiy[.]com

credit-agricole-filtre-exagone.iceiy.com is currently listed as an active generic phishing infrastructure with a high risk rating. The domain was registered through Porkbun LLC on 2020-12-06 and resolves to the IPv4 address 185.27.134.205, which is hosted in the United Kingdom by I FastNet LTD. DNS resolution is served by the byet.org name server cluster (ns1–ns5.byet.org). Multiple security aggregators have flagged the domain: VirusTotal reports 11 of 91 antivirus and URL‑reputation engines flagging it, and both PhishDestroy and OpenPhish have added it to their blocklists, bringing the total number of public blocklists to at least two.

Passive fingerprinting of the web server reveals a stack comprising Nginx with OpenResty, PHP, Java, Adobe Experience Manager, and jQuery, indicating a potentially complex back‑end capable of serving dynamic content. No public page title or SSL certificate details have been disclosed, and no HTTP response codes have been observed, leaving the exact phishing lure and payload unknown. The presence of Adobe Experience Manager and Java suggests the actors may be leveraging a compromised content‑management platform to host credential‑harvesting pages. Defenders should tag the IP address 185.27.134.205 as malicious, enforce outbound filtering for the domain, and ensure that any internal DNS resolvers block or sinkhole requests to credit-agricole-filtre-exagone.iceiy.com.

Continuous monitoring of the associated name servers and the hosting provider is advised, as the adversary could shift to additional IPs or sub‑domains. Aggregating telemetry from endpoint protection products that report the 11 detections can improve detection confidence. Until a detailed page analysis is performed, the precise phishing vector remains uncertain, but the existing technical indicators warrant immediate containment and proactive blocking.