e67vm91sgf17[.]trickle[.]host

The domain e67vm91sgf17.trickle.host was registered on 7 November 2023 through Amazon Registrar, Inc. It resolves to the IPv4 address 13.225.196.86, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Canada. DNS resolution is provided by four Amazon Route 53 name servers: ns-1093.awsdns-08.org, ns-1490.awsdns-58.org, ns-1610.awsdns-09.co.uk, and ns-1662.awsdns-... . The TLS certificate presented by the host is issued to "Amazon" and uses the Amazon RSA 2048 M04 CA, confirming the use of Amazon Web Services infrastructure.

HTTP probing returned a 404 status code, indicating that the expected resource is not present or has been removed. The site’s page title, as observed in the last crawl, is "Identifiez-vous - Orange," suggesting an attempt to impersonate the French telecommunications provider Orange. Automated scanning on VirusTotal recorded 19 positive detections out of 93 participating security vendors, reinforcing the suspicion of malicious intent. The domain is listed on a single public security blocklist and has been actively blocked by the PhishDestroy mitigation service.

Infrastructure fingerprinting shows deployment of Amazon S3 and Amazon CloudFront, typical of temporary hosting used for phishing campaigns. As of the report date 23 July 2026, the domain is reported offline, but its recent activity and detection history warrant continued monitoring. Defenders should ensure that outbound traffic to 13.225.196.86 is denied, add the domain to internal blocklists, and watch for any re‑registration or similar sub‑domains that reuse the same naming pattern. Incident response teams should also correlate any credential‑theft alerts referencing the "Identifiez‑vous - Orange" title with this indicator of compromise to improve detection coverage.