jean-luc-assistant-ca[.]surge[.]sh

On July 24, 2026, the domain jean-luc-assistant-ca.surge.sh was flagged for brand impersonation, specifically targeting Credit Agricole. The domain is currently offline, with its HTTP status returning a 404 error, indicating that the requested page does not exist. The site's infrastructure analysis reveals that it is hosted on an IP address located in the United States, specifically 138.197.235.123, under the control of DigitalOcean, LLC (AS14061). The domain was registered through Surge.sh, and its nameservers are ns1.surge.sh and ns2.surge.sh.

The SSL certificate for the domain is issued by Sectigo Limited, through the Sectigo RSA Domain Validation Secure Server CA, which provides a basic level of trust and encryption. However, the presence of a valid SSL certificate does not mitigate the risk of phishing, as it can be obtained by malicious actors. According to available intelligence, the domain appears on one security blocklist and is blocked by PhishDestroy, a known security service. The page title found for the domain is 'Accès à votre caisse régionale - Crédit Agricole,' which closely mimics the official Credit Agricole page title, suggesting an attempt to deceive users into believing they are accessing a legitimate Credit Agricole service.

While the domain has been taken offline, the threat of brand impersonation remains relevant, and security teams should remain vigilant. Defenders are advised to monitor for any resurfacing of the domain and to verify that internal blocklists and security tools are updated to include jean-luc-assistant-ca.surge.sh. Users should be educated to recognize and report such impersonations, and to always verify the legitimacy of websites, especially those purporting to represent financial institutions.