optimisation-ca-mabanque[.]surge[.]sh

Analysis of optimisation-ca-mabanque.surge.sh indicates that the domain was used to host a brand‑impersonation page targeting Credit Agricole customers. The site resolved to IP address 138.197.235.123, an address assigned to DigitalOcean, LLC (AS14061) located in the United States. DNS resolution was provided by the default Surge.sh name servers ns1.surge.sh and ns2.surge.sh, confirming that the domain was provisioned through the Surge.sh hosting platform. The TLS certificate presented by the site was issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA, a standard domain‑validated certificate that does not provide any intrinsic assurance of legitimacy. An HTTP request returned a 404 status code, indicating that the page content was no longer accessible at the time of testing, and the overall status of the domain is listed as offline.

The page title captured from the site, "Accès à votre caisse régionale - Crédit Agricole", directly references the targeted financial institution, reinforcing the conclusion that the domain was intended to deceive users into believing they were accessing a legitimate Credit Agricole portal. VirusTotal scans recorded 14 detections out of 95 security vendors, reflecting a moderate level of consensus among scanning engines that the domain exhibits malicious characteristics. The domain appears on a single external security blocklist and has been flagged by the PhishDestroy mitigation service, suggesting that at least one anti‑phishing repository has taken action against it.

While the available evidence confirms the brand‑impersonation intent and outlines the hosting infrastructure, the exact phishing kit or credential‑collection mechanism remains unknown because the site content is no longer reachable.