postale[.]connexion-client[.]com

The domain postale.connexion-client.com was registered on 31 Oct 2025 via Hosting Concepts B.V. d/b/a Registrar.eu and uses OpenProvider name servers (ns1.openprovider.nl, ns2.openprovider.be, ns3.openprovider.eu). DNS resolution points to 141.11.136.50, an address assigned to Virtual Machine Solutions LLC (AS25693) located in the United States. No TLS certificate is presented, meaning the site serves HTTP only. Gridinsoft assigns a trust score of 0/100, indicating extreme lack of credibility.

VirusTotal analysis shows that 16 of 95 scanning engines flag the domain, confirming malicious characteristics. The page title retrieved from the site reads "Connexion à mon espace client - La Banque Postale", suggesting an attempt to impersonate the French banking service La Banque Postale. The domain appears on a single external blocklist and has been specifically blocked by PhishDestroy, reinforcing the phishing assessment. Current status is listed as offline, which may reflect a takedown or temporary removal.

Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the associated IP and name servers, and add the domain to internal blacklists. Because the infrastructure uses a generic hosting provider and a public IP range, threat actors could quickly redeploy similar domains; therefore, detection rules should focus on the observed page title, the combination of OpenProvider name servers, and the low Gridinsoft score. Ongoing threat‑intel feeds should be consulted for any re‑appearance of the IP address or similar naming patterns.