espresso-tge[.]com

This domain is classified as a high-risk credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure was designed to mimic legitimate authentication portals, likely to exfiltrate sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. The domain's high-risk designation stems from its active exploitation in recent campaigns and detection by multiple security mechanisms. Infrastructure analysis reveals the following technical indicators: the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, and resolves to the IP address 188.114.96.3. Security vendor detections on VirusTotal report 13 out of 95 engines flagging the domain as malicious. The domain appears on three distinct security blocklists and is actively blocked by at least three endpoint protection frameworks. Additional technologies detected include HSTS enforcement, Cloudflare hosting, and HTTP/3 protocol usage, which may have been leveraged to evade traditional detection methods. The page title 'Even geduld...' suggests a temporary holding or redirection page, commonly used in phishing campaigns to delay user suspicion while backend scripts process stolen data. Mitigation for this specific threat type requires immediate action from network administrators and end-users. Network-level protections should include DNS sinkholing for the domain and its associated IP address 188.114.96.3, along with implementation of strict TLS inspection policies to detect and block HSTS-enabled malicious connections. Endpoint devices should be scanned for indicators of compromise, particularly browser artifacts or cached credentials that may have interacted with the domain. Security teams are advised to monitor for unauthorized access attempts using credentials that may have been exposed through this phishing infrastructure. Given the domain's recent creation date and offline status, organizations should investigate potential lateral movement or persistence mechanisms that may have been established during its active period.