esnavs-gcc[.]com

This domain, esnavs-gcc.com, is flagged for brand impersonation, specifically targeting the 'across' brand. Analysis indicates no direct evidence of a crypto drainer kit or credential theft payload, but the domain mimics legitimate branding to deceive users. The page title 'E-SNAVS' suggests an attempt to impersonate a service or platform associated with the target brand, likely to facilitate fraudulent transactions or data harvesting. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 50.6.7.251, hosted under AS31898 (Oracle Corporation) in the United States. It was registered on September 08, 2025, through GoDaddy.com, LLC. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while it appears on two security blocklists, including PhishDestroy and PhishingDB. No Google Safe Browsing (GSB) entries were identified at the time of analysis. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. The elevated risk level is justified by the combination of brand impersonation, blocklist presence, and vendor detections. Organizations should monitor for renewed activity, block the domain at the network level, and educate users about recognizing brand impersonation tactics. If the domain resurfaces, further analysis of hosted content and payloads is recommended to determine the full scope of the threat.