verificar-identidad[.]kesug[.]com

Analysis of verificar-identidad.kesug.com, observed on July 24 2026, indicates active infrastructure supporting an account takeover phishing campaign. The domain resolves to IP address 77.72.1.44, which is hosted in Great Britain under ASN 12488 owned by Krystal Hosting Ltd. The hosting provider and location are consistent with a number of previously reported malicious sites that leverage inexpensive shared hosting to conceal malicious activity. Registration data shows the domain was created on August 19 2023 through NameCheap, Inc., and continues to use the default Byet.org name server set (ns1‑ns5.byet.org). The presence of a ZeroSSL ECC Domain Secure Site CA certificate confirms the site is served over HTTPS, a tactic frequently employed to increase victim trust.

HTTP requests return a 200 status code, while the page title currently displays "Domain Suspended," suggesting the original landing page may have been removed or temporarily disabled; no content beyond the title has been captured, leaving the exact phishing payload unknown. Reputation scoring from Gridinsoft rates the domain at 0/100, indicating an extremely low trust rating. VirusTotal scans report that nine of ninety‑three antivirus vendors flag the domain as malicious, reinforcing the suspicion of abuse. The domain is listed on at least one public security blocklist and is actively blocked by the PhishDestroy service, confirming that defensive feeds consider it a threat.

The observed evidence collectively satisfies the criteria for a high‑risk, active phishing site targeting account credentials. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for related command‑and‑control traffic originating from the 77.72.1.44 address.