esia-gosuslug[.]com

The domain esia-gosuslug.com was registered by Fewmoretaps OU d/b/a Trustname.com and first observed on July 15, 2026. It resolves to the IPv4 address 45.9.14.18 and is served by four nameservers: ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com. The domain is currently listed as active and has been blocked by the PhishDestroy feed, as well as appearing on a single additional security blocklist. VirusTotal has recorded scans from 91 antivirus and URL‑reputation vendors, none of which have raised a detection; however, the lack of detections does not constitute evidence that the domain is benign. No public information is available regarding SSL certificate details, HTTP response codes, page title, or content analysis, so the specific landing page characteristics remain unknown. Evidence indicates the domain is being used for a generic phishing campaign, but the exact phishing vector, targeted brand, or credential‑capture method has not been disclosed. Defenders should prioritize immediate containment actions: add esia-gosuslug.com and its resolved IP 45.9.14.18 to network and endpoint blocklists, monitor DNS queries for the domain and its four authoritative nameservers, and continue to observe outbound traffic for any attempted connections to the associated IP. Ongoing intelligence gathering should focus on retrieving HTTP headers, SSL details, and page content to refine detection signatures and assess the scope of the phishing operation.