espresso-registration[.]app

This domain, espresso-registration.app, is flagged as an active phishing threat targeting users through a fraudulent Espresso Claim Portal. Registered on February 21, 2026, via NiceNIC International Group Co., Limited, the domain resolves to IP address 104.21.60.213, hosted on Cloudflare’s infrastructure (AS13335). Analysis indicates the site employs HTTP/3 and HSTS, common techniques to enhance perceived legitimacy, while returning a 301 HTTP status, suggesting a redirect to a malicious endpoint. Nameservers bailey.ns.cloudflare.com and morgan.ns.cloudflare.com further confirm Cloudflare’s role in hosting this infrastructure. Security vendors have identified this domain with moderate confidence: 5 out of 95 engines on VirusTotal classify it as malicious, and it appears on two security blocklists. The SSL certificate, issued by Google Trust Services (WE1), aligns with typical phishing campaigns leveraging trusted certificate authorities to bypass initial scrutiny. The page title, Espresso Claim Portal, implies an attempt to impersonate a legitimate claims or rewards system, though no specific brand has been confirmed as the intended target. Defenders should treat this domain as high-risk due to its active status and confirmed phishing indicators. The use of Cloudflare complicates traditional IP-based blocking, necessitating domain-level or certificate-based mitigations. Network monitoring should prioritize detection of redirects to espresso-registration.app, particularly those originating from phishing emails or compromised advertisements. Given the domain’s age and persistent activity, it is unlikely to be a short-lived campaign, warranting continued vigilance and inclusion in threat intelligence feeds.