text-secure-esl[.]top

This domain, text-secure-esl.top, is actively impersonating ESL Federal Credit Union as part of a high-risk credential phishing campaign. Registered on July 18, 2026, through NameSilo, LLC, the domain resolves to IP address 66.55.66.105 and uses nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com. The page title, 'ESL Federal Credit Union - Log in,' directly matches the branding of the legitimate financial institution, indicating a targeted attempt to harvest user credentials. Analysis indicates the domain is flagged by Google Safe Browsing for social engineering and is blocked by PhishDestroy. Seventeen of ninety-five security vendors on VirusTotal have detected this domain as malicious, and it appears on one security blocklist. The infrastructure, including the use of DNSowl nameservers and a recently registered domain, aligns with patterns observed in phishing operations. Defenders should treat this domain as a confirmed threat, block access to 66.55.66.105, and monitor for related indicators of compromise. The exact content of the phishing page remains unanalyzed, but the combination of domain registration details, infrastructure, and detection flags provides sufficient evidence to classify this as an active and credible threat targeting ESL Federal Credit Union customers.