verify-claim-esl-org[.]lat

This domain, verify-claim-esl-org.lat, is an active crypto drainer phishing infrastructure impersonating ESL Federal Credit Union. Analysis indicates the site presents a fraudulent login portal under the title 'ESL Federal Credit Union - Log in,' designed to harvest credentials and execute unauthorized cryptocurrency transactions. The threat type is explicitly categorized as a crypto drainer, a specialized form of phishing that targets digital wallet credentials and drains funds upon authentication. No specific drainer kit has been conclusively identified at this time, though the infrastructure aligns with known patterns of malicious credential harvesting followed by automated fund transfers. Infrastructure analysis reveals the domain was registered on July 07, 2026, through Porkbun LLC, a registrar frequently leveraged for short-lived phishing operations. The domain resolves to the IP address 104.225.143.75, which has been flagged in prior threat intelligence reports for hosting multiple phishing campaigns. Google Safe Browsing has classified this domain as phishing, and VirusTotal reports 7 out of 95 security vendors detecting it as malicious. Additional blocklist monitoring indicates the domain remains unlisted on several major threat intelligence feeds, suggesting either recent deployment or evasion tactics. As of the latest verification, verify-claim-esl-org.lat remains active and continues to resolve to the aforementioned IP address. Immediate response actions include recommending network-level blocking of the domain and IP, as well as endpoint protection rules to prevent user interaction. The remaining risk is assessed as high due to the domain's operational status, the specificity of its targeting, and the financial impact associated with crypto drainer attacks. Organizations and individuals are advised to monitor for unauthorized transactions, rotate credentials for any accounts accessed via this domain, and implement multi-factor authentication to mitigate further exposure.