transaction-esl-org[.]top

Analysis as of July 22, 2026 indicates that the domain transaction-esl-org.top remains active after its registration on July 21, 2026 through NameSilo, LLC. The domain resolves to the IPv4 address 66.55.66.105 and is served by the authoritative name servers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com. Google Safe Browsing has flagged the host for social engineering, and 14 of 95 security vendors on VirusTotal have raised detections, confirming a consensus that the site is being used for malicious purposes. The domain is listed on a public security blocklist and has been actively blocked by the PhishDestroy service, demonstrating that at least one dedicated anti‑phishing platform has taken mitigation steps. Publicly available intelligence does not include details such as SSL certificate attributes, HTTP response codes, page titles, or any identified brand that the site may be impersonating.

Consequently, the precise phishing lure and the credential‑harvesting mechanisms remain unknown. The lack of observed content means that automated content‑scraping tools have not yet indexed the page, and no additional contextual indicators have been published. Defenders should treat transaction-esl-org.top as high‑risk infrastructure.

Immediate actions include adding the domain and its resolving IP address to network‑level deny lists, updating URL filtering policies, and ensuring that endpoint protection solutions are configured to block the host based on the existing Google Safe Browsing and VirusTotal detections. Continuous monitoring of the IP address and the associated name servers is recommended, as the infrastructure could be reused for future campaigns. Organizations should also consider sharing any newly observed artifacts with threat‑sharing communities to accelerate collective response.