esee36[.]it

This domain, esee36.it, is identified as a credential harvesting phishing site targeting French-speaking users, as indicated by its page title 'Page d’accueil.' The domain is currently offline but was actively flagged for malicious activity prior to takedown. No specific brand impersonation has been confirmed, though the generic French-language landing page suggests broad targeting of login credentials. Analysis indicates the domain was registered through Dynadot LLC on February 21, 2026, an anomalous future date likely intended to evade detection. It resolves to the IP address 104.21.38.177, hosted on AS13335 (Cloudflare, Inc.). The domain appears on two security blocklists and is flagged by 16 of 95 security vendors on VirusTotal. Its SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent. Infrastructure analysis reveals the use of Cloudflare’s network, a common tactic to obscure hosting origins and complicate takedown efforts. The domain is currently offline, though residual risk remains due to its recent activity and blocklist presence. Organizations are advised to block the domain and its resolving IP (104.21.38.177) at the perimeter. Security teams should monitor for related indicators, including the anomalous registration date and SSL certificate issuer, to detect potential follow-up campaigns. End-users should be alerted to phishing attempts leveraging French-language landing pages, particularly those hosted on newly registered or suspiciously dated domains.