msg-secure-esl[.]top

This domain, msg-secure-esl.top, was registered on July 18, 2026, and is actively hosting a credential phishing site targeting ESL Federal Credit Union, as indicated by the page title 'ESL Federal Credit Union - Log in.' Infrastructure analysis reveals the domain resolves to IP address 66.55.66.105 and uses nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com, with registration through NameSilo, LLC. The domain is flagged by one security blocklist (PhishDestroy) and is classified as social engineering by Google Safe Browsing. As of the latest scan, 14 out of 95 security vendors on VirusTotal detect this domain as malicious. Defenders should note that the domain remains active and is likely part of a broader phishing campaign aimed at harvesting login credentials. The short time between registration and detection suggests rapid deployment, a common tactic in phishing operations. While the exact phishing kit or additional infrastructure details are not yet analyzed, the use of DNSOwl nameservers and a recently registered domain aligns with known phishing patterns. Organizations should block the domain and its resolving IP at the network level, monitor for related indicators, and alert users to the threat, particularly those associated with ESL Federal Credit Union.