ensdomain[.]online[.]mou-euro[.]online

Analysis indicates that the domain ensdomain.online.mou-euro.online is presently active and has been classified as a generic phishing source. Registration records show the domain was created through Ultahost, Inc., and the authoritative name servers are ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, and ns4.ultahost.com, suggesting the hosting provider controls the DNS resolution. An HTTP request to the root URL returns a 301 redirect, a pattern often used to forward victims to a credential‑harvesting page or to hide the final landing site. The domain is listed on a single external blocklist and has been added to the PhishDestroy blocklist, confirming that at least one anti‑phishing service has observed malicious activity associated with it.

VirusTotal scans report that two out of ninety‑one security vendors have flagged the domain, providing limited but corroborating evidence of abuse. No additional public intelligence such as Safe Browsing alerts, OTX tags, or SSL certificate details are presently available, leaving the exact content and target brand of the phishing campaign unknown. Defenders should continue to monitor the domain for changes in HTTP response codes, new blocklist entries, or increased detection counts.

Network‑level controls can be employed to block resolution of the four Ultahost name servers, and security appliances should be configured to deny traffic to the domain while logging any attempted connections. Incident response teams should treat any observed authentication attempts to services that match the domain as potentially compromised and advise users to change credentials if they have interacted with the site. Ongoing collection of threat‑intel feeds is recommended to capture any future attribution or payload details that may emerge.