Author: admin

A new report out today from phishing defense company Cofense Inc. reveals a dramatic rise in malicious activity leveraging Spain’s .es top-level domain, marking a shift in tactics among phishing operators targeting enterprise users.

According to the research from Max Gannon and Jacob Malimban from Cofense’s Intelligence Team, the use of the .es TLD in credential phishing campaigns surged by a whopping 19 times from the fourth quarter of 2024 through to the end of the first quarter of this year. The surge in the use of .es saw the TLD enter the top three most abused domains for phishing, behind only .com and .ru.

The .es domain is officially intended for Spanish-speaking audiences, but threat actors seemingly don’t care and are increasingly using it to disguise malicious content. The researchers note that the abuse isn’t isolated to a specific group either, as a broad cross-section of phishing campaigns has adopted .es domains to host second-stage phishing pages — sites users are redirected to after clicking on email links.

The sites are often used to harvest login credentials or distribute remote access tools such as XWorm and Dark Crystal RAT. A RAT is a type of malware that allows attackers to secretly control a victim’s computer or network remotely.

Though the surging use of .es TLDs is perhaps surprising, what isn’t is the company the threat actors are impersonating: Microsoft Corp. and its various services. Some 95% of the phishing campaigns using the .es TLD are impersonating Microsoft services such as Outlook. Bringing up the rear, other companies being impersonated include Adobe Inc., Google LLC, and Docusign Inc., though at much lower rates. The campaigns often feature highly polished emails and convincing login pages hosted on pseudo-randomly generated subdomains under .es domains.

In an interesting twist, the researchers also claim that nearly all of these malicious .es domains — about 99% — are hosted on Cloudflare Inc.’s infrastructure, often using Cloudflare Turnstile CAPTCHA for added legitimacy. That raises questions about how easily threat actors are leveraging modern deployment tools such as Cloudflare Pages to spin up malicious content quickly.

“While Cloudflare has recently made deploying a web page quick and easy via command line with pages hosted on [.]pages[.]dev it is unclear whether their recent move to making domains hosted by them easy to deploy has attracted threat actors to their hosting services across different platforms or if there are other reasons, such as how strict or lenient Cloudflare is with abuse complaints,” the researchers write.

The report emphasizes that the use of dynamically generated subdomains that are typically random strings rather than human-readable names is a common trait of these campaigns. Examples include domains like gymi8.fwpzza.es, making them harder for casual users to identify as suspicious.

Cofense warns that organizations should be alert to this shift in TLD abuse and adapt their detection strategies accordingly, particularly focusing on subdomain monitoring and more nuanced brand spoofing detection. As phishing tactics evolve, domain abuse patterns continue to be an early warning signal for threat activity.

Image: SiliconANGLE/Reve

Come forth protectors of Sharval! From July 7–23, 3 a.m. server time, the Diablo Immortal Druid Trial Race is your chance to show your devotion to Sanctuary in a fierce, time-based dungeon challenge.

Players who accept the challenge from the in-game event hub must run a hellish version of Mad King’s Breach while playing as the Druid. Your goal? Cut through hordes of the Burning Hell’s foot soldiers and their deranged king as quickly as possible. You will be ranked based on your fastest clear time, with ties decided by highest damage output in that run.

Each week of the competition, the top 200 players from each server will receive one random Legendary item and one random Set item delivered via in-game mail. And once the competition ends, the mightiest Druid—the number one ranked player worldwide—will assist in naming a future Legendary item.

Attune to nature’s might, center your primal sensibilities, and enter the fray. May success find you!

See the current leaderboard rankings on the official Diablo X account. They will be updated every Monday and Thursday at 7 p.m. PDT.

To get a full overview of the Druid ahead of the race, including its skills and affixes, visit this article.

[Terms and Conditions]