Why .es Domains Are Being Exploited in Phishing Attacks
Cybersecurity researchers have uncovered a major trend in recent phishing activity—an unexpected surge in the misuse of .es domains for cyberattacks. Once primarily associated with Spanish businesses, .es has now become the third most exploited top-level domain (TLD) in cybercrime, following .com and .ru. If you're wondering how threat actors are using .es domains and what it means for your digital safety, this post breaks it down. We'll also explore how to recognize and prevent phishing attacks using deceptive domain tricks.
The Rise of .es Domains in Phishing Campaigns
According to security analysts at Cofense, there’s been a 19x quarter-over-quarter increase in phishing campaigns using .es domains between late 2024 and early 2025. Nearly 1,400 malicious subdomains tied to around 450 unique .es domains were detected. A staggering 99% of these were credential phishing attacks, designed to steal logins from unsuspecting users. The remaining 1% distributed remote access trojans (RATs), such as XWorm and ConnectWise RAT, which can silently take control of a victim's device.
Microsoft Tops List of Impersonated Brands
In these malicious campaigns, Microsoft was the most impersonated brand, appearing in 95% of phishing attempts. Other frequently spoofed names included Google, Adobe, DocuSign, and even the U.S. Social Security Administration. Attackers used fake HR requests or document-sharing lures via email to trick users into clicking harmful links. The domains—often random strings like gymi8.fwpzza.es—were automatically generated, making them easier to identify as fraudulent but harder to trace back to a single cybercriminal group.
How to Stay Safe From .es Phishing Attacks
Although the .es domain is now a popular phishing vector, the techniques used remain consistent: spoofed emails, impersonated brands, and malware-delivering links. Most of the malicious .es subdomains were hosted on Cloudflare, but this doesn’t imply Cloudflare’s involvement—it only served as the content delivery network. To protect yourself and your organization, always verify domain names, avoid clicking on unsolicited document links, and enable multi-factor authentication for sensitive accounts.
Comment