inverrespusl[.]world

Analysis of inverrespusl.world, created on 21 February 2026 and hosted behind Cloudflare (ASN 13335, United States), indicates a high‑risk generic phishing operation. The domain resolves to IP address 104.21.55.55, is served via Cloudflare’s network and employs the Google Trust Services / WE1 SSL certificate, confirming that TLS termination is handled by the CDN. HTTP requests receive a 302 redirect, a technique commonly used to conceal the final malicious landing page. The page title returned by the server, "Inversiones RESA - Gestión Patrimonial y Soluciones de Inversión," suggests an attempt to impersonate a financial advisory service, though the content of the site has not been publicly examined.

Infrastructure signals include Cloudflare Browser Insights and HTTP/3 support, both typical of legitimate sites but also leveraged by threat actors to blend in with normal traffic. Reputation data shows the domain appears on a single security blocklist and has a Gridinsoft trust score of 0 / 100, indicating an extreme lack of confidence. Five of ninety‑three VirusTotal scanners flagged the domain, reinforcing the suspicion of malicious activity. The registrar listed is NiceNIC International Group Co., Limited, a known bulk registration service often used for short‑lived malicious domains.

PhishDestroy has already blocked the domain, providing an early indicator of its phishing nature. Defenders should add inverrespusl.world to web‑filter allow‑lists as a blocked indicator, monitor outbound connections to the associated IP address, and enforce SSL inspection to capture the redirected payload. Network sensors should flag any HTTP 302 responses from this domain, and endpoint security tools should treat any files or scripts downloaded after the redirect as suspicious. Continuous threat‑intel feeds should be consulted for updates, as the current evidence base is limited to infrastructure and reputation signals; no content‑level analysis has yet been published.