# PhishDestroy domain threat record: swiss.mubarcanarias.es

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/swiss.mubarcanarias.es/
Machine-readable companion: https://phishdestroy.io/domain/swiss.mubarcanarias.es/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-17 17:26:31 UTC
- Last availability or vendor check: 2026-10-22 22:46:04 UTC
- Stored record updated: 2026-10-22 22:46:04 UTC
- VirusTotal detections in the stored snapshot: 9/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 185.129.249.99
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a14ae5-f78b-70e8-9409-8f844f1a231e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/swiss.mubarcanarias.es
- Certificate Transparency search: https://crt.sh/?q=%25.swiss.mubarcanarias.es
- Web Archive lookup: https://web.archive.org/web/*/https://swiss.mubarcanarias.es/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
swiss.mubarcanarias.es is an active impersonation phishing site that pretends to be the SwissPass service. It targets users of the SwissPass brand, likely seeking login credentials. PhishDestroy first recorded the domain on 2026-10-17. The site was still live with its malicious content as of the last check on 2026-10-19.

How the scam works
The page title displayed in the browser is “swisspass.ch”, reinforcing the illusion of a legitimate SwissPass portal. Victims are prompted to enter personal or wallet credentials that are then captured by the attackers. Collected data can be used to hijack accounts, drain wallets, or sell the information on underground markets.

Evidence
VirusTotal scanned the domain with 92 engines and flagged it as malicious in 9 scans, including detections from BitDefender, DNS8, ESET, Forcepoint ThreatSeeker, G‑Data, Kaspersky, OpenPhish and SOCRadar. PhishDestroy added the domain to its blocklist, and Spamhaus listed it in the DBL_ABUSED_PHISH category. These independent signals confirm the impersonation phishing nature of the site.

Infrastructure
The domain’s registrar information is not publicly available. Hosting resides on IP 185.129.249.99 within the AXARNET COMUNICACIONES, S.L. network (AS50926) located in Spain. TLS certificates are issued by Let’s Encrypt (YR1), indicating the site uses a valid, automated HTTPS certificate.

What to do
If you visited the site, immediately change any SwissPass passwords and revoke any wallet approvals that may have been granted. Monitor your accounts for unauthorized activity and report the incident to the legitimate SwissPass service. Security teams should block the domain at the DNS and firewall level, add it to internal phishing blocklists, and share the indicator with industry threat‑sharing groups.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a14ae5-f78b-70e8-9409-8f844f1a231e/
VirusTotal report: https://www.virustotal.com/gui/domain/swiss.mubarcanarias.es
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=swiss.mubarcanarias.es
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:10:43 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/XxyCkZ9k/c0ddd4f3a3c4.png
  Captured: 2026-10-17 17:26:31 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a14ae5-f78b-70e8-9409-8f844f1a231e.png
  Captured: 2026-10-17 17:26:31 UTC
  Source report: https://urlscan.io/result/01a14ae5-f78b-70e8-9409-8f844f1a231e/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0ccb07f5-11dd-4d4d-b0f1-f42080d08bae.png
  Captured: 2026-10-17 17:58:14 UTC
  Source report: https://radar.cloudflare.com/scan/0ccb07f5-11dd-4d4d-b0f1-f42080d08bae
  SHA-256: 5b685b6fd0c356b8389e33596a40c60d2f63ca6aac5f9ec6250f109105361924
- URLQuery: https://screenshots.phishdestroy.io/uq/5b742b9b-19a0-4305-bd69-52509a7bde88.png
  Source report: https://urlquery.net/report/5b742b9b-19a0-4305-bd69-52509a7bde88
  SHA-256: b16819377428d330ff5eae4e84773e40a2136507bad1d83aa3e2598a593579f8
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a149ae-905f-7239-a521-48d901966e33.png
  Captured: 2026-10-17 11:45:51 UTC
  Source report: https://urlscan.io/result/01a149ae-905f-7239-a521-48d901966e33/
  SHA-256: cdecb2771fb56291cf7d712e151597abc7fbfda8fc1df278e648ddf21a118bef
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a149f3-82cc-7686-bdf6-2d3f070e5ada.png
  Captured: 2026-10-17 13:01:07 UTC
  Source report: https://urlscan.io/result/01a149f3-82cc-7686-bdf6-2d3f070e5ada/
  SHA-256: f6fe4ac5447fd0d388e650a5561835fcab04a7eacd7130f1b3a72ba92f5ec93d
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a2f-f372-71fd-9245-5b8abda504f6.png
  Captured: 2026-10-17 14:07:08 UTC
  Source report: https://urlscan.io/result/01a14a2f-f372-71fd-9245-5b8abda504f6/
  SHA-256: ef9a13648bbb267e0e43a583ac62cd689d9b4facf30a9622b06f0175370f0aa5
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14ae9-6ffe-746f-9f27-4c37d8e01061.png
  Captured: 2026-10-17 17:29:47 UTC
  Source report: https://urlscan.io/result/01a14ae9-6ffe-746f-9f27-4c37d8e01061/
  SHA-256: 61549a366843f1d4d3d4f003282c2e5ba79deefb68ab0fc691d724464f575b25
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14d93-ac08-70a5-8eeb-5c6ea089d60f.png
  Captured: 2026-10-18 05:54:55 UTC
  Source report: https://urlscan.io/result/01a14d93-ac08-70a5-8eeb-5c6ea089d60f/
  SHA-256: f4d74a8114b94d830411790a37e613f5d936e23df807e61256876ab8eeb2af6d
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15477-9096-740d-b131-521c01424873.png
  Captured: 2026-10-19 14:01:36 UTC
  Source report: https://urlscan.io/result/01a15477-9096-740d-b131-521c01424873/
  SHA-256: ebbb7979be4ac923889958c73c1279b326f51a1e29de43e473744e3c27233873

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T16:46:44Z",
        "uuid": "01a14ae5-f78b-70e8-9409-8f844f1a231e",
        "scanned_at": "2026-10-17T17:25:58Z",
        "final_url": "https://www.swisspass.ch/",
        "status": 403,
        "redirected": "off-domain",
        "redirects": [
            {
                "to": "https://swiss.mubarcanarias.es/",
                "from": "http://swiss.mubarcanarias.es/",
                "status": 307
            },
            {
                "to": "https://www.swisspass.ch/",
                "from": "https://swiss.mubarcanarias.es/"
            },
            {
                "to": "https://www.swisspass.ch/",
                "from": "https://www.swisspass.ch/",
                "status": 307
            }
        ],
        "ip": "2a06:98c1:3200::90:80",
        "domains": [
            "swiss.mubarcanarias.es",
            "challenges.cloudflare.com"
        ],
        "ips": [
            "104.18.95.41",
            "104.18.94.41",
            "2a06:98c1:3200::90:80",
            "185.129.249.99"
        ],
        "asns": [
            "13335",
            "50926"
        ],
        "countries": [
            "ES"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "da42ab74906c79968be1716a2fa118c778c6ace1c23b7b67c14fed26d0afc85f",
        "script_hashes": [
            "839fa888ac3bf309252f3a5005aeef56335cbaf24fd04f581ac90b8ea13bf68c"
        ],
        "globals": [
            "_cf_chl_opt",
            "runProgram",
            "vUAjb0",
            "zCGb4",
            "AGRfA7",
            "qrht8",
            "LeviO5",
            "qpPe1",
            "atAFr0",
            "SABtz7",
            "FIac3",
            "RpzJz6",
            "QSqpx9",
            "ueZh9",
            "FBBK4",
            "ZliED2",
            "HKul9",
            "NmGWd6",
            "THirw9",
            "IXEYu6",
            "nOLY0",
            "DraY9",
            "vyix0",
            "uEeN6",
            "nTlR0",
            "AwUcP3",
            "MkvrI5",
            "MpSwI7",
            "xrbo0",
            "vMhC1",
            "angular",
            "vvfHL3",
            "lffN9",
            "dSvRK1",
            "turnstile",
            "QBEM0",
            "AgLL2",
            "wEyW4",
            "THSr2"
        ],
        "cookies": [
            "__portal_auth",
            "i18n_redirected",
            "__cf_bm"
        ],
        "tls": {
            "san": [
                "swiss.mubarcanarias.es",
                "www.swiss.mubarcanarias.es"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "swiss.mubarcanarias.es",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-14T08:30:24Z",
            "valid_from": "2026-10-16T08:30:25Z"
        },
        "domain_age_days": 4324,
        "apex_age_days": 4165,
        "tls_age_days": 4,
        "tls_valid_days": 90,
        "requests": 31,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -92,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:57:25Z",
        "uuid": "0ccb07f5-11dd-4d4d-b0f1-f42080d08bae",
        "scanned_at": "2026-10-17T17:58:14Z",
        "final_url": "https://www.swisspass.ch/",
        "status": 200,
        "history": [
            {
                "url": "https://swiss.mubarcanarias.es/",
                "status": 200
            },
            {
                "url": "https://www.swisspass.ch/",
                "status": 200
            }
        ],
        "dom_hash": "0243a198e38e558fc04b4143620827affb1ed9fec9d98c5c33e444227f028349",
        "doc_hash": "da42ab74906c79968be1716a2fa118c778c6ace1c23b7b67c14fed26d0afc85f",
        "domain_risks": [
            "Travel"
        ],
        "radar_rank": {
            "bucket": "200000"
        },
        "dns": [
            {
                "name": "www.swisspass.ch",
                "type": "CNAME",
                "value": "www.swisspass.ch.cdn.cloudflare.net"
            },
            {
                "name": "www.swisspass.ch",
                "type": "CNAME",
                "value": "www.swisspass.ch.cdn.cloudflare.net"
            }
        ],
        "dnssec_valid": false,
        "ip": "141.101.90.107"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T18:52:36Z",
        "analysis_at": "2026-10-18T16:48:26Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 9,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "phishing",
            "G-Data": "phishing",
            "Sophos": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "OpenPhish": "phishing",
            "BitDefender": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-10-16T10:46:29Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:185.129.249.99 ~all"
            },
            {
                "ttl": 13156,
                "type": "A",
                "value": "185.129.249.99"
            }
        ],
        "dns_at": "2026-10-18T16:48:44Z",
        "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b",
        "cert": {
            "san": [
                "swiss.mubarcanarias.es",
                "www.swiss.mubarcanarias.es"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "68676d6ab31aed22a7e776689020b8a4268",
            "sha256": "a471a8ac58e8c33f7ee1edbbf0e169733a7c11887948cd1f63ed9e1535bbe883",
            "subject": "swiss.mubarcanarias.es",
            "valid_to": "2027-01-14T08:30:24Z",
            "valid_from": "2026-10-16T08:30:25Z"
        }
    }
}
```