dargons10[.]es

This domain, dargons10.es, is identified as a generic_phishing site specifically designed to impersonate the legitimate n8n.io workflow automation platform. Analysis indicates the site was crafted to deceive users into submitting sensitive credentials, such as login details or API keys, under the guise of a trusted automation service. The page title, 'n8n.io - Workflow Automation,' directly mirrors the legitimate service, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals concrete indicators of malicious activity. The domain currently resolves to the IP address 172.67.180.36 and has been flagged by 1 out of 95 security vendors on VirusTotal, suggesting limited but targeted detection. It appears on two security blocklists, including PhishDestroy and OISD, further corroborating its malicious nature. The domain is registered through Cloudflare, Inc., a common tactic to obscure ownership and leverage Cloudflare’s infrastructure for anonymity. Additionally, the site employs HTTP/3 and utilizes an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to visitors. Users who have visited dargons10.es or interacted with its content should take immediate remediation steps. First, revoke any credentials or API keys that may have been entered on the site, as these are likely compromised. Conduct a thorough review of systems that may have interacted with the domain, including browser histories and network logs, to identify any unauthorized access or data exfiltration. If automation workflows were configured using the fraudulent site, audit those workflows for malicious modifications or unauthorized integrations. Organizations should also consider implementing additional monitoring for anomalous authentication attempts or unexpected API calls originating from affected accounts.