epnicaragua[.]org

The domain epnicaragua.org is currently classified as a high‑risk generic phishing site and remains active as of 12 July 2026. The public‑facing page returns HTTP 200 and presents the title “Empresa Portuaria Nacional – EPN”, a brand impersonation that suggests credential harvesting aimed at the Ecuadorian port authority. The risk level assigned by the reporting system reflects the combination of observed malicious activity and the low trust indicators associated with the site.

Technical infrastructure analysis shows the domain was registered on 9 October 2025 through INWX GmbH and is served from the IP address 159.198.74.107, which belongs to AS22612, a Namecheap, Inc. network located in the United States. The site uses a Let's Encrypt certificate (R13) issued to epnicaragua.org, confirming the presence of TLS but offering no assurance of legitimacy. Authoritative name servers are ns.inwx.com, ns2.inwx.com and ns3.inwx.eu, all consistent with the registrar.

Threat intelligence sources corroborate the phishing classification. VirusTotal records indicate that 3 of 95 scanned security vendors flagged the domain as malicious. AlienVault OTX lists the domain in four separate threat pulses, and PhishDestroy has already blocked it, while a single public blocklist also lists the address. The Gridinsoft trust score is 0 out of 100, reinforcing the conclusion that the site is untrusted.

Defenders should prioritize blocking traffic to epnicaragua.org at network perimeters and updating endpoint detection rules to flag any HTTP or TLS connections to the domain. Incident response teams should monitor for credential submissions that match the “Empresa Portuaria Nacional” brand, as compromised accounts may be leveraged in further attacks. Continuous monitoring of the associated IP range and the INWX name servers is advised, given the recent registration date and the active status of the site.