transicionesenergeticaslocales[.]com

Analysis of transicionesenergeticaslocales.com shows a newly‑registered domain created on 11 March 2026 that is actively serving web content (HTTP 200). The site is hosted on IP 192.142.37.229, which resolves to an Autonomous System registered to Ultahost, Inc. in Spain (AS214036). DNS resolution is provided by launch1.spaceship.net and launch2.spaceship.net, confirming that the registrar is Spaceship, Inc. The TLS certificate is issued by Let’s Encrypt (R12), indicating a valid, but freely‑issued, encryption layer. The web server stack consists of Nginx delivering pages that load jQuery and Google Analytics, suggesting a typical content‑delivery configuration rather than a specialized malicious payload.

VirusTotal scans have identified the domain as malicious in 4 out of 91 security vendor engines, providing independent confirmation of suspicious behavior. The domain appears on a single public blocklist and is specifically listed by PhishDestroy, which categorises it as a phishing resource. The visible page title, "Cordoba Clean, Servicios de limpieza en Córdoba," does not match the domain name, a classic indicator of credential‑ harvesting attempts targeting Spanish‑language users.

While the exact phishing template has not been captured, the combination of recent registration, mismatched branding, modest vendor detections, and blocklist inclusion justifies a high‑risk designation. Defenders should immediately block DNS resolution and HTTP traffic to 192.142.37.229, add the domain to web‑filter and email‑gateway deny lists, and monitor for any related C2 patterns. Continuous re‑scanning on VirusTotal and updates from PhishDestroy are advised to capture any escalation in detection counts.