pnbahiadecadiz[.]es

This domain, pnbahiadecadiz.es, is actively flagged as a high-risk credential phishing site targeting users of the PN Bahía de Cádiz portal, as indicated by the page title 'PN Bahía de Cádiz - PN Bahía de Cádiz'. Registered on March 30, 2026, the domain resolves to IP 172.67.193.239, hosted behind Cloudflare infrastructure in Canada, and returns an HTTP 301 redirect status. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, jQuery, and Cloudflare services, including Browser Insights and HTTP/3. The domain is currently listed on one security blocklist and is flagged by 12 of 94 security vendors in available scans, though the specific nature of these detections remains unconfirmed. Nameservers are consistent with Cloudflare (jule.ns.cloudflare.com, toby.ns.cloudflare.com), and the SSL certificate is issued by Google Trust Services (WE1). Defenders should note that the domain's recent registration, use of Cloudflare for obfuscation, and association with a known institutional portal increase the likelihood of targeted credential harvesting. While the exact phishing kit or payload is not yet analysed, the combination of WordPress infrastructure and a 301 redirect suggests an attempt to funnel victims to a secondary malicious endpoint. No evidence of takedown or sinkholing is present as of July 12, 2026, and the domain remains operational. Recommended actions include blocking the domain and IP at network and endpoint levels, monitoring for related subdomains or redirect chains, and reviewing logs for connections to 172.67.193.239. Further analysis of the redirect target and any associated payloads is advised to determine the full scope of the campaign.