filezilla[.]com[.]es

The domain filezilla.com.es was flagged on July 12, 2026 as part of a brand‑impersonation campaign targeting Adobe. The listing originates from PhishDestroy, which classifies the site as an impersonation of the Adobe brand. The site returns HTTP 200 and presents a valid TLS certificate from Let’s Encrypt (R12). The page title observed is “▷ FileZilla en Español | FTP seguro y gratis para todos”, which bears no direct reference to Adobe.

Infrastructure analysis shows the domain is hosted on an IP address 50.31.188.69 located in the United States and associated with autonomous system AS23352 (DEFT.COM). The authoritative name servers are ns4938.banahosting.com and ns4939.banahosting.com. The web stack reports WordPress, MySQL, PHP, Yoast SEO, LiteSpeed, jQuery and Google Analytics, indicating a typical content‑management deployment rather than a bespoke credential‑harvesting platform.

The primary malicious indicator is the brand‑impersonation label applied by PhishDestroy, suggesting the site may be used to lure Adobe users. No malicious payloads have been reported by VirusTotal (0/95 detections) and the domain appears on a single security blocklist, leaving the presence of active phishing forms unconfirmed. The discrepancy between the Adobe impersonation claim and the FileZilla‑related page title introduces uncertainty about the exact lure used.

Defenders should block network traffic to 50.31.188.69 and to the domain filezilla.com.es at perimeter devices. Email security gateways should add the domain to suspicious sender lists to prevent credential‑stealing attempts. Continuous monitoring of the IP and name‑server resolution is advised, as changes in the hosting environment may indicate escalation. Incident response teams should treat any credential submissions to this domain as potentially compromised and enforce immediate password resets for affected Adobe accounts.