correosprepago[.]bnext[.]es

Analysis of the domain correosprepago.bnext.es indicates that it was registered on February 21, 2026 through Google LLC and is hosted on a Fastly edge network (AS54113) with the IPv6 address 2620:0:890::100. The authoritative nameserver listed is correosprepago.web.app, and the site serves a valid TLS certificate issued by Google Trust Services under the WR3 profile, with HTTP Strict Transport Security (HSTS) enabled. The page currently returns HTTP 200 and presents the title “Mi tarjeta | Correos Prepago”, suggesting an attempt to lure victims with a prepaid‑card theme.

Technical profiling reveals the use of Firebase as a backend platform, together with Google Tag Manager, Google Analytics, Facebook Pixel, Cookiebot, and HTTP/3. These components are commonly observed in phishing kits that harvest credentials and track visitor activity. Reputation services assign a Gridinsoft trust score of 0 out of 100, and the domain appears on three public phishing blocklists (PhishDestroy, Phishunt, PhishingDB). VirusTotal reports that 9 of 95 scanned security vendors flag the domain as malicious, reinforcing the suspicion of active abuse.

The primary threat category is identified as a shipping‑related generic phishing campaign. While the exact content of the landing page has not been publicly disclosed, the combination of a convincing title, the presence of tracking and analytics scripts, and the low trust scores strongly indicate a credential‑harvesting operation aimed at users expecting a prepaid mail service. Defenders should prioritize blocking the domain at network perimeter devices, updating DNS blocklists, and monitoring outbound connections to the associated Fastly IP range. Continuous re‑evaluation is advised, as any changes to the site’s infrastructure or additional detections could alter the risk posture.