aquapark-canarias[.]com

This domain, aquapark-canarias.com, is currently under investigation for credential theft activity impersonating HafenStadt Hamburg, a recognized urban development brand in Germany. The site presents itself as an official portal for HafenStadt Hamburg, a tactic commonly employed to deceive users into submitting sensitive login credentials, personal data, or financial information under false pretenses. Analysis indicates the domain remains active and continues to resolve, posing an ongoing risk to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on June 15, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk registrations. It resolves to the IP address 31.76.87.247, which has been linked to other suspicious domains in recent threat intelligence reports. The domain appears on one security blocklist and was referenced in one AlienVault OTX threat intelligence pulse, suggesting early detection by automated systems. Despite these indicators, the domain has not yet been flagged by any of the 95 vendors monitored by VirusTotal, highlighting a potential gap in detection coverage or the use of evasion techniques to avoid initial scrutiny. Current status confirms the domain remains active, with the page title explicitly displaying 'HafenStadt Hamburg' to reinforce the impersonation scheme. Given the lack of detections on VirusTotal and the domain's recent registration, this infrastructure may represent a low-volume or targeted campaign designed to evade broader detection. Organizations and individuals are advised to block the domain and its associated IP address at the network perimeter. Users should be educated to verify the legitimacy of any site claiming affiliation with HafenStadt Hamburg, particularly those requesting credentials or personal data. Monitoring for additional indicators of compromise, such as unusual login attempts or data exfiltration patterns, is recommended for entities that may have been exposed.