bbva[.]es-web-avisos[.]com

PhishDestroy identifies bbva.es-web-avisos.com as a brand impersonation threat targeting Facebook, currently classified as elevated risk and taken offline. This domain was created on February 21, 2026, and resolves to IP address 77.73.203.99. It attempts to deceive users by mimicking the Facebook brand, likely for credential theft or other malicious purposes.

The domain is flagged by 9 out of 95 VirusTotal security vendors, indicating moderate detection across the industry. Its SSL certificate is issued by Entrust OV TLS Issuing RSA CA 1. It appears on only 1 security blocklist, suggesting it may have evaded broader detection until recently. The page title observed, "¿Qué es el phishing y cómo evitarlo? ¡No piques! - Cliente Bancario, Banco de España," is ironic as it educates about phishing while itself being a phishing site. The domain is registered via an undisclosed registrar, and its creation date is recent, further supporting its malicious nature.

Currently, the domain is offline, which mitigates immediate risk. However, organizations should monitor for similar domains and educate users about brand impersonation tactics. PhishDestroy recommends blocking this domain and any associated IP addresses at the network level, and conducting awareness training to help users recognize such threats. Users who may have interacted with the site should change passwords and enable multi-factor authentication on affected accounts.