iberdrolas[.]fans

The domain iberdrolas.fans was registered on March 12, 2026 through Tucows Domains Inc. and is currently reported as offline. Technical fingerprinting shows the site was served from Cloudflare’s network (AS13335) with the IP address 188.114.97.3 located in the United States. The DNS configuration lists the authoritative nameservers hassan.ns.cloudflare.com and ivy.ns.cloudflare.com, confirming Cloudflare as the hosting provider. The site employed Vue.js as its front‑end framework and responded over HTTP/3, indicating a modern web stack.

An SSL certificate issued by Let’s Encrypt (certificate identifier E8) was active at the time of observation, providing HTTPS encryption but offering no assurance of legitimacy. The page title returned by the server was “Login,” and the threat classification supplied in the intelligence is “Credential Phishing.” VirusTotal recorded a single positive detection out of ninety‑four scanning engines, and the domain appears on one external blocklist, specifically PhishDestroy, which has already taken the site down. No additional public blocklists or Safe Browsing entries were noted. While the page content beyond the title has not been captured, the combination of a generic login prompt, modern JavaScript framework, and the credential‑phishing label strongly suggests an attempt to harvest user credentials.

Defenders should add the IP address 188.114.97.3 and the domain iberdrolas.fans to network‑level deny lists, enforce TLS inspection where possible, and monitor for any resurgence of the domain or related subdomains. Continuous re‑scanning with multi‑vendor services is advised to capture any future changes in detection status. The evidence base is limited to the data points listed; further forensic capture of the page payload would be required to confirm the exact phishing payload.