md1[.]es

The domain md1.es has been identified as a high-risk entity associated with generic phishing activity as of July 21, 2026. Infrastructure analysis reveals that the domain is hosted in France via Dedik Services Limited, with a public IP address of 82.25.63.1. The site serves content over HTTPS with a Let's Encrypt SSL certificate and runs on a stack that includes Ubuntu, Apache HTTP Server, Bootstrap, and jQuery. The domain is operational, responding with HTTP 200, and displays the page title 'MD1.ES : md1.es'.

Threat intelligence correlates this domain with active malicious operations: four out of ninety-one security vendors on VirusTotal flag md1.es as malicious, and it is listed on at least one security blocklist. It is also blocked by PhishDestroy and has been referenced in two AlienVault OTX threat intelligence pulses, further substantiating its risk profile. The presence of Openprovider nameservers (ns1.openprovider.nl, ns2.openprovider.be, ns3.openprovider.eu) is consistent with mass-registered domains frequently leveraged in phishing campaigns.

Although the exact content or targeting of the phishing activity is not detailed in the known intelligence or page title, multiple independent security sources have validated the threat. Defenders are advised to block md1.es at network and endpoint levels, monitor for related infrastructure, and reference the listed threat intelligence sources for further technical details. Continued monitoring is recommended, as the domain remains active at the time of reporting.