corta[.]es

Analysis indicates that corta.es is currently active and classified as a high‑risk brand‑impersonation infrastructure targeting Facebook users. The site presents the page title "Corta - Acortamiento de URL para la nueva generación" and serves HTTP 200 responses over IPv6 address 2001:ba0:219:8f00::1. TLS is provided by a Let's Encrypt certificate (R13). Hosting is identified in Spain under AS8560 IONOS SE, with DNS served by ns1.corta.es and ns2.corta.es and a single MX record (mail.corta.es, priority 10). Technical fingerprints reveal a stack comprising Nginx, PHP, and a web‑hosting control panel, with HTTP Strict Transport Security enabled. Reputation metrics are uniformly low: Gridinsoft and Scamadviser assign a trust score of 1 / 100, and the domain appears on two public blocklists (PhishDestroy, PhishingDB). AlienVault OTX references the domain in sixteen threat pulses, and VirusTotal reports 12 of 95 security vendors flagging it as malicious. The primary uncertainty is the exact content and credential‑harvesting mechanisms used; no visual analysis of the landing page is available. Defenders should treat corta.es as a confirmed phishing source, enforce DNS or proxy blocking, monitor related IP and MX activity, and consider sinkholing the IPv6 address to disrupt further abuse.