verifyspain[.]com

Analysis of www.verifyspain.com indicates a newly registered credential phishing site that impersonates the Telegram brand. The domain was created on February 21, 2026 and registered through Spaceship, Inc., using the authoritative nameservers launch1.spaceship.net and launch2.spaceship.net. DNS resolution points to IP address 66.29.148.143, which belongs to AS22612 (Namecheap, Inc.) and is geolocated in the United States. The web server presents a Let’s Encrypt R13 TLS certificate, confirming that HTTPS was active when the site was online. The page title retrieved during the brief active period reads "KYC Hub — Escríbenos en Telegramie," reinforcing the claim of a Telegram-related KYC service.

Detected server technology includes LiteSpeed web server and a Facebook Pixel, a common tracker employed by many phishing kits. The site was classified as a credential phishing operation targeting Telegram users, consistent with the brand impersonation label. Threat intelligence sources show the domain appears on a single security blocklist and was blocked by PhishDestroy. AlienVault OTX reports one pulse referencing the domain, and VirusTotal recorded three detections out of ninety-three scanners, indicating that multiple security vendors flagged the infrastructure as malicious. Gridinsoft assigned a trust score of 0 out of 100, underscoring the high likelihood of malicious intent.

Current HTTP status is offline, but the historical evidence suggests the site was intentionally taken down after detection. Defenders should continue to monitor the IP address 66.29.148.143 for any reactivation, enforce blocking of the domain at perimeter defenses, and update URL filtering rules to include the domain and its known IP. Users should be warned that unsolicited messages directing them to a "KYC Hub" on Telegram are likely fraudulent, and credential submission to such pages should be prohibited.