
- Experts observe a 19x quarter-over-quarter rise in .es usage for malicious campaigns
- 99% were credential phishing attacks, with 1% relating to remote access trojans
- Microsoft was by far the most commonly impersonated brand
Cybersecurity experts from Cofense have revealed a 19x increase in malicious campaigns using .es domains between Q4 2024 and Q5 2025, making it the third-most abused top-level domain (TLD) after .com and .ru.