Cybersecurity experts from Cofense have revealed a 19x increase in malicious campaigns using .es domains between Q4 2024 and Q5 2025, making it the third-most abused top-level domain (TLD) after .com and .ru.
Typically reserved for businesses and organizations in Spain, or Spanish-speaking audiences, researchers found nearly 1,400 malicious subdomains across nearly 450 .es base domains between January and May.
An overwhelming majority (99%) of the campaigns involved credential phishing, with most of the remaining 1% delivering remote access trojans (RATs) like ConnectWise RAT, Dark Crystal and XWorm.
.es domains are proving popular for phishing attacksAlthough the rise of .es domains in cyberattacks is noteworthy, attack vectors remain unchanged. Malware was seen to be delivered by C2 nodes or spoofed emails, with most (95%) impersonating Microsoft (an attacker's favorite). Adobe, Google, Docusign and the Social Security Administration made up the top-five most commonly impersonated websites. Email lures often mimicked HR and document-related requests.
Interestingly, the malicious .es subdomains were randomly generated, not crafted manually, making them easier to identify as being fake. Examples include ag7sr[.]fjlabpkgcuo[.]es and gymi8[.]fwpzza[.]es.
Despite researchers suggesting that no similarities can be used to link attacks to a single group, 99% of the malicious .es domains were hosted on Cloudflare.
"If one threat actor or threat actor group were taking advantage of .es TLD domains then it is likely that the brands spoofed in .es TLD campaigns would indicate certain preferences by the threat actors," the researchers wrote.
Cofense explained that "significant restrictions" on the usage of .es TLDs were in place until 2005, adding that the recent rise in .es-related attacks could be a cause for concern, marking a new trend exploiting the authority that country-related TLDs unofficially carry.
You might also likeCybersecurity experts from Cofense have revealed a 19x increase in malicious campaigns using .es domains between Q4 2024 and Q5 2025, making it the third-most abused top-level domain (TLD) after .com and .ru.
Typically reserved for businesses and organizations in Spain, or Spanish-speaking audiences, researchers found nearly 1,400 malicious subdomains across nearly 450 .es base domains between January and May.
An overwhelming majority (99%) of the campaigns involved credential phishing, with most of the remaining 1% delivering remote access trojans (RATs) like ConnectWise RAT, Dark Crystal and XWorm.
.es domains are proving popular for phishing attacksAlthough the rise of .es domains in cyberattacks is noteworthy, attack vectors remain unchanged. Malware was seen to be delivered by C2 nodes or spoofed emails, with most (95%) impersonating Microsoft (an attacker's favorite). Adobe, Google, Docusign and the Social Security Administration made up the top-five most commonly impersonated websites. Email lures often mimicked HR and document-related requests.
Interestingly, the malicious .es subdomains were randomly generated, not crafted manually, making them easier to identify as being fake. Examples include ag7sr[.]fjlabpkgcuo[.]es and gymi8[.]fwpzza[.]es.
Despite researchers suggesting that no similarities can be used to link attacks to a single group, 99% of the malicious .es domains were hosted on Cloudflare.
"If one threat actor or threat actor group were taking advantage of .es TLD domains then it is likely that the brands spoofed in .es TLD campaigns would indicate certain preferences by the threat actors," the researchers wrote.
Cofense explained that "significant restrictions" on the usage of .es TLDs were in place until 2005, adding that the recent rise in .es-related attacks could be a cause for concern, marking a new trend exploiting the authority that country-related TLDs unofficially carry.
You might also likeSpending time on the internet in 2025 is proving to be more difficult than ever before. After all, image generation tools are readily accessible in AI products like ChatGPT, and video generation software like Google's Veo 3 is available to the general public.
We're still at a point in the AI-powered internet journey where I'd argue it's still easy enough to tell what's real and what's not. That said, today's AI image and video tools are more powerful than ever, and the scary thing is: this is the worst they'll ever be.
The other day, while browsing Instagram, I stumbled across a new post from France and Real Madrid soccer superstar, Kylian Mbappé. Widely regarded as one of the best players in the world, the image showcased an incredible bicycle kick he had performed in the Club World Cup quarter-final the night before.
The thing is, while the image appeared normal at first glance, a closer inspection revealed some seriously bad editing, or quite possibly AI image generation.
You see, zoom into the crowd watching Mbappé's acrobatics and you'll see a Picasso-esque abstract work of art, people merging into each other, and something more akin to a horror movie than a soccer field. All of the faces blur together like a nightmare.
Initially, I couldn't quite believe that a social media admin for an Instagram account with over 124 million followers would use AI to enhance an image. But then I thought about it some more, and of course, AI has infiltrated the social profiles of public figures. It's everywhere.
A post shared by Kylian Mbappé (@k.mbappe)
A photo posted by on
What's real anymore?You might be wondering why Kylian Mbappé's social media team used AI to edit this photo in the first place. After all, according to official reports, there were over 76,000 fans in MetLife Stadium for the game.
Since it started a few weeks ago, the FIFA Club World Cup has been plagued with stories of low attendance rates, with one report claiming the tournament had over 1 million empty seats in the group stage alone.
Now, 76,000 is closer to MetLife's 82,500 capacity than some of the other examples of low attendance in the tournament, but considering the terrible photo edits to the crowd, did Mbappé's incredible goal fall into the line of sight of empty seats?
Thinking about the context of the tournament and the badly edited photo, this is the conclusion that I'd feel most comfortable putting forward. After all, sometimes you have to call a spade a spade. Why would anyone play with the crowd capacity other than to fill gaps?
Whether Mbappe's photo was AI-edited or badly edited by a human, the world of photo editing on social media is nothing new. Since the inception of platforms like Facebook and Instagram, we've all had to adapt to the 21st-century way of living, which often includes curating your best angles and happiest moments online.
AI-generated instagram influencer (Image credit: @millasofiafin / Instagram)In the past, influencers would slim down their waists using apps on their iPhones or by manually editing the photo. Now, AI can do it all with the press of a button. And that's not all, AI-edited photos are only the beginning.
Whether that's fully AI-generated influencers scoring brand deals, AI-generated YouTube channels garnering millions of views and subscribers, or AI beauty pageants, we no longer live in a world where it's easy to tell what's real on social media and what's not. The thing is, have we ever been able to? Or is AI just making it easier than ever before to bend reality to fit a narrative?
As someone who has used multiple AI photo editing tools for testing purposes, I'm fairly confident that Mbappé's terrible editing is the work of artificial intelligence, and most probably Apple's mediocre Clean Up tool.
This clear example of heavily-edited photography shines a light, not only on bad editing, but also on the fact that if bad edits slip through the cracks, there's a high chance most of the posts we see aren't actually rooted in real life.
You might also likeSpending time on the internet in 2025 is proving to be more difficult than ever before. After all, image generation tools are readily accessible in AI products like ChatGPT, and video generation software like Google's Veo 3 is available to the general public.
We're still at a point in the AI-powered internet journey where I'd argue it's still easy enough to tell what's real and what's not. That said, today's AI image and video tools are more powerful than ever, and the scary thing is: this is the worst they'll ever be.
The other day, while browsing Instagram, I stumbled across a new post from France and Real Madrid soccer superstar, Kylian Mbappé. Widely regarded as one of the best players in the world, the image showcased an incredible bicycle kick he had performed in the Club World Cup quarter-final the night before.
The thing is, while the image appeared normal at first glance, a closer inspection revealed some seriously bad editing, or quite possibly AI image generation.
You see, zoom into the crowd watching Mbappé's acrobatics and you'll see a Picasso-esque abstract work of art, people merging into each other, and something more akin to a horror movie than a soccer field. All of the faces blur together like a nightmare.
Initially, I couldn't quite believe that a social media admin for an Instagram account with over 124 million followers would use AI to enhance an image. But then I thought about it some more, and of course, AI has infiltrated the social profiles of public figures. It's everywhere.
A post shared by Kylian Mbappé (@k.mbappe)
A photo posted by on
What's real anymore?You might be wondering why Kylian Mbappé's social media team used AI to edit this photo in the first place. After all, according to official reports, there were over 76,000 fans in MetLife Stadium for the game.
Since it started a few weeks ago, the FIFA Club World Cup has been plagued with stories of low attendance rates, with one report claiming the tournament had over 1 million empty seats in the group stage alone.
Now, 76,000 is closer to MetLife's 82,500 capacity than some of the other examples of low attendance in the tournament, but considering the terrible photo edits to the crowd, did Mbappé's incredible goal fall into the line of sight of empty seats?
Thinking about the context of the tournament and the badly edited photo, this is the conclusion that I'd feel most comfortable putting forward. After all, sometimes you have to call a spade a spade. Why would anyone play with the crowd capacity other than to fill gaps?
Whether Mbappe's photo was AI-edited or badly edited by a human, the world of photo editing on social media is nothing new. Since the inception of platforms like Facebook and Instagram, we've all had to adapt to the 21st-century way of living, which often includes curating your best angles and happiest moments online.
AI-generated instagram influencer (Image credit: @millasofiafin / Instagram)In the past, influencers would slim down their waists using apps on their iPhones or by manually editing the photo. Now, AI can do it all with the press of a button. And that's not all, AI-edited photos are only the beginning.
Whether that's fully AI-generated influencers scoring brand deals, AI-generated YouTube channels garnering millions of views and subscribers, or AI beauty pageants, we no longer live in a world where it's easy to tell what's real on social media and what's not. The thing is, have we ever been able to? Or is AI just making it easier than ever before to bend reality to fit a narrative?
As someone who has used multiple AI photo editing tools for testing purposes, I'm fairly confident that Mbappé's terrible editing is the work of artificial intelligence, and most probably Apple's mediocre Clean Up tool.
This clear example of heavily-edited photography shines a light, not only on bad editing, but also on the fact that if bad edits slip through the cracks, there's a high chance most of the posts we see aren't actually rooted in real life.
You might also like