aii-ib-chuirokin-or-jp[.]net

The domain aii-ib-chuirokin-or-jp.net is identified as a credential theft operation specifically impersonating Nomura Securities, a major Japanese financial services provider. Analysis confirms the site is currently offline, though it previously presented a login interface mimicking the legitimate Nomura Securities portal, as indicated by the page title 'ログイン | 野村證券'. This infrastructure was designed to harvest user credentials, posing a severe risk to individuals attempting to access financial services through the fraudulent interface. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on December 02, 2025, through Aceville Pte. Ltd., and resolves to the IP address 34.97.159.198, hosted within Google LLC’s AS396982 in Japan. Security vendors have flagged this domain as malicious, with 21 of 95 VirusTotal vendors marking it as a threat. Additionally, the domain appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB. The absence of an SSL certificate further undermines its legitimacy, as secure financial platforms universally employ encryption. Given the domain’s current offline status, it may have been taken down due to enforcement actions or operational changes by the threat actors. However, users who previously interacted with this site should immediately change their Nomura Securities credentials and monitor their accounts for unauthorized activity. Organizations are advised to block the domain and its associated IP address (34.97.159.198) at the network level to prevent potential access. Continuous monitoring for similar impersonation domains is recommended, particularly those mimicking financial institutions with slight variations in spelling or structure.