nairaworld[.]ng

This domain, nairaworld.ng, is confirmed as a credential harvesting phishing site targeting users through a fraudulent account creation interface. The page title, 'NairaWorld – Create Account,' suggests an attempt to impersonate a financial or payment service, though no specific legitimate brand name is confirmed. The domain is currently offline, but prior activity indicates a focused effort to collect user credentials under false pretenses. Analysis indicates the domain was flagged by 4 of 95 security vendors on VirusTotal, registered through Leads Globe, and appears on one security blocklist. Infrastructure analysis reveals the domain resolved to IP address 163.61.188.5 and used a Let's Encrypt SSL certificate. The domain was created on April 10, 2026, and has been referenced in one threat intelligence pulse on AlienVault OTX. These indicators align with known phishing infrastructure patterns, particularly the use of free SSL certificates and short-lived domains. The domain is currently offline, but residual risk remains for users who may have interacted with it prior to takedown. Organizations are advised to block the domain and associated IP at perimeter defenses, revoke any active sessions linked to the site, and conduct password resets for affected accounts. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors often reuse infrastructure across campaigns.