postnorrd-no[.]cfd

This domain, postnorrd-no.cfd, was identified as a brand impersonation targeting PostNord AB. It was registered on November 19, 2025, through Domain International Services Limited. The domain resolves to IP address 45.195.69.164, hosted in Malaysia by AS149440 Evoxt Sdn. Bhd. Its nameservers are ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, and ns4.domainnamedns.com.

The page title retrieved was "Access Denied," indicating the site may have been blocked or taken down before content was fully analyzed. No SSL certificate was present. The domain was flagged by 21 out of 95 security vendors on VirusTotal and appeared on 1 security blocklist. It was also found in 15 AlienVault OTX threat intelligence pulses. The Gridinsoft trust score was 0/100, reflecting high suspicion.

The domain was blocked by PhishDestroy and is currently offline. Defenders should note the domain is tied to a known brand impersonation campaign, but the exact scam type (e.g., credential harvesting or malware distribution) is not confirmed from the data. Given the registration date, hosting in a region not associated with the legitimate brand, and multiple vendor detections, this domain should be considered malicious. No further action is required as it is already offline, but any residual logs or email traffic referencing this domain should be reviewed for potential compromise.