# PhishDestroy domain threat record: utility.nrs.com.ng Content language: English Canonical HTML report: https://phishdestroy.io/domain/utility.nrs.com.ng/ Machine-readable companion: https://phishdestroy.io/domain/utility.nrs.com.ng/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-09 06:17:11 UTC - Last availability or vendor check: 2026-10-22 10:34:02 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 6/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 163.61.188.7 - Registrar in stored WHOIS data: Leads Globe - Registrar country in stored WHOIS data: NG - Last stored HTTP status: 200 - Registration date (registry RDAP, nrs.com.ng): 2026-09-08 09:05:52 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a084cf-6dcd-74f3-a337-ccf83a7daaff/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/utility.nrs.com.ng - Certificate Transparency search: https://crt.sh/?q=%25.utility.nrs.com.ng - Web Archive lookup: https://web.archive.org/web/*/https://utility.nrs.com.ng/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview utility.nrs.com.ng is an impersonation phishing page that presents itself as an "EServices" portal, the kind of online service desk people use for utility, billing or official account tasks. The .com.ng address and the "utility" label are built to look like a legitimate Nigerian service site. PhishDestroy first flagged it on 2026-09-09. It was still online and serving content when last checked on 2026-10-19, more than a month later. How the scam works Fake e-service portals copy the layout and wording of a real provider so visitors believe they are paying a bill, renewing a service or logging into an account. The "EServices" title supports that pretence. Whatever the victim types in, such as usernames, passwords, ID numbers or card details, goes to the operators instead of the real service. Those details can then be used to take over accounts, make fraudulent charges, or run follow-up scams that rely on the victim's own personal information. Evidence Six of 89 VirusTotal engines marked the domain as malicious or phishing by 2026-09-12: CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar, VIPRE and desenmascara.me. That count is modest, so many browsers and security tools will not block the site yet. Spamhaus separately lists the domain in its DBL as a spam domain. In addition, it appears on the PhishDestroy blocklist. Infrastructure The parent domain nrs.com.ng was registered through Leads Globe on 2026-09-08, and PhishDestroy flagged it one day later. A name that goes live this quickly after registration was almost certainly set up for this campaign. The site is hosted on the NEW DHAKA HARDWARE network, which geolocates to the United States, at 163.61.188.7. Its free Let's Encrypt certificate shows a padlock in the browser, but a padlock says nothing about whether a site is genuine. What to do If you entered a password on this page, change it immediately on the real service and on any other account that shares it, then turn on two-factor authentication. If you submitted card or bank details, contact your bank to block the card and dispute any charges you do not recognise. Expect follow-up calls, texts or emails that quote your details, and reach the real provider only through contact details you already trust. Defenders should block the domain and the IP above, and should search mail and proxy logs for users who visited it since 2026-09-09. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a084cf-6dcd-74f3-a337-ccf83a7daaff/ VirusTotal report: https://www.virustotal.com/gui/domain/utility.nrs.com.ng Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=utility.nrs.com.ng Archived copy: https://web.archive.org/web/20260922181052/https://utility.nrs.com.ng/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:46:13 UTC ## Stored page captures - Primary capture: https://i.ibb.co/pB14tKmF/ba03579f286d.png Captured: 2026-09-09 06:17:11 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a084cf-6dcd-74f3-a337-ccf83a7daaff.png Captured: 2026-09-09 06:17:11 UTC Source report: https://urlscan.io/result/01a084cf-6dcd-74f3-a337-ccf83a7daaff/ - URLQuery: https://screenshots.phishdestroy.io/uq/7495ba6d-4dba-4b32-843b-4df917f8b120.png Captured: 2026-09-09 07:07:46 UTC Source report: https://urlquery.net/report/7495ba6d-4dba-4b32-843b-4df917f8b120 SHA-256: b897cb495475e9c5766c5c6f8c5805fa230a37fe949c0546d53e4f8b7dbca8c2 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4222d341-664d-4f5e-99dc-b06a48531910.png Captured: 2026-09-09 06:50:59 UTC Source report: https://radar.cloudflare.com/scan/4222d341-664d-4f5e-99dc-b06a48531910 SHA-256: f26d666ef23f17b47aedf9f2d3343f197931ec7fcde3d1a1949b372e2fbeedf0 - URLScan ยท 2026-09-09: https://screenshots.phishdestroy.io/us/01a084cb-d9e7-75fc-87b3-ca29cfab0ab8.png Captured: 2026-09-09 06:12:34 UTC Source report: https://urlscan.io/result/01a084cb-d9e7-75fc-87b3-ca29cfab0ab8/ SHA-256: b2b9efb9278ca1af201f82f07f86623966795d82407b2e41cb23071bf5a15d6d ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T02:24:56Z", "uuid": "01a084cf-6dcd-74f3-a337-ccf83a7daaff", "scanned_at": "2026-09-09T06:16:30Z", "final_url": "https://utility.nrs.com.ng/AMM/", "status": 200, "ip": "163.61.188.7", "ptr": "s6.whitelabelclouds.com", "domains": [ "tcc.firs.gov.ng", "cdnjs.cloudflare.com", "maxcdn.bootstrapcdn.com", "ajax.googleapis.com" ], "ips": [ "104.18.10.207", "142.251.14.95", "104.17.24.14", "66.22.96.117", "163.61.188.7" ], "asns": [ "13335", "15169", "198949", "153568" ], "countries": [ "US", "ZA", "BD" ], "link_domains": [ "tcc.firs.gov.ng" ], "doc_hash": "1d4eafc242425d4dfd39c7607a59384501f8a306a8054b4b20078bd077df7c45", "globals": [ "$", "jQuery", "Popper", "bootstrap", "header" ], "tls": { "san": [ "utility.nrs.com.ng", "www.utility.nrs.com.ng" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "utility.nrs.com.ng", "protocol": "TLS 1.3", "valid_to": "2026-12-07T08:35:43Z", "valid_from": "2026-09-08T08:35:44Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 9, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 92, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T02:35:45Z", "uuid": "4222d341-664d-4f5e-99dc-b06a48531910", "scanned_at": "2026-09-09T06:50:59Z", "final_url": "https://utility.nrs.com.ng/", "status": 200, "history": [ { "url": "https://utility.nrs.com.ng/", "status": 200 } ], "dom_hash": "48bf4ec572bd576034e3827d33cf81c2ccf11d37cf61d60e8f5fa103d54b4df3", "doc_hash": "781b87453179113feca78d0c0f2bb164745c95ab4c8e99c7dd14d3a738efbe33", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "utility.nrs.com.ng", "type": "A", "value": "163.61.188.7" } ], "dnssec_valid": false, "ip": "163.61.188.7" } } ```