iptvnordicno[.]com

Analysis of the domain iptvnordicno.com indicates it is a confirmed phishing site with high-risk classification, active as of July 30, 2026. The domain was registered on July 01, 2026, through Ultahost, Inc., and currently resolves to the IP address 104.21.59.60. Infrastructure analysis reveals Cloudflare nameservers (jacob.ns.cloudflare.com and zara.ns.cloudflare.com), a common pattern observed in phishing campaigns to obscure hosting origins and evade takedowns. VirusTotal detections show 2 of 91 security vendors flagging the domain, a modest but notable signal given the domain's recent registration.

The domain appears on one security blocklist, specifically PhishDestroy, which classified it as a generic phishing threat. The exact nature of the phishing content remains unconfirmed, as no page title, brand target, or phishing kit details were provided in available intelligence. However, the domain name suggests an attempt to mimic legitimate streaming or IPTV services, potentially targeting user credentials or payment information. Defenders should treat this domain as malicious and prioritize blocking it at the DNS and proxy levels.

Network logs should be reviewed for connections to 104.21.59.60 or the domain itself, particularly from endpoints with access to corporate or personal streaming accounts. Given the domain's recent creation and active status, monitoring for related domains with similar naming patterns (e.g., variations of 'iptv' or 'nordic') is recommended. No SSL or HTTP status data was provided, so further investigation into TLS certificates or server responses may yield additional indicators.