nasrviolin[.]com

This domain, nasrviolin.com, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates no association with legitimate brand infrastructure, suggesting a generic phishing campaign designed to capture sensitive authentication details. The domain does not employ a recognizable drainer kit but operates as a standalone phishing endpoint, likely leveraging social engineering tactics to trick victims into submitting credentials. Infrastructure analysis reveals the domain was registered on August 16, 2021, through Atak Domain, a registrar frequently linked to malicious activity. It resolves to the IP address 185.141.133.197, hosted within the Iranian autonomous system AS48715 (Sefroyek Pardaz Engineering PJSC). The domain lacks an SSL certificate, increasing the likelihood of interception during credential transmission. Detection metrics show 14 out of 95 security vendors flagged nasrviolin.com on VirusTotal, while it appears on two independent blocklists: PhishDestroy and PhishingDB. No entries were found in Google Safe Browsing at the time of analysis. The domain is currently offline, likely due to takedown efforts or infrastructure suspension. Despite its inactive status, residual risk persists due to the potential reuse of the IP address or registration details in future campaigns. Organizations are advised to monitor related indicators, including the IP 185.141.133.197 and the registrar Atak Domain, for emerging threats. Users should remain vigilant against phishing attempts, particularly those mimicking login portals, and verify domain authenticity before submitting credentials.