nonkosigroup[.]co[.]za

The domain nonkosigroup.co.za has been identified as a fake login portal designed to harvest user credentials. Analysis indicates the domain is currently in a taken_down status, though prior activity suggests it was actively targeting victims through deceptive login interfaces. No specific brand impersonation has been confirmed, but the generic phishing infrastructure aligns with credential theft campaigns. Infrastructure analysis reveals the domain was registered on October 14, 2025, through the registrar Domains. It resolves to the IP address 142.132.207.224 and is associated with a Let's Encrypt SSL certificate, providing a superficial layer of legitimacy. Detection metrics show the domain was flagged by 6 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0/100. The domain appears on two security blocklists and is actively blocked by PhishDestroy and OISD. Technologies detected include LiteSpeed and HTTP/3, which are commonly used in both legitimate and malicious web infrastructure. At present, the domain displays an 'Account Suspended' page, indicating a likely takedown or cessation of active phishing operations. However, the infrastructure may remain accessible for future malicious use. Organizations are advised to block the domain and its associated IP at the perimeter level. Security teams should monitor for related domains registered through the same registrar, particularly those with recent creation dates or similar naming patterns. End users should be educated on recognizing fake login portals and verifying domain authenticity before entering credentials.