niriramo75[.]com

This domain, niriramo75.com, is flagged for credential theft activity targeting users through deceptive landing pages. Analysis indicates the absence of overt brand impersonation or crypto drainer kit signatures, suggesting a focus on generic login credential harvesting. The page title 'Just a moment...' is consistent with evasion techniques used to delay or obscure malicious intent during initial access attempts. Infrastructure analysis reveals the domain was registered on July 06, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 178.16.54.222 and employs a Let's Encrypt SSL certificate, a common tactic to mimic legitimate encryption. Detection metrics include a VirusTotal score of 4/95 security vendors, presence on one security blocklist, and inclusion in a single AlienVault OTX threat intelligence pulse. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. The domain remains active and unblocked by major browser-based protection mechanisms, including Google Safe Browsing. Current response actions involve monitoring for additional indicators of compromise, such as redirected endpoints or associated malware payloads. Despite limited vendor detections, the domain's recent registration, low trust score, and active status present a persistent high-risk threat. Users are advised to block the domain at the network level and validate any credentials potentially exposed to this infrastructure.