nomadic[.]dnsserverbr[.]info

Security firm PhishDestroy identifies nomadic.dnsserverbr.info as an active phishing dropper designed to harvest user credentials under the guise of a legitimate DNS service. No affiliation with any well-known brand or drainer kit has been established at this time, indicating a generic but effective phishing lure. The domain’s obfuscated name mimics DNS terminology, potentially luring users seeking hosting or DNS configuration tools. Technical indicators point to a highly evasive operation with no clear ties to public phishing kits or known threat actor groups.

This domain was flagged by 18 out of 95 VirusTotal security vendors, with a confirmed resolution to 104.21.71.98. The IP is hosted by Cloudflare, Inc. and the domain was registered through NameBright.com. SSL certificates issued by Google Trust Services suggest an attempt to appear legitimate, despite blocklisting by three security organizations: PhishingArmy, OISD, and CERT-PL. These factors, combined with the domain’s recent registration date (not specified in the dataset), indicate a newly deployed threat attempting to bypass automated detection mechanisms.

The domain remains active and poses a high risk to potential victims. Immediate response includes blacklisting at the network, DNS, and endpoint levels. Organizations and users should avoid visiting nomadic.dnsserverbr.info and investigate for signs of compromise in logs or endpoints that may have resolved the domain. While the current infrastructure appears limited to this single domain and IP, the use of Cloudflare and Google TLS certificates suggests potential for rapid scaling. Remaining risk is assessed as HIGH due to the domain’s active status, multi-vendor detection, and the absence of takedown actions.