nc-domain[.]click

Analysis indicates that the domain nc-domain.click was registered on 23 May 2026 through Global Domain Group LLC and is currently hosted behind Cloudflare (IP 172.67.146.26, location CA). The authoritative nameservers cleo.ns.cloudflare.com and kenia.ns.cloudflare.com resolve to the same Cloudflare network, suggesting the attacker is leveraging Cloudflare’s CDN and DDoS protection to hide the origin. The site serves HTTP 200 responses and presents an SSL certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS chain despite the malicious intent. The page title returned is “NC Panel”, providing no further context about the targeted brand or service. Threat intelligence sources have flagged the domain as high‑risk. PhishDestroy has blocked it, and it appears on a single security blocklist. AlienVault OTX lists the domain in one pulse, and VirusTotal reports that six of ninety‑one scanned scanners flagged the host, reinforcing the suspicion of malicious activity. Gridinsoft assigned a trust score of 0 out of 100, and the overall risk level is marked high, with the domain status reported as active. While the exact phishing kit or credential‑harvesting page has not been publicly disclosed, the convergence of multiple independent detections, a zero‑trust score, and a recent registration date points to a likely credential‑stealing operation. Defenders should add nc-domain.click to block lists, monitor DNS queries for this FQDN, and consider sink‑holing traffic to prevent potential credential capture. Ongoing observation is advised to capture any payloads or redirects that may emerge as the campaign evolves.