noramusic[.]pro

Analysis of the domain noramusic.pro indicates active phishing infrastructure targeting administrative credentials. The domain, registered on April 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, currently resolves to the IP address 212.23.222.105. It appears on two security blocklists and is flagged by 6 of 95 security vendors in a recent scan. The domain is also referenced in 23 threat intelligence pulses, suggesting broader recognition within the security community. The page title, "Nora Music — Admin," implies a focus on administrative access, a common tactic in credential harvesting campaigns. The domain employs a Let's Encrypt SSL certificate and utilizes technologies including Python, Chart.js, Uvicorn, jsDelivr, and HTTP/3, which are consistent with modern web applications but do not preclude malicious use. No specific phishing kit or targeted brand is confirmed beyond the page title, limiting attribution to a generic admin-themed phishing site. Defenders should treat this domain as high-risk due to its presence on multiple blocklists and its association with known malicious indicators. Network-level blocking of 212.23.222.105 and noramusic.pro is recommended. Further investigation into the domain's traffic patterns and any linked infrastructure may reveal additional compromised assets or ongoing campaigns. The domain remains active as of July 12, 2026, with no signs of takedown or remediation.