northmonihrt[.]com[.]westhrtb[.]com

Analysis of northmonihrt.com.westhrtb.com indicates that the domain was registered on February 21, 2026 and is presently taken offline. The site presented the page title "Northmoni Heritage | Official Website," aligning with a brand impersonation scam that targets users seeking heritage or genealogical services. DNS resolution points to IP address 213.165.249.109, which is hosted in the Netherlands under AS22611 InMotion Hosting, Inc. The SSL certificate associated with the host received an R10 rating, suggesting a low level of trust. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious nature of the infrastructure.

VirusTotal scanned the domain and recorded three positive detections out of ninety‑three security vendors, confirming that multiple scanners identified it as malicious. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service. The combination of a newly created domain, low trust scores, a weak SSL rating, and multiple vendor detections points to a deliberate phishing operation rather than an accidental compromise.

While the exact phishing kit or credential‑harvesting page has not been publicly disclosed, the available evidence is sufficient for defenders to implement mitigation. Recommendations include adding northmonihrt.com.westhrtb.com and its resolving IP 213.165.249.109 to firewall deny lists, monitoring for any residual traffic, and ensuring that web filtering solutions block the domain based on its reputation. Continuous observation of the host ASN and any re‑registration attempts is advised, as threat actors often recycle infrastructure after takedown.