nestli[.]pro

Analysis of nestli.pro indicates an active generic phishing infrastructure targeting internet users. The domain was registered through NameCheap, Inc. on October 13, 2025 and is delegated to the authoritative name servers ns1.intelliwire.net, ns2.intelliwire.net, and ns3.intelliwire.com. DNS resolution points to the IPv4 address 64.238.34.20, which is currently reachable and associated with the active hosting of the malicious site. Threat intelligence feeds have recorded the domain on two security blocklists, and it is explicitly blocked by the PhishDestroy and OpenPhish feeds, confirming its classification as a phishing resource.

VirusTotal scans show that 14 of 91 security vendors have flagged the domain, providing additional corroboration of malicious intent. No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact content and credential‑stealing mechanisms unverified. The lack of visible brand impersonation suggests a broad‑scope phishing campaign rather than a targeted brand clone.

Defenders should add 64.238.34.20 and nestli.pro to network deny lists, monitor DNS queries for the listed name servers, and enforce URL filtering against the known blocklists. Continuous re‑scanning on VirusTotal and periodic WHOIS checks are recommended to detect any future changes in registration or hosting that could indicate campaign evolution. Given the recent creation date and active status, the infrastructure remains a high‑risk element in the threat landscape and warrants immediate mitigation.