nomine[.]ro

The domain nomine.ro, registered on April 14 2026 through TERON SYSTEMS SRL, resolves to the IPv4 address 195.20.203.130, which is geolocated to Romania and associated with the same registrar. Authoritative name servers ns1.teron.ro through ns4.teron.ro serve the zone, indicating that the infrastructure is fully hosted by the registrar’s network. The site presents an HTTP 200 response with the generic page title "Index of /" and is served by Nginx. A Let's Encrypt R13 certificate is active, confirming that TLS termination is correctly configured but offering no indication of malicious content.

Malware and URL scanning services have flagged the domain: sixteen of ninety‑four vendors on VirusTotal reported it as malicious, and the domain appears on a single security blocklist. PhishDestroy has explicitly blocked the host, and Google Safe Browsing classifies it as a social‑engineering threat, consistent with the recorded scam type of brand impersonation targeting Google. The domain’s MX record points to itself, a pattern often observed in phishing infrastructure to simplify email spoofing. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the low‑reputation assessment.

Although the site has been taken offline, the observable infrastructure—dedicated name servers, a self‑referencing MX, a valid TLS certificate, and multiple vendor detections—provides concrete evidence of a high‑risk, Google‑impersonation campaign. Defenders should continue to block the domain at network perimeters, add it to internal blocklists, monitor the associated IP for any resurgence of activity, and consider reporting the case to relevant threat‑intel sharing platforms. Ongoing vigilance is advised because the offline status may be temporary and the underlying infrastructure remains under the control of the threat actor.