norseoption[.]sbs

As of July 28, 2026, the domain norseoption.sbs is flagged as a potential phishing site. Analysis indicates that the domain is registered through Atak Domain, a registrar known for facilitating malicious activities. The domain was created on July 20, 2026, which aligns with the recent emergence of the threat. Infrastructure analysis reveals that the domain resolves to the IP address 86.107.77.91, hosted by a provider that may not have stringent security measures.

The SSL certificate for norseoption.sbs is issued by Let's Encrypt, a common choice for phishing campaigns due to its ease of use and lack of rigorous verification processes. This domain appears in one threat intelligence pulse on AlienVault OTX, suggesting it has been identified as part of a broader malicious campaign. Additionally, the domain is present on three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating that multiple security organizations have deemed it a threat.

While the domain is still active, defenders should exercise caution and implement additional layers of security, such as enhanced monitoring and user education, to mitigate the risk of phishing attacks. The exact content of the website has not been analyzed, but given the available evidence, it is advisable to block access to this domain and monitor for any related malicious activities. Defenders should also consider reporting this domain to additional security platforms and authorities to aid in broader threat mitigation efforts.