nv[.]fszcanw[.]com

The domain nv.fszcanw.com is assessed as a credential harvesting phishing infrastructure designed to impersonate legitimate login portals and capture sensitive user information such as passwords and account identifiers. The observed behavior aligns with generic_phishing activity, where victims are typically redirected to spoofed authentication pages that mimic trusted services. Once credentials are submitted, they can be immediately exfiltrated and used for account takeover, fraud, or lateral access to additional systems.

Technical intelligence indicates multiple independent security vendors have flagged this domain, with 14/95 detections recorded across scanning engines. The domain was created on May 30, 2026, indicating very recent infrastructure deployment consistent with short-lived phishing campaigns. Registration is handled through IONOS SE, and the domain currently resolves to IP 198.71.59.189. Additional indicators include a Let's Encrypt YR2 SSL certificate, which is commonly used in fast-provisioned malicious infrastructure due to automated issuance and low deployment cost. The domain is also listed on at least one security blocklist and is marked as actively resolving at the time of analysis.

If a user has interacted with this domain, immediate risk mitigation is required. All credentials potentially entered on nv.fszcanw.com should be considered compromised and reset without delay, especially if reused across multiple services. Sessions associated with affected accounts should be invalidated, and multi-factor authentication should be enabled or reviewed for unauthorized changes. Endpoint scans are recommended to ensure no additional payloads or redirects were executed following access. Network defenders should consider blocking the domain and associated IP 198.71.59.189 at perimeter controls while monitoring for repeated connection attempts or related infrastructure reuse patterns.