task[.]nlglsport[.]com

This domain, task.nlglsport.com, is flagged as an elevated-risk credential harvesting phishing site. Analysis indicates it operates under the guise of a generic e-commerce interface (page title: shop), designed to deceive users into submitting sensitive authentication credentials or financial information. The domain's infrastructure and rapid detection by security vendors suggest a deliberate attempt to impersonate legitimate retail platforms, a common tactic in credential theft campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.85.49 and is registered through NameCheap, Inc., with a creation date of February 21, 2026. It appears on 2 security blocklists and is blocked by multiple threat intelligence feeds. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious. The domain employs Vue.js for frontend interactions, enforces HSTS for encrypted connections, and is proxied through Cloudflare, utilizing HTTP/3 for performance. The SSL certificate is issued by Google Trust Services, and the domain holds a Gridinsoft trust score of 0/100. Its current status is offline, though this does not preclude future reactivation. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (104.21.85.49) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) into endpoint detection and response (EDR) systems, including the domain, IP, and associated SSL certificate thumbprint. User awareness training should emphasize the risks of credential submission on unfamiliar e-commerce sites, particularly those with recent creation dates or low trust scores. Monitoring for similar domains registered through the same registrar (NameCheap, Inc.) or utilizing Cloudflare infrastructure may help identify related phishing campaigns. Network logs should be reviewed for historical connections to the domain or IP to assess potential prior compromise.