nim-network[.]com

The domain nim-network.com was registered on 21 February 2026 and is currently taken offline. Infrastructure analysis shows the domain resolves to the IP address 15.197.130.221, which belongs to Amazon Web Services (ASN 16509) and is geolocated in the United States. The TLS certificate presented by the host is identified as rating R11, indicating a low‑trust issuance. A trust scoring service assigns a zero‑out‑of‑one‑hundred rating, reflecting extreme suspicion.

Malware‑and‑reputation scanning on VirusTotal reports that one of ninety‑three security engines flagged the domain, confirming at least one detection among many scanners. The site appears on three public blocklists and is directly listed by PhishDestroy, ScamSniffer, and Enkrypt, all of which categorize the activity as a brand‑impersonation campaign targeting the Sui brand. The sole page title returned from the server is “nim-network.com”, providing no additional context about the payload or landing page. Because the domain is offline, real‑time content verification is not possible, and the exact phishing kit or credential‑harvesting mechanism remains unknown.

Defenders should continue to block the IP address 15.197.130.221 at the network perimeter, enforce DNS‑based deny lists that include nim-network.com, and monitor for any resurgence of the domain or associated sub‑domains. Threat‑intel teams are advised to share the indicator set with partners and to watch for future registrations that reuse the same hosting provider or certificate characteristics. Ongoing observation of the three blocklists that have already flagged the domain will help capture any re‑activation attempts.