nomadteam[.]bg

This domain, nomadteam.bg, is actively flagged as a generic phishing threat with a high-risk classification. Registered on March 23, 2026, through Superhosting.bg, the domain remains operational as of July 12, 2026, resolving to the IP address 91.196.125.137, which is geolocated in Bulgaria and associated with SuperHosting.BG Ltd. The domain appears on one security blocklist and has been identified in two AlienVault OTX threat intelligence pulses, indicating its inclusion in broader threat-sharing communities. A single security vendor on VirusTotal has flagged the domain, though the limited detection rate does not diminish its confirmed presence on other threat feeds. Analysis of the domain's infrastructure reveals an SSL certificate issued by Let's Encrypt (R13) and an HTTP 302 redirect status, which is commonly employed to obscure the final destination of phishing pages or to evade automated detection mechanisms. The page title, 'Начало – NomadTeam,' suggests a localized or brand-impersonation attempt, though no specific impersonated entity has been confirmed. The domain's registration details and hosting provider align with patterns observed in other phishing campaigns, where infrastructure is reused or rapidly provisioned for short-term malicious activity. Defenders should treat this domain as an active threat, particularly given its persistence since March 2026 and its inclusion in threat intelligence repositories. Network-level blocking of 91.196.125.137 and monitoring for connections to nomadteam.bg are recommended to mitigate potential credential harvesting or malware distribution. The domain's low Gridinsoft trust score of 0/100 further corroborates its malicious classification, though the exact phishing kit or payload remains unconfirmed. Organizations should correlate this domain with other indicators of compromise, particularly if internal logs show user interactions with the IP or domain.