alert[.]nortirock[.]co[.]uk

This domain, alert.nortirock.co.uk, is flagged as a credential phishing resource designed to harvest user authentication details. Analysis indicates no direct association with a known brand or drainer kit, though the infrastructure aligns with generic phishing campaigns targeting login portals. The domain exhibits characteristics typical of credential theft operations, including rapid deployment and evasion tactics such as a 404 Not Found response to hinder automated detection. Infrastructure analysis reveals the domain was registered on June 14, 2026, through Hosting Concepts B.V. (REGISTRAR-EU) and resolves to the IP address 188.114.97.3. Security vendor detections on VirusTotal stand at 6 out of 95, indicating moderate but consistent identification as malicious. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services, a common choice for phishing sites to appear legitimate. No entries were found in Google Safe Browsing at the time of analysis, suggesting either recent takedown or evasion of broader detection mechanisms. The domain is currently offline, likely due to enforcement actions or voluntary suspension by the registrar. While the immediate threat has been mitigated, residual risk remains due to the domain's recent creation and prior malicious activity. Users who may have interacted with the domain are advised to rotate credentials for any accounts accessed during the exposure window. Organizations should monitor for related domains registered under the same registrar or resolving to the same IP, as threat actors frequently reuse infrastructure across campaigns.