natcsc[.]com

A newly identified threat actor operates natcsc.com, a counterfeit login portal currently under active investigation for credential harvesting. The domain mimics legitimate services to trick visitors into surrendering sensitive account details, which are then weaponized for financial fraud or identity theft. Security teams advise treating this domain as hostile and blocking access immediately to prevent potential compromise.

PhishDestroy’s analysis confirms the following technical indicators: the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 12, 2026, and currently resolves to the IP address 188.114.96.3. VirusTotal scanning (2 out of 95 detection engines) shows this infrastructure remains under the radar, with no detections recorded to date. The site utilizes a Let’s Encrypt SSL certificate—common among malicious actors—to lend false legitimacy to its fraudulent activities.

If you or anyone in your organization visited natcsc.com, do not enter any credentials or sensitive information. Disconnect from the network immediately and run a full antivirus scan. Report the incident to your security team and consider rotating passwords for any accounts that may have been exposed. Avoid interacting with the domain further, and block both the domain and IP at your firewall and email gateway to prevent follow-on attacks. PhishDestroy continues to monitor this threat and will update advisories as new intelligence emerges.