nfcarabia[.]com

The domain nfcarabia.com is identified as an active phishing site specifically targeting Nissan Arabia customers and affiliates. Analysis indicates this domain is designed to impersonate legitimate Nissan Middle East portals, likely to harvest login credentials, personal data, or financial information from unsuspecting users seeking vehicle services, promotions, or account management. The domain remains operational and poses a high-risk threat due to its targeted impersonation of a major automotive brand. Infrastructure analysis reveals nfcarabia.com was registered on May 29, 2025, through NAMECHEAP INC, a registrar frequently associated with newly created phishing domains. The domain resolves to the IP address 66.29.135.74, hosted on AS22612 (Namecheap, Inc.) in the United States. As of the latest assessment, 4 of 95 security vendors on VirusTotal have flagged this domain as malicious. It appears on one security blocklist and is actively blocked by enterprise phishing detection systems. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its free and automated issuance process. Current monitoring confirms nfcarabia.com remains active, with no signs of takedown or remediation. Organizations and end users are advised to implement immediate blocking of the domain and its resolving IP address at the network perimeter. Security teams should prioritize reviewing logs for connections to 66.29.135.74 or nfcarabia.com, particularly from internal systems accessing Nissan-related services. Users should be alerted to verify the authenticity of any Nissan Arabia communications, ensuring URLs match the official nissan-middleeast.com domain. Multi-factor authentication should be enforced for all Nissan Arabia accounts to mitigate credential theft risks. Continuous monitoring for similar domains using variations of 'nfc' or 'arabia' is recommended to detect potential follow-up campaigns.