contact[.]nmhs[.]co[.]in

The domain contact.nmhs.co.in presents a high-risk threat by engaging in brand impersonation, specifically targeting Facebook. The domain is designed to deceive users by mimicking legitimate Facebook communications, potentially leading to unauthorized access to sensitive information. This site is part of a phishing campaign aiming to exploit the trust users place in recognized brands.

Technical analysis reveals that contact.nmhs.co.in is actively listed on two security blocklists and has been flagged by 12 out of 95 security vendors on VirusTotal. The domain was registered through GoDaddy.com, LLC on March 27, 2022, and is currently hosted on an IP address located in India, specifically under AS63949 Akamai Connected Cloud. The SSL certificate issued by Let's Encrypt indicates an attempt to appear legitimate, with the page title set as NMHS, which could further mislead users.

Users who have interacted with this domain should immediately change their Facebook passwords and enable two-factor authentication to secure their accounts. Additionally, they should monitor their accounts for any unauthorized activity and consider reporting the encounter to Facebook for further investigation. It is also recommended to run a full security scan on their devices to ensure no malware has been introduced.