everestmotors[.]com[.]np

This domain, everestmotors.com.np, has been identified as a high-risk phishing site specifically targeting users through fake auto dealer impersonation. Analysis indicates the domain was designed to mimic legitimate automotive sales or service platforms, likely to harvest credentials or financial information. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively serving malicious content. Infrastructure analysis reveals the domain resolved to IP address 103.104.232.145, hosted under AS137209 (Oasis Broadband Internet Pvt. Ltd.) in Nepal. The domain was flagged by 18 of 95 security vendors on VirusTotal, with no valid SSL certificate detected. It appeared on two security blocklists, including PhishDestroy and PhishingDB, and was explicitly marked as phishing by Google Safe Browsing. The lack of encryption and its presence on multiple threat intelligence feeds further corroborate its malicious intent. Current status confirms the domain is offline, reducing immediate risk to users. However, organizations should maintain blocking rules for 103.104.232.145 and monitor for re-registration under similar naming conventions. Network defenders are advised to update firewall and proxy rules to deny traffic to this IP and domain. End users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available.