narcos24[.]com

Analysis of the domain narcos24.com, created on June 07, 2025 and registered through NiceNIC International Group Co., Limited, shows that it is currently offline but was previously used for a generic phishing campaign. The site served a page with the title "Вы не робот?" ("You are not a robot?"), indicating a possible CAPTCHA evasion tactic. No SSL certificate was observed, and the domain resolved to the IP address 91.206.71.141, which is hosted by Cloudflare (AS13335) in the Netherlands. DNS resolution used Cloudflare’s authoritative nameservers david.ns.cloudflare.com and dina.ns.cloudflare.com, confirming the hosting provider.

VirusTotal scans recorded two detections out of ninety‑five security vendors, suggesting limited but notable malicious activity. The domain appears on one public security blocklist and has been specifically flagged and blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of high risk. While the exact phishing lure and target audience remain unknown, the combination of a non‑TLS site, low trust score, and detection by multiple security vendors indicates a deliberate malicious operation.

Defenders should continue to block the domain at perimeter defenses, monitor for any re‑registration attempts, and add the associated IP address to deny‑list rules. Additional scrutiny of outbound traffic for connections to 91.206.71.141 is advised, as well as updating web‑filtering policies to include the identified blocklist entry. Continuous observation of the registrar NiceNIC for any new domains linked to this infrastructure may help pre‑empt future campaigns.