nopmutie[.]top

The domain nopmutie.top has been identified as a credential theft operation specifically targeting users of the myGov platform. Analysis indicates the site impersonates the official myGov sign-in portal, as evidenced by the page title 'Sign in with myGov - myGov' and the use of branding elements associated with the legitimate service. The domain is currently offline, though prior activity suggests an active campaign to harvest login credentials from unsuspecting users. Infrastructure analysis reveals multiple technical indicators supporting the classification of this domain as malicious. The domain was registered on January 12, 2026, through PDR Ltd., a registrar frequently associated with suspicious domains. It resolves to the IP address 212.47.75.111, hosted on AS51167 (Contabo GmbH) in France, a network segment with a history of hosting fraudulent activity. The SSL certificate is classified as R13, a low-trust indicator often linked to automated or malicious certificate issuance. Security vendors have flagged the domain, with 18 of 95 VirusTotal engines detecting it as malicious. Additionally, the domain appears on one security blocklist, further corroborating its classification as a threat. The current offline status of nopmutie.top does not eliminate the risk, as domains of this nature often resurface under different names or infrastructure. Organizations and users are advised to implement the following measures: block the domain and its associated IP address (212.47.75.111) at the network level; monitor for similar domains registered through PDR Ltd. or hosted on AS51167; and educate users on recognizing credential theft tactics, particularly those impersonating government services. Security teams should also review logs for connections to the IP address or domain to identify potential compromised accounts. Given the elevated risk level, proactive monitoring and threat hunting are recommended to mitigate future exposure.