nn1505[.]com

This domain, nn1505.com, is identified as a credential theft operation designed to harvest user login details through deceptive web forms. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the infrastructure aligns with common credential harvesting tactics. The page title, nn1505.com, lacks branding elements, suggesting a generic but targeted approach to trick users into submitting sensitive information. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 21 out of 95 security vendors on VirusTotal, with detection categories including phishing and malicious activity. It was registered through GoDaddy.com, LLC on February 27, 2019, and resolves to the IP address 103.143.28.212, hosted in Hong Kong under AS135581 (ONL-HK). The domain appears on one security blocklist and uses a default SSL certificate issued to 'Default Company Ltd.' No active Google Safe Browsing (GSB) listing is currently observed, though historical data may vary. As of the latest assessment, nn1505.com has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed for future malicious campaigns. Users who may have interacted with this domain are advised to reset credentials for any accounts accessed during potential exposure. Organizations should monitor for related indicators, including the IP address and SSL certificate details, to detect residual or evolving threats associated with this infrastructure. The elevated risk designation is retained due to the domain's history and potential for reuse.