neukospecial[.]live

Analysis of the domain neukospecial.live indicates an active phishing infrastructure operational since February 21, 2026. The domain resolves to IP address 188.114.96.3 and is protected by Cloudflare, as evidenced by detected technologies including Cloudflare Browser Insights and HTTP/3. The SSL certificate is issued by Google Trust Services, a common choice for both legitimate and malicious sites. The page title 'Just a moment...' suggests the presence of a Cloudflare interstitial or challenge page, which may obscure the actual phishing content from automated analysis. The domain is flagged by 22 threat intelligence pulses on AlienVault OTX and appears on two security blocklists, including PhishDestroy and BLP-Malware. Five out of 95 security vendors on VirusTotal have detected this domain as malicious. Registration details indicate the domain was registered through NiceNIC International Group Co., Limited, a registrar frequently used for both benign and malicious domains. Infrastructure analysis reveals no definitive brand targeting or phishing kit identification at this stage, as the exact content of the site remains unconfirmed. Defenders are advised to block the domain and associated IP address (188.114.96.3) at the network level. Monitoring for connections to this domain should be prioritized, particularly given its high-risk classification and continued activity as of July 12, 2026. Further analysis of the site's content, if accessible, is recommended to determine the specific phishing campaign or target.