# PhishDestroy domain threat record: 01neuf.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/01neuf.com/
Machine-readable companion: https://phishdestroy.io/domain/01neuf.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-09 22:40:09 UTC
- Last availability or vendor check: 2026-10-25 02:00:44 UTC
- Stored record updated: 2026-10-25 03:20:37 UTC
- VirusTotal detections in the stored snapshot: 4/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Registrar in stored WHOIS data: Gname.com Pte. Ltd.
- Registration date (registry RDAP, 01neuf.com): 2024-11-24 19:08:16 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/01neuf.com
- Certificate Transparency search: https://crt.sh/?q=%25.01neuf.com
- Web Archive lookup: https://web.archive.org/web/*/https://01neuf.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
01neuf.com is on the PhishDestroy blocklist as a suspicious domain. No impersonated brand or target audience has been confirmed. PhishDestroy first flagged it on 2026-08-10. The site has been offline since 2026-09-13, and as of 2026-10-19 its DNS no longer resolves.

How the scam works
No specific scheme has been confirmed for this domain. However, the vendors that flagged it, including a dedicated anti-phishing service and Spamhaus's phishing category, point to a page built to harvest something from visitors. That usually means login credentials, personal details or payment information. Typically, such a page is reached through a link in an email, text or social post and asks the visitor to sign in or confirm details on a look-alike form. Anything typed into that form goes straight to whoever runs the domain.

Evidence
The strongest independent signal is Spamhaus, which lists the domain in its DBL under the phishing category. On VirusTotal, 4 of 89 engines flagged it as of 2026-09-13: Forcepoint ThreatSeeker, Fortinet, PhishFort and SOCRadar. That count is low, but the flags come from vendors that specialise in web threats and brand-abuse monitoring rather than from generic scanners. The domain also appears in 3 AlienVault OTX threat pulses, so other researchers have tied it to malicious activity.

Infrastructure
The domain went dark on 2026-09-13, about five weeks after PhishDestroy first flagged it. That same day, VirusTotal vendors had already marked it. Its DNS was still inactive when last checked on 2026-10-19, so it currently serves nothing. Short-lived domains like this are often dropped once they are reported, but the name can be reactivated or re-registered later. That is why it stays on the blocklist.

What to do
If you entered a password on this site, change it immediately, along with any other account that reuses it, and turn on two-factor authentication. If you submitted card or bank details, contact your bank to block the card and dispute any unfamiliar charges. Treat follow-up emails or calls referencing the site as part of the same attempt. Defenders should block 01neuf.com at DNS and web proxies and keep it blocked even while it is offline. They should also search mail and proxy logs from 2026-08-10 onward for users who clicked through to it.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/01neuf.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=01neuf.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:54:06 UTC

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:31:04Z",
        "uuid": "e5984d1e-a590-4d5f-ba01-3ed816789777",
        "scanned_at": "2026-09-12T22:34:06Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T14:54:56Z",
        "analysis_at": "2026-09-12T20:52:01Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "PhishFort": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Business/Economy, Suspicious (alphaMountain.ai)"
        },
        "registrar": "Gname.com Pte. Ltd.",
        "created": "2024-11-24T19:08:16Z",
        "expires": "2026-11-24T19:08:16Z",
        "updated": "2026-09-08T03:06:19Z",
        "first_seen": "2024-03-05T23:42:10Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.share-dns.com",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "104.165.23.212"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.share-dns.net"
            }
        ],
        "dns_at": "2026-07-13T23:35:27Z",
        "jarm": "2ad2ad16d2ad2ad0002ad2ad2ad2ad487dfc3734968073f786f66dcf4de1b2",
        "cert": {
            "san": [
                "*.dadapro.com",
                "dadapro.com"
            ],
            "issuer": "DigiCert Inc / Thawte RSA CA 2018",
            "serial": "56fce75c426c41252fb92453e84eb3f",
            "sha256": "3f625dad91acb9fb651633e7c74204a83107dc08d2695f3020126fe445b49ff8",
            "subject": "*.dadapro.com",
            "valid_to": "2020-05-17T12:00:00Z",
            "valid_from": "2019-03-19T00:00:00Z"
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "registrar_iana_id": "1923",
            "registrar_url": "http://www.gname.com",
            "created": "2024-11-24T19:08:16Z",
            "updated": "2026-07-14T03:03:57Z",
            "expires": "2026-11-24T19:08:16Z",
            "status": [
                "clientHold",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a.share-dns.com",
                "b.share-dns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client hold",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2026-11-24T19:08:16Z",
                "registration": "2024-11-24T19:08:16Z",
                "last update of RDAP database": "2026-09-08T03:06:19Z"
            }
        }
    }
}
```