app[.]neoforumpro[.]com

app.neoforumpro.com was observed pointing to the IPv4 address 198.12.66.123, which is announced by AS36352 (HostPapa) and geolocated in the United States. The domain was registered on 28 February 2025 through Cosmotown, Inc., and uses the authoritative name servers ns1.host-forest.com and ns2.host-forest.com. No TLS certificate is presented; HTTP requests to the host return no secure connection, indicating the site is served over plain HTTP. The page title returned from the root URL reads “Neo Forum Pro - Access a Wealth of Trading Opportunities,” suggesting an attempt to lure users interested in trading platforms, but the actual content has not been captured because the site is currently offline.

VirusTotal analysis recorded that two out of ninety‑five scanning engines flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the suspicion of malicious intent. The domain appears on a single public blocklist and is specifically listed by PhishDestroy, confirming that at least one anti‑phishing service has taken automated action against it. The risk rating assigned is elevated, reflecting the combination of brand‑impersonation tactics, low trust score, and detection by multiple security vendors. Because the host is hosted on a shared provider (HostPapa), it is possible that the IP address may be reused for unrelated legitimate services, so defenders should consider both domain‑level and IP‑level blocking while monitoring for any re‑appearance of the same host name.

Defenders are advised to add app.neoforumpro.com to DNS and URL filtering policies, enforce TLS‑only connections for corporate browsers, and continue to watch the AS36352 address space for new domains that exhibit similar registration patterns or page‑title phrasing. Until the site is taken down or further forensic data becomes available, the observable indicators remain limited to the registration details, hosting infrastructure, and the two vendor detections.