couponfollow[.]sale

Analysis of couponfollow.sale was performed on 2026-07-26 following its appearance on a public blocklist. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and was created on 2026-07-21, indicating a very recent deployment. DNS resolution points to IP address 104.21.51.160, which is hosted behind Cloudflare as evidenced by the authoritative nameservers keanu.ns.cloudflare.com and ullis.ns.cloudflare.com. The domain is classified as a generic phishing threat based on the supplied intelligence, and it currently appears on one security blocklist, specifically PhishDestroy, which has taken active measures to block the host.

VirusTotal reports that the domain has been scanned by 91 antivirus and URL‑reputation vendors, yet none of the vendors have raised a detection at the time of scanning. While the lack of detections does not constitute a safety assurance, it demonstrates that the malicious infrastructure has not yet been fingerprinted by the participating scanners. No additional public reputation sources such as Google Safe Browsing, OTX, or SSL certificate transparency logs are available for this domain at the time of review. Consequently, the observable surface consists of registration details, hosting information, and blocklist status.

Uncertainty remains regarding the actual payload delivered, the phishing kit employed, and any compromised credentials that may be exfiltrated. Defenders should add couponfollow.sale to internal URL filtering policies, monitor DNS queries for the domain and its associated IP, and consider proactive blocking at the firewall or proxy level. Continuous re‑evaluation is advised, as future scans by additional vendors or updates to blocklists may reveal further malicious activity.