neutys[.]net

This domain is flagged for hosting a generic phishing infrastructure targeting users of cloud-based services. Analysis indicates the site mimics legitimate cloud portals to harvest login credentials, session tokens, or sensitive corporate data. The threat type is classified as credential theft phishing, with an elevated risk level due to its recent creation and active distribution methods. Infrastructure analysis reveals multiple high-risk indicators. The domain neutys.net was registered on August 28, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to IP address 188.114.96.3, which is part of a network range known for hosting malicious content. The domain appears on one security blocklist and is flagged by 7 out of 95 security vendors on VirusTotal. Additional technical indicators include a Gridinsoft trust score of 1/100, use of Cloudflare for obfuscation, and detected technologies such as PHP, Mailgun, and jQuery, which are commonly exploited in phishing campaigns. The page title 'Home | Neutys' suggests an attempt to appear as a legitimate service portal. Mitigation steps should focus on preventing credential exposure and containing potential breaches. Organizations should immediately block the domain neutys.net and its resolving IP 188.114.96.3 at the network perimeter. Endpoint protection systems should be updated to detect and quarantine any artifacts associated with this campaign. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window, particularly those tied to cloud services. Security teams should monitor for unusual authentication attempts or data exfiltration patterns originating from affected accounts. Given the domain's recent creation and use of Cloudflare, additional scrutiny should be applied to traffic from similar infrastructure patterns.