new[.]nicoanas[.]com

new.nicoanas.com was registered on May 06, 2026 through GoDaddy.com, LLC. The domain is protected by a Let’s Encrypt certificate (E8) and uses Cloudflare’s DNS service with the authoritative nameservers ara.ns.cloudflare.com and sri.ns.cloudflare.com. The short age of the domain combined with the presence of a free TLS certificate is typical of infrastructure deployed for credential‑stealing campaigns.

The domain resolves to IP address 188.114.96.3, which is hosted by Cloudflare, Inc. in Canada. HTTP requests to the host presently return a 403 status code, indicating that access is being deliberately restricted, a behavior frequently observed in phishing sites that serve content only to targeted victims. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. It is also listed as blocked by PhishDestroy, confirming that at least one anti‑phishing organization has taken action against the domain.

Public detection platforms have not yet flagged the domain, as evidenced by a 0/95 detection count on VirusTotal. This lack of detections does not imply benign intent; rather, it reflects the early stage of the campaign. Defensive teams should proactively block the domain at perimeter firewalls and DNS resolvers, monitor for any DNS queries or HTTP traffic to 188.114.96.3, and consider adding the domain to internal blocklists. Continued observation of the associated IP and any future changes to the certificate or hosting configuration is recommended to detect escalation or repurposing of the infrastructure.

Analysts should also correlate any observed credential submissions or login pages with known brand impersonations, and employ sandbox analysis of any retrieved payloads. Given the use of Cloudflare as a reverse proxy, direct attribution to the underlying host is limited, emphasizing the need for network‑level indicators such as the IP address and observed HTTP responses.