newcrest-ltd[.]net

Analysis indicates that the domain newcrest-ltd.net is actively used for phishing. The domain was registered on July 17 2025 through Web4Africa Inc. and is hosted on the IP address 65.98.127.26, which is associated with the listedhosting.net name‑server cluster (cloud1.listedhosting.net, cloud2.listedhosting.net, cloud3.listedhosting.net, cloud). The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal scans show that 2 of 91 security vendors have flagged the domain as malicious, confirming the presence of at least some detection signatures.

The current status in the intelligence feed is “active,” suggesting that the phishing infrastructure is still operational. No additional evidence such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, or page title information is available in the provided data, leaving the exact content and targeting of the phishing page unverified. Consequently, the precise brand or credential‑harvesting technique employed by the site cannot be determined at this time. Defenders should treat newcrest-ltd.net as a high‑risk phishing indicator.

Immediate actions include adding the domain to network and email deny‑lists, ensuring that DNS filtering solutions block resolution to 65.98.127.26, and updating intrusion‑prevention signatures that reference the two vendor detections reported by VirusTotal. Continuous monitoring of the associated IP address and the listedhosting.net name‑server group is recommended, as any change in hosting configuration may signal further malicious activity. Analysts should also request a live crawl of the URL to capture page content, which would enable more precise attribution and remediation.