nieuwestep[.]nl

The domain nieuwestep.nl was registered on 17 September 2020 through the registrar ZXCS and is currently served by the authoritative name servers ns.zxcs.be, ns.zxcs.eu and ns.zxcs.nl. DNS resolution points to the IPv4 address 185.104.29.124, which remains active as of the report date (04 August 2026). The domain appears on two public phishing blocklists, PhishDestroy and OpenPhish, confirming that it has been identified as malicious by independent threat‑sharing communities. VirusTotal has recorded four positives out of ninety‑one scanned security vendors, indicating that at least a subset of scanners consider the host to be suspicious or malicious.

No further contextual information such as a page title, SSL certificate details, or HTTP response codes has been published, so the exact content served by the site cannot be verified at this time. Analysis of the available indicators suggests that the infrastructure is being used for a phishing campaign, likely targeting users familiar with the “nieuwestep” naming pattern. The presence on multiple blocklists and the VirusTotal detections increase confidence that the domain is actively employed for illicit credential harvesting. However, the lack of publicly available webpage metadata limits the ability to attribute a specific brand or phishing kit to the operation.

Defenders should block outbound connections to 185.104.29.124 and add nieuwestep.nl to DNS‑based deny lists. Email gateways should be configured to flag any messages containing links to this domain, and security monitoring solutions should watch for authentication attempts to accounts that may be targeted by the campaign. Continuous re‑evaluation is recommended, as the domain remains active and may evolve its hosting or payload delivery mechanisms.