noones-partnership[.]com

Analysis of noones-partnership.com shows the domain was registered on 3 February 2026 through Hosting Concepts B.V. d/b/a Registrar.eu and is served by Nginx on the IP address 45.74.47.181, which belongs to AS213441 SLAYER GROUP LIMITED located in Germany. The site presented a page titled “Noones × LocalCoinSwap — Partnership Announcement” before being taken offline. TLS was provided by a Let’s Encrypt R13 certificate, indicating a recent HTTPS configuration. VirusTotal records indicate that 15 out of 95 scanned security vendors flagged the domain as malicious, and the host appears on four independent security blocklists.

Additional threat intelligence providers—including PhishDestroy, MetaMask, ScamSniffer, and SEAL—have also listed the domain as blocked. The domain resolves to three OpenProvider name servers (ns1.openprovider.nl, ns2.openprovider.be, ns3.openprovider.eu), a common configuration for rapidly deployed phishing infrastructure. The combination of a newly created domain, short‑lived hosting, multiple vendor detections, and blocklist listings strongly suggests a targeted phishing campaign, likely aimed at users of the LocalCoinSwap service.

However, the exact payload, credential‑harvesting mechanism, and any associated command‑and‑control infrastructure remain unknown because the site is no longer reachable for direct inspection. Defenders should update URL filtering and DNS block policies to include the domain and its associated IP address, monitor for similar newly registered domains using the same registrar or name‑server pattern, and consider adding the AS number to threat‑intel feeds. Continuous verification of blocklist feeds is recommended, as the domain may be re‑hosted elsewhere if the operators attempt to resume activity.