neescto[.]co

On 15 March 2026 the domain neescto.co was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to 172.67.134.169, an address owned by AS13335 Cloudflare, Inc. The site was served behind Cloudflare, employing Cloudflare Browser Insights and HTTP/3 transport. A Let’s Encrypt certificate was observed, indicating a valid TLS handshake at the time of capture. The landing page returned the title “Even geduld…”, but no additional content has been disclosed.

VirusTotal recorded 2 detections out of 94 scanners, and the domain is presently listed on three public blocklists, specifically PhishDestroy, MetaMask, and SEAL. The nameservers june.ns.cloudflare.com and nikon.ns.cloudflare.com are standard Cloudflare entries. As of the reporting date the host appears offline, and no further HTTP response codes have been captured. Analysts can confirm the infrastructure is typical of fast‑flux phishing hosting, but the specific campaign payload, target brand, or credential‑harvesting form has not been publicly released.

Uncertainty remains regarding the phishing template used and the intended victim demographic. Defensive actions should include immediate DNS‑level blocking of neescto.co, inclusion in web‑gateway deny lists, and monitoring of outbound connections to the associated Cloudflare IP range for any residual activity. Continuous re‑scanning is advised to detect potential re‑activation, and threat‑intel feeds should be updated to reflect the domain’s status and its association with the listed blocklists.