neocoin-migration[.]pages[.]dev

On 29 July 2026 the domain neocoin-migration.pages.dev was observed hosting a generic phishing campaign. The domain is registered through Cloudflare, Inc., and uses the Cloudflare nameservers kenia.ns.cloudflare.com and razvan.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is a Cloudflare edge node commonly shared among unrelated sites. The domain appears on a single security blocklist and is listed by PhishDestroy as a blocked phishing resource. VirusTotal has processed the domain and 7 of 91 security vendors have returned a malicious classification, indicating that automated scanners have identified phishing‑related artifacts.

The elevated risk rating reflects the combination of active status, blocklist presence, and vendor detections. At the time of writing the actual page title and any credential‑stealing forms have not been publicly disclosed, so the specific lure employed by the site remains unknown. The use of a Cloudflare‑provided subdomain suggests the operators are leveraging the platform’s anonymity and DDoS mitigation features to hide the true origin of the phishing infrastructure. Because the IP address is a shared edge node, attributing malicious activity to a single host is unreliable, but the correlation of blocklist listings and vendor detections provides sufficient evidence for defensive action.

Organizations should add neocoin-migration.pages.dev to web‑filtering and DNS‑sinkhole policies, monitor traffic to the associated IP address, and consider blocking any outbound connections to the domain. Defenders may also review email gateways for references to “neo‑coin” or similar terminology, as the domain name hints at a cryptocurrency‑related lure, although no explicit claim has been verified. Continuous re‑evaluation is advised, and any observed credential submissions should be treated as compromised and trigger incident response procedures.