neobet[.]top

Analysis of neobet.top, observed on July 24, 2026, indicates an active high‑risk phishing infrastructure targeting cryptocurrency users. The domain was registered on March 05, 2025 through Web Commerce Communications Limited and resolves to IP address 69.5.189.57, which is announced by Autonomous System AS42624 operated by Global‑Data System IT Corporation in Switzerland. The hosting provider supplies a Let's Encrypt certificate (YR2) and the site returns HTTP 200, confirming a reachable web service. The page title returned by the server reads “Neobet: Most Popular Online Crypto Casino Based on Blockchain”, aligning with the classified scam type of a crypto‑casino fraud.

The infrastructure is associated with the publicly known Gambler Scam phishing kit, a template frequently used to lure victims into credential‑stealing or financial loss. Reputation checks are uniformly negative: Gridinsoft assigns a trust score of 1 / 100, the domain appears on one security blocklist, and PhishDestroy reports it as blocked. AlienVault OTX references the domain in a single threat‑intel pulse, reinforcing its malicious profile. VirusTotal analysis shows that 11 of 95 scanned security engines flag the domain, providing additional independent confirmation of malicious activity.

The domain’s authoritative name servers are ns3.nameserverhub.com and ns4.nameserverhub.com, which are listed in multiple variants, suggesting potential redundancy or misconfiguration. While the exact content delivered to victims has not been disclosed, the convergence of a low trust score, detection by multiple vendors, inclusion on blocklists, and use of a known phishing kit strongly indicates a credential‑ harvesting or financial‑extraction campaign. Defenders should proactively block DNS resolution for neobet.top, incorporate the domain into URL filtering and email security policies, and monitor network traffic for connections to 69.5.189.57.