neon-club[.]top

Analysis of neon-club.top shows a recently registered domain (created 21 February 2026) that was actively hosting a crypto‑casino lure before being taken offline. The site presented the page title “Neon‑club: Most Popular Online Crypto Casino Based on Blockchain,” and forensic examination linked it to the publicly known Gambler Scam phishing kit. The domain resolves to the IPv6 address 2606:4700:3037::ac43:dc05, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States.

A TLS certificate identified as WE1 was observed, indicating encryption was in place during its brief operation. VirusTotal scans recorded 11 detections out of 93 security vendors, confirming that multiple AV engines recognized the activity as malicious. The Gridinsoft trust score is 0 / 100, reflecting extreme distrust, and the domain appears on a single security blocklist, specifically PhishDestroy, which has already blocked it.

Current HTTP status shows the site is offline, and no additional Safe Browsing or Open Threat Exchange entries are available. Defenders should immediately add neon-club.top to inbound and outbound filtering rules, monitor the associated Cloudflare IP range for any resurgence, and consider sharing the indicator set with threat‑sharing communities. Continuous observation of the ASN and any new registrations using similar naming patterns is advised, as the infrastructure could be repurposed for future crypto‑related phishing campaigns.