neonvm[.]xyz

The domain neonvm.xyz was a generic phishing site that posed an elevated risk of credential theft or malware distribution. It did not impersonate a specific brand or use a known drainer kit. As of the latest verification, neonvm.xyz has been taken offline, though it previously operated as an active phishing page.

Technical indicators show neonvm.xyz was detected by 2 of 95 VirusTotal security vendors, including alphaMountain.ai and Forcepoint ThreatSeeker. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on July 21, 2025, and resolved to the IP address 104.21.80.1, hosted on Cloudflare's network (AS13335). It appeared on one security blocklist, PhishDestroy, and had no SSL certificate. The observed page title was 'Nur einen Moment…', and the domain used a single nameserver.

Users who encountered neonvm.xyz should assume potential exposure of login credentials or device compromise. Immediate steps include changing passwords for any accounts accessed while the site was active, enabling two-factor authentication, and monitoring accounts for unauthorized activity. Victims may report the phishing domain to their email provider, browser security teams, or platforms like Google Safe Browsing or PhishTank to aid in broader mitigation efforts.