neonwhale[.]org

NeonWhale.org was registered on March 03, 2026 through Namecheap Inc. The domain resolves to the IPv4 address 209.74.67.149, which is advertised as being located in Singapore and is announced by AS22612, also owned by Namecheap. Authoritative DNS is provided by dns1.namecheaphosting.com and dns2.namecheaphosting.com. The site presents a valid Sectigo‑issued DV certificate issued to “Sectigo Limited / Sectigo Public Server Authentication CA DV R36”, indicating that TLS termination is correctly configured. Security telemetry shows a Gridinsoft trust score of 0 out of 100, and VirusTotal reports that 2 of 95 scanning engines have flagged the host. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy feed. HTTP requests receive a 200 OK response, and the page title reads “NEON WHALE | $NWH - The Apex of Solana”, clearly referencing the Solana ecosystem. Analysis of the content suggests a brand‑impersonation campaign aimed at Solana users. The use of the Solana name and ticker symbol $NWH, combined with the phrasing “The Apex of Solana”, is intended to lure investors or community members into a fraudulent interaction, likely involving credential harvesting or illicit token swaps. The exact malicious payload has not been captured, so the precise attack vector remains uncertain. Given the high‑risk classification, defenders should add neonwhale.org to network‑level deny lists, enforce DNS filtering, and monitor outbound connections to 209.74.67.149 for anomalous activity. Incident response teams should collect HTTP request/response logs, capture the TLS certificate chain, and, if possible, retrieve a snapshot of the landing page for further malware analysis. User education campaigns should warn Solana community members about the impersonation attempt and advise verification of URLs before any transaction.