neonnex[.]site

The domain neonnexx.site has been identified as a brand impersonation threat specifically targeting Discord users. This domain was registered through NameCheap, Inc. and was hosting a page titled "Shade Network — The Private Execution Layer," which was designed to deceive visitors into believing they were interacting with a legitimate Discord-related service. Although no specific crypto drainer kit was identified, the domain's sole purpose appears to have been phishing for Discord credentials or other sensitive information.

Technical analysis reveals several red flags. VirusTotal reports that 5 out of 95 security vendors flag this domain as malicious, and it appears on three security blocklists. The domain resolves to IP address 172.67.140.117 and was created on October 15, 2025. Notably, the domain has no SSL certificate, making any data transmitted to it unencrypted and easily intercepted. AlienVault OTX also includes this domain in one threat intelligence pulse, further corroborating its malicious nature. Google Safe Browsing (GSB) status is not explicitly provided, but the blocklist presence suggests it may have been flagged.

As of the latest update, neonnexx.site has been taken offline, mitigating immediate risk. However, users should remain cautious as similar domains may appear. PhishDestroy recommends that users who may have visited this domain change their Discord passwords immediately and enable two-factor authentication. The remaining risk is low due to the domain's offline status, but vigilance against future brand impersonation attempts is advised. Always verify URLs before entering credentials, and use PhishDestroy's tools to check suspicious links.