signalpointjs[.]online

Analysis of signalpointjs.online, observed as offline as of July 25 2026, indicates the domain is being used for a crypto‑focused phishing campaign. The site was registered on 26 February 2026 via NameCheap, Inc., and resolves to the Cloudflare address 172.67.196.5, which belongs to AS13335 in the United States. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. No SSL certificate is presented, and the authoritative name servers are craig.ns.cloudflare.com and princess.ns.cloudflare.com, confirming reliance on Cloudflare’s DNS infrastructure.

VirusTotal scans show that one of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious intent. The page title retrieved from the live snapshot reads “Signalpointjs: Most Popular Online Crypto Casino Based on Blockchain,” and the campaign has been linked to the Gambler Scam phishing kit, a known template used to lure victims into fake cryptocurrency casino offers. The classification of the threat is a Crypto Scam, consistent with the title and kit association. While the offline status prevents direct interaction, the presence of the domain on a blocklist, the lack of TLS protection, and the vendor detection collectively substantiate a credible phishing risk.

Uncertainties remain regarding the exact payload delivered to victims, the extent of credential harvesting, and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the same IP range. Defenders should immediately add signalpointjs.online to URL filtering and DNS sinkhole policies, block the associated IP 172.67.196.5 at the network perimeter, and monitor for any traffic to Cloudflare name servers that match the observed pattern. Continuous re‑scanning of the domain and its IP is recommended in case the site is re‑hosted, and any observed attempts to mimic the casino branding should be flagged for further forensic analysis.