vip[.]neugox[.]com

The domain vip.neugox.com is currently active and has been identified as a generic phishing infrastructure. Registration data shows the domain was created on May 12, 2026 and was registered through Fewmoretaps OU doing business as Trustname.com. DNS resolution points to the IP address 104.21.35.80, which is hosted on Cloudflare’s network and is served by the authoritative nameservers jakub.ns.cloudflare.com and maleah.ns.cloudflare.com.

Independent threat intelligence sources have placed the domain on a single security blocklist and it is also listed by PhishDestroy as a confirmed phishing site. VirusTotal analysis reports that 14 of 91 scanning engines flag the domain as malicious, indicating a moderate level of consensus among security vendors that the domain is being used for abusive activity. The available evidence does not include a page title, HTTP response codes, SSL certificate details, or any observed payload, so the exact content and phishing kit employed remain unknown.

Defenders should treat vip.neugox.com as a high‑risk indicator: the domain should be added to DNS blocklists, outbound web filtering rules should deny connections to the associated IP address, and network monitoring should alert on any attempted communications to the domain or its Cloudflare edge. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection scores, and threat‑intel feeds should be consulted for updates on related indicators of compromise. Until additional forensic evidence is gathered, the precautionary measures outlined above represent the most effective mitigation against the observed phishing threat.