nbatopshot[.]gg

The domain nbatopshot.gg was observed on July 23, 2026 and is currently offline. Registration records show the domain was created on December 19, 2025 through the registrar Key Systems (http://www.key-systems.net). DNS resolution points to the IP address 172.67.152.233, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is present, indicating the site was served over plain HTTP when active. Threat intelligence indicates the site was used for a wallet/seed phishing campaign that impersonates the “base” brand, as reflected in the page title “NBA Top Shot”.

VirusTotal analysis recorded 14 detections out of 95 scanned security vendors. The domain appears on two public blocklists and has been specifically blocked by PhishDestroy and ScamSniffer. AlienVault OTX lists the domain in three separate threat pulses, further corroborating malicious activity. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of high risk. The available evidence points to a typical credential‑stealing infrastructure that leverages Cloudflare’s CDN to obscure the origin of the malicious server.

The lack of an SSL certificate suggests the operators did not prioritize encrypted transport, potentially to simplify the phishing flow. Because the site is offline, active probing is not possible, and the exact content of the landing page remains unverified beyond the page title. Defenders should continue to block the domain and its associated IP address at network perimeters, update URL filtering feeds with the observed indicators, and monitor for any re‑registration attempts. Analysts should also watch for new domains registered by the same registrar that exhibit similar creation dates or resolve to Cloudflare IP ranges, as these may represent follow‑up campaigns.