emberlord[.]top

The domain emberlord.top was registered on 21 February 2026 and is currently taken offline. Analysis of public intelligence shows the site presented the page title “Emberlord: Most Popular Online Crypto Casino Based on Blockchain”, indicating a crypto‑casino lure. The site employed the publicly identified “Gambler Scam” phishing kit, a package commonly used to harvest credentials for cryptocurrency services. Scanning on VirusTotal recorded 13 detections out of 95 security vendors, confirming that multiple AV engines classify the host as malicious.

The SSL certificate is listed as “WE1”, which provides no assurance of legitimacy, and the Gridinsoft trust score is 0 out of 100, the lowest possible rating. Network resolution points to IP address 172.67.178.49, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States; the same IP is frequently shared by other malicious actors due to Cloudflare’s reverse‑proxy model. The domain appears on one known security blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing its classification as a threat. The combination of a recent registration, use of a known scam kit, low trust metrics, multiple vendor detections, and inclusion on blocklists suggests a high likelihood that the site was used to deceive victims into entering crypto‑related credentials or payments.

Because the site is offline, direct forensic capture of page content is not possible, leaving the exact content and any additional payloads unverified. Defenders should continue to block the domain at DNS and proxy layers, monitor for any future re‑registration of the same name, and add the associated IP address to threat‑intel feeds. Additional scrutiny of traffic to Cloudflare‑hosted IP ranges that match the observed address is advised, as attackers may shift to other domains using the same infrastructure.