neonstake[.]com

Analysis of neonstake.com shows it is an active crypto‑drainer site. The domain was registered on 16 July 2025 through NameCheap and resolves to IP 188.114.96.3, which belongs to AS13335 operated by Cloudflare in the United States. DNS is hosted on darwin.ns.cloudflare.com and nancy.ns.cloudflare.com, and the site serves a 301 redirect over HTTPS using a Google Trust Services certificate (WE1). The HTTP response contains the page title “BetFoxx | Casino & Sportsbook”, indicating the site is masquerading as an online gambling platform. MX records point to webhosting2012.is.cc, a host often associated with disposable mail services. Infrastructure fingerprints reveal Microsoft ASP.NET on Nginx behind Cloudflare, with client‑side components such as LiveChat, Hotjar, Google Analytics and cdnjs. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy. VirusTotal scans show one of ninety‑five vendors flagged the site, and the observed phishing kit is identified as the “Gambler Scam”, a toolkit frequently used to lure victims into sending cryptocurrency to fraudulent wallets. While the available evidence confirms the presence of a gambling‑themed phishing kit and infrastructure typical of crypto‑drainer operations, the exact wallet addresses or transaction flow have not been publicly disclosed. Defenders should add neonstake.com to blocklists for web and email gateways, monitor outbound connections to the resolved IP, and enforce strict validation of any cryptocurrency transaction requests that reference the domain. Continuous threat‑intel feeds should be consulted for updates on associated wallet addresses or new detections.