en-ndx-x-portal[.]square[.]site

Analysis on en-ndx-x-portal.square.site indicates that the domain is actively used for phishing operations as of the report date 21 July 2026. The domain resolves to the IPv4 address 74.115.51.5 and is listed as active in the intelligence feed. Registration information shows the domain was provisioned through Square, Inc., but the authoritative name server records could not be resolved (NS_NOT_FOUND), which hampers further DNS‑based attribution. Malware scanning on VirusTotal returned a detection ratio of 8 / 95 security vendors, confirming that a subset of commercial scanners have identified malicious behavior associated with the host. The domain is currently blocked by the PhishDestroy mitigation service and appears on one external security blocklist, reinforcing its classification as high‑risk. No additional public artifacts such as Safe Browsing verdicts, Open Threat Exchange entries, SSL certificate details, HTTP response codes, or page titles have been observed, leaving those vectors unverified. The limited visibility of the hosting environment and lack of name‑server data introduce uncertainty regarding the full infrastructure scope and potential affiliate domains. Defenders should immediately add en‑ndx‑x‑portal.square.site and the associated IP address 74.115.51.5 to network‑level deny lists, configure URL filtering to block any HTTP/HTTPS requests to the domain, and monitor DNS logs for any resolution attempts. Continuous re‑query of VirusTotal and threat‑intel platforms is recommended to capture any changes in detection scores or new blocklist entries. Organizations employing email security gateways should enforce strict URL reputation checks and quarantine messages that contain redirects to this domain. Periodic passive DNS and WHOIS monitoring may reveal future name‑server updates or registration changes that could indicate further malicious activity.