neardex[.]quest

This domain, neardex.quest, was identified as a generic phishing threat and has since been taken offline. Analysis indicates the domain was registered on April 29, 2025, through Dynadot LLC, a known registrar. The domain resolves to IP address 199.59.243.228, hosted on AS16509 operated by Amazon.com, Inc., located in the United States. Its nameservers were configured to ns1.dyna-ns.net and ns2.dyna-ns.net. SSL encryption was provided via a Let's Encrypt certificate (R12).

Security vendors flagged this domain at a detection rate of 1 out of 95 on VirusTotal, indicating minimal but confirmed malicious recognition. It also appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high level of suspicion. The page title was recorded as neardex.quest, suggesting the domain was likely used to impersonate a brand or service related to the name 'Neardex', though the exact brand target is not specified in available intelligence. The phishing kit employed was an Airdrop Scam, a common technique used to deceive users into connecting cryptocurrency wallets or revealing credentials under the guise of a token distribution event.

Defenders should note that although the domain is currently offline, the infrastructure (IP, registrar, nameservers) may be reused in future campaigns. Monitoring for any new domains registered under similar patterns or using the same hosting and nameserver configuration is recommended. As no Safe Browsing or AlienVault OTX data is provided in the intelligence, further correlation with those sources could help identify additional related infrastructure. The limited detection count suggests that this domain may have been active for a short period or targeted a narrow audience, but its classification as a phishing threat is substantiated by the Airdrop Scam kit and the zero trust score.