neobulix[.]org

Analysis of neobulix.org indicates a high-risk credential phishing domain registered on February 18, 2026, through Squarespace Domains LLC. The domain remains active as of July 12, 2026, and is flagged by one security blocklist. Infrastructure reveals resolution to IP 104.21.62.71, hosted on Cloudflare infrastructure in Canada, with an SSL certificate issued by Let's Encrypt (serial E7). The HTTP response status is 200, suggesting an operational endpoint. Technologies detected include Ant Design, Cloudflare Browser Insights, and HTTP/3, consistent with modern phishing kits designed to evade detection. The page title 'Bullx | Neo Vision' may indicate an attempt to mimic a legitimate service or brand, though no specific brand impersonation has been confirmed in available intelligence. Three of 91 security vendors on VirusTotal have flagged the domain, though the absence of broader detection does not preclude malicious intent. The domain's creation date, recent registration, and use of Cloudflare for obfuscation align with common phishing tactics. Defenders should treat neobulix.org as an active threat. Block the domain and IP 104.21.62.71 at perimeter controls, monitor for connections from internal assets, and investigate any credentials submitted to this endpoint. Further analysis of the site's content and payload is recommended to determine the exact phishing mechanism and targeted entities.