bullx-neos[.]sbs

The domain bullx-neos.sbs has been identified as a high‑risk generic phishing infrastructure. Analysis flags the site as active as of the report date, July 12 2026, and assigns a unique seed of 4881f9 for tracking. The page title returned by the server is “Ray Ecommerce Solutions,” which does not correspond to any known legitimate brand and suggests the site is being used to lure victims under a commercial pretext. Infrastructure analysis shows the domain was registered on 3 November 2025 through GRANSY S.R.O operating as SUBREG.CZ. Authoritative nameservers are ns.gransy.com through ns5.gransy.com, all pointing to the same registrar. The domain resolves to IP 94.154.35.60, an address located in the Netherlands and announced by AS202412 (Omegatech LTD). No TLS certificate is present, and the web server responds with HTTP 308, indicating a permanent redirect without encryption. Reputation data corroborates the malicious assessment. The site is listed on one security blocklist, received a Gridinsoft trust score of 0 / 100, and a Scamadviser rating of 45 / 100. PhishDestroy has actively blocked the domain, and VirusTotal reports 14 of 95 scanning engines flagging it as malicious. These signals collectively reinforce the high‑risk classification, although the exact phishing kit or target page content has not been publicly disclosed. Defenders should immediately block bullx‑neos.sbs at network perimeter and add the associated IP 94.154.35.60 to deny‑list rules. Continuous monitoring of DNS queries for the domain and its MX record (mail.bullx-neos.sbs) is advised, as the mail server may be leveraged for credential harvesting. Given the lack of TLS and the presence of a permanent redirect, any attempted connections are likely to fail or be redirected to malicious payloads, reinforcing the need for proactive filtering.