ndxx-app[.]created[.]app

This domain, ndxx-app.created.app, is flagged as an elevated-risk fake login portal designed to harvest user credentials. Analysis indicates the infrastructure was configured to impersonate legitimate authentication pages, a common tactic in credential phishing campaigns. The domain exhibits characteristics consistent with targeted attacks against users of web-based services, where unsuspecting victims are redirected to fraudulent login interfaces. Infrastructure analysis reveals the domain was registered on July 12, 2023, through Tucows Domains Inc. and resolves to the IP address 18.208.88.157. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains due to its accessibility. Detection metrics show the domain appears on one security blocklist, with a Gridinsoft trust score of 0/100. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious. The page title, 'Site not found,' suggests the domain may have been taken offline or reconfigured post-detection, though residual risk remains for users who interacted with it prior to removal. Mitigation steps for this specific threat type include immediate credential rotation for any accounts accessed via this domain. Users should enable multi-factor authentication on all sensitive accounts to mitigate the impact of stolen credentials. Network administrators are advised to block the domain and its resolving IP (18.208.88.157) at the perimeter level. Organizations should also monitor for anomalous login attempts originating from the IP or associated infrastructure. Given the domain’s registration date and detection timeline, historical log analysis is recommended to identify potential prior exposure.