vertexneobase[.]digital

This domain is flagged as an elevated-risk brand impersonation threat targeting X.com users. Analysis indicates the infrastructure was configured to deceive victims into disclosing login credentials or other sensitive information by mimicking the authentic platform. The domain is currently offline but was operational long enough to establish malicious intent and technical indicators of compromise. Infrastructure analysis reveals vertexneobase.digital resolved to IP address 104.21.5.116, hosted on Cloudflare's network (AS13335) in the United States. The domain was registered through Cloudflare, Inc., a common tactic to obscure ownership and leverage proxy services. The page title 'Welcome to nginx!' suggests a default server configuration, often used in phishing kits to quickly deploy fraudulent login portals. VirusTotal reports 11 out of 95 security vendors flagged this domain as malicious, while it appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy to unsuspecting users. The domain is also blocked by PhishDestroy, further confirming its classification as a phishing threat. Mitigation steps for this specific threat type include immediate blacklisting of the domain and its associated IP address (104.21.5.116) across all network security controls. Organizations should update endpoint protection rules to detect and block access to domains with similar naming patterns (e.g., 'neobase,' 'vertex') impersonating X.com. Security teams are advised to monitor for credential reuse attempts, particularly from users who may have interacted with this domain prior to its takedown. Additionally, user awareness training should emphasize the risks of default server pages (e.g., nginx welcome screens) as red flags for phishing sites. Network logs should be reviewed for any prior connections to this domain or its IP to assess potential compromise.