eomox[.]com

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of x.com. Analysis indicates the site mimics legitimate x.com login or verification pages, likely to harvest credentials or distribute malicious payloads under the guise of the targeted brand. The domain has been active since March 31, 2017, and exhibits infrastructure consistent with phishing operations, including Cloudflare hosting and protective fronting mechanisms. Infrastructure analysis reveals the domain is registered through Cloudflare, Inc., and resolves to IP address 172.67.174.164, located within AS13335 (Cloudflare, Inc.) in the United States. Security vendor detections on VirusTotal stand at 3 out of 95, indicating limited but confirmed malicious classification. The domain appears on at least one security blocklist and is actively blocked by enterprise phishing detection systems. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare’s network. The page title, 'Attention Required! | Cloudflare,' suggests the use of Cloudflare’s anti-bot challenge page, a tactic frequently employed to obscure phishing content from automated scanners. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP (172.67.174.164) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) including the domain, IP, and SSL certificate thumbprint into security tools to prevent access. End-user education should emphasize verifying the authenticity of x.com-related communications, particularly those prompting login or account verification. Security teams are advised to monitor for credential harvesting attempts originating from this domain and investigate any related authentication logs for unauthorized access. Given the domain’s long-standing registration and Cloudflare hosting, continued vigilance is required as threat actors may rotate infrastructure or re-deploy the domain for future campaigns.