account[.]vertextrust[.]org

Analysis of www.account.vertextrust.org shows a high‑risk credential‑phishing infrastructure that remains active as of July 20 2026. The domain resolves to 66.45.252.178, an IP owned by Interserver, Inc. in the United States. Registration was performed through Dynadot Inc., and the authoritative nameservers are ns5.nameserveit.com and ns6.nameserveit.com. The site presents a TLS certificate issued by Let’s Encrypt (identifier YE2), confirming encrypted transport but offering no indication of legitimate ownership. HTTP requests return a 200 status code while the page title reported by the scanner is “403 Forbidden,” suggesting a possible misconfiguration or intentional response obfuscation. VirusTotal scans indicate that 11 of 91 security vendors have flagged the domain, and it appears on a single external blocklist. The domain is currently blocked by the PhishDestroy feed, reinforcing confidence in its malicious intent. While the exact phishing landing page content has not been captured, the combination of active status, high‑risk rating, and multiple vendor detections warrants immediate defensive action. Organizations should add the domain to network and DNS blocklists, monitor outbound connections to the associated IP address, and enforce credential‑security controls such as multi‑factor authentication to mitigate potential credential theft. Continuous re‑evaluation is advised, as additional indicators may emerge from future traffic analysis.