vexquis[.]com

Analysis of vexquis.com indicates an active phishing infrastructure registered on October 2, 2025, through Gname.com Pte. Ltd. The domain resolves to 188.114.97.3 and is protected by Cloudflare, utilizing HTTP/3 and HSTS protocols. Detected technologies include Vue.js and Marked, suggesting a dynamic frontend framework commonly employed in credential-harvesting or fraudulent sites. The page title, 'VEXQUIS,' provides no explicit brand association, and no specific scam type or targeted brand has been confirmed at this stage. As of July 12, 2026, the domain is flagged by 6 of 95 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy and OISD. AlienVault OTX records 22 threat intelligence pulses referencing this domain, reinforcing its classification as malicious. The SSL certificate is issued by Google Trust Services, a common but not exclusive indicator of legitimacy, often exploited to lend false credibility to phishing pages. Infrastructure analysis reveals no anomalous registration patterns, though the use of Cloudflare may obscure origin server details and impede takedown efforts. Defenders should treat this domain as high-risk, particularly in environments where user authentication or financial transactions occur. Blocking at the DNS or network level is recommended, alongside monitoring for related subdomains or IP associations. Further analysis of the site’s content and backend behavior is required to determine the exact phishing methodology or targeted sector.