neostiq[.]com

PhishDestroy identifies neostiq.com as an elevated-risk domain involved in active invoice-themed phishing campaigns targeting corporate users. The site leverages social-engineering tactics designed to trick finance teams into approving fraudulent payments disguised as legitimate vendor invoices. Security telemetry confirms the threat is live and propagating via email spam runs.

This domain was flagged by 1 out of 95 VirusTotal security vendors on the day of creation—January 11, 2026—via registrar Realtime Register B.V. It resolves to IP 104.21.13.209 and currently carries a Google Trust Services SSL certificate, which may lend false legitimacy to unsuspecting visitors. Despite the short lifespan, neostiq.com has not yet appeared on any public blocklists, leaving open a narrow window for defenders to block it before wider abuse.

To mitigate the invoice phishing risk, immediately block neostiq.com and the underlying IP 104.21.13.209 at your perimeter. Scan mailboxes for messages containing URLs or attachments referencing neostiq.com; quarantine and investigate any matches. Update user awareness training to highlight red flags such as mismatched domains, urgency language, and unusual banking instructions. Monitor certificate transparency logs for additional neostiq-branded domains and consider preemptive domain blocking if corroborating threat intelligence emerges.