formly-x[.]com

This domain, formly-x.com, is identified as a credential harvesting phishing site designed to mimic legitimate login portals. Analysis indicates no direct association with a specific brand, though the use of technologies such as Chart.js and jsDelivr suggests an attempt to replicate interactive form functionality. The infrastructure does not align with known drainer kits, but the presence of HSTS and Let’s Encrypt SSL certificates may be intended to lend a false sense of legitimacy to potential victims. Infrastructure analysis reveals the domain was registered on April 14, 2026, through GMO Internet, Inc., and resolves to the IP address 54.92.60.118. It is flagged by 5 out of 95 security vendors on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. No entries were found in Google Safe Browsing at the time of assessment, though this may reflect detection lag rather than absence of malicious activity. The domain is currently offline, reducing immediate risk of user exposure. However, the infrastructure remains registered and could be reactivated or repurposed. Network defenders should monitor for re-emergence on the same IP or registrar, particularly if paired with similar technologies or SSL patterns. Organizations are advised to preemptively block the domain and IP in perimeter defenses and update detection rules to account for the observed technical indicators, including the use of Ubuntu, Nginx, and third-party script delivery via jsDelivr.