Domain security and threat intelligence

fluxion.exchange

Name: fluxion.exchange — PhishDestroy evidence record
Published: 2026-02-18
License: https://creativecommons.org/licenses/by/4.0/

In short

PhishDestroy first recorded fluxion.exchange on 2026-02-18. Stored VirusTotal result: 2/89 engines flagged.

“Fluxion”

Review the evidence

Registrar: Dynadot
Resolved IP: 172.67.153.207Cloudflare, Inc. · CDN
Registered: Dec 28, 2025
First observed: Feb 18, 2026

PhishDestroy assessment Critical

81/100

Evidence score

Availability Last known active Latest stored reachability observation Observed Nov 4, 2026 · 11:45 UTCHTTP probe

Risk signals

VirusTotal detections: 2/89

VirusTotal

2 / 89

engine detections

OTX

community references

URLScan

Malicious

engine verdict · score 99

Page captures

open gallery

Domain age

311 days

registered 2025-12-28 according to RDAP · source data differ

Analysis

Domain summary

PhishDestroy first recorded fluxion.exchange on 2026-02-18. Stored VirusTotal result: 2/89 engines flagged. Risk: critical (81/100). Registrar: Dynadot. Status: Last known active. Hosting: CLOUDFLARENET - Cloudflare, Inc., US. Do not enter credentials or connect a wallet.

Critical

Status: Last known active
VirusTotal: 2 / 89
Scam type (automated label): Fake Exchange
Hosting: 172.67.153.207Cloudflare, Inc. · CDN
Registrar: Dynadot
Registered: Dec 28, 2025
OTX: 24 community refs
Page captures: 5

Page captures Source results Registration record

Recorded source summary

PhishDestroy stores a record for fluxion.exchange. Source observations are dated separately; missing checks do not establish safety.

A reviewed analysis is not available for this text revision. Consult the dated source records below.

Source evidenceVirusTotal 2 / 89 · OTX 24 references 9 sources

VirusTotal

2 / 89 engine detections

Retrieved / checked: 2026-09-19 04:30:17 · as stored; legacy timezone not established

Open report

URLScan

Malicious · engine verdict · score 99

2026-02-18 15:16 UTC

Open report

URLScanOriginal source recordObserved: 2026-02-18 15:16:39 UTC25 fields

Observed: 2026-02-18T15:16:39Z · Retrieved: 2026-10-23T16:24:42Z

Report ID

019c7152-f466-77bd-b6f2-f30cca5b8462

Final URL

https://fluxion.exchange/

HTTP response

200

Redirect type

https-only

Redirects

To
https://fluxion.exchange/
From
http://fluxion.exchange/
Status
307

IP address

172.67.153.207

Contacted domains

api.web3modal.org
cca-lite.coinbase.com
api.ipify.org
cdnjs.cloudflare.com
fonts.googleapis.com
secure.walletconnect.org
cdn.jsdelivr.net
pulse.walletconnect.org
app.fluxion.network

Contacted IP addresses

142.250.186.42
104.20.34.30
104.18.35.15
104.16.175.226
172.67.74.152
104.17.24.14
104.18.19.237
172.66.157.155
64.29.17.1
172.67.153.207

Autonomous systems (ASN)

15169
13335
16509

Server countries

Linked domains

fluxion-dex.notion.site
x.com
github.com
app.mantle.xyz
refuel.mantle.xyz
metamask.io
learn.rainbow.me

Social media links

https://x.com/Fluxion_dex
https://github.com/exvulsec/auditreport/blob/main/Smartcontract/Fluxion%20Smart%20Contract%20Audit%20Report-Exvul.pdf

Document hash

352cb627321b3d552a2e3a489b5a888cc1929626c69c09f60256bf67f129f8fb

Script hashes

259e1f3489defc1955dbfd86397244101e2f623dc20135f811345e5d822d60e3
8b2f4a74bc4e0f5fb3094c65e4e9eb00af8a25058c4e43c0299c07f52ce3d1af
88485a0dc8464b3161161a9f5de6e7527843fd611be68abc5ca9e6c691aacf4c
3d297c79a3be0dd50228acbaaa2b43135678b824f1668694a4c48fa9218cddc8
e34728b0e6c8910f7d4250d2ee2e5e8fd45a1095fc05fbf5bc21ae15b1971dba
d440f0c765bcca845aa4ce558f2ab8196deb8bc540c6139441d9d61f91101d92
4b110016758f5a65dac165b91bfbba9523cf098ac2b9755a294c8e2b8d5b15d0
64a37fc9f02e6cca8ef01e03d81e3f9594e57c0d8d791cb1adb026d1d2f8d66a
68e0f9f10a713647011aaa5be6b70877c955262b906eb9a6ae25d29bd7c804c6
fe872ba9f3ea5595f2f53a32500ca94f8939ffa55eaaf294a6cd514acb8f7adc

JavaScript globals

crashReport
do‌
const‌‌‌‌‌
return‌‌‌‌
while‌‌‌‌‌
__globalObject
__TextDecoder
__Uint8Array
__String
__Array
utf8ArrayToStr
import‌‌‌‌
finally‌‌‌
true‌‌‌‌‌‌
throw‌‌‌‌‌
false‌‌‌‌‌
else‌‌‌‌‌‌
try‌‌‌‌‌‌‌
public‌‌‌‌
export‌‌‌‌‌
yield‌‌‌‌‌‌
throw‌‌‌‌‌‌
of‌‌‌‌‌‌‌‌‌
default‌‌‌‌
debugger‌‌‌
false‌‌‌‌‌‌
e46jvfbmmj
__next_f
ensureButton
myconnections
webpackChunk_N_E
next
_N_E_STYLE_LOAD
_walletConnectCore_clientTwo_count
downloadLogsBlobInBrowser
_walletConnectCore_clientTwo
_walletConnectCore_clientOne_count
_walletConnectCore_clientOne
ClientAnalytics
litPropertyMetadata

Cookies

gacfxdn1x7
__cf_bm
_cfuvid

Browser storage keys

wagmi.store
rk-version
cbwsdk.store
@appkit/active_caip_network_id
@appkit/active_namespace
@appkit/connection_status

TLS session and certificate

Subject alternative names: fluxion.exchange
*.fluxion.exchange
Cipher: AES_128_GCM
Issuer: WE1
Subject: fluxion.exchange
Protocol: QUIC
Valid until: 2026-05-07 04:37:20 UTC
Valid from: 2026-02-06 03:39:40 UTC

Domain age, days

231

Differs from the registration date in RDAP (2025-12-28), which gives 52 days on the scan date 2026-02-18. The two sources disagree; both values are kept as recorded.

Registered domain age, days

231

Differs from the registration date in RDAP (2025-12-28), which gives 52 days on the scan date 2026-02-18. The two sources disagree; both values are kept as recorded.

Certificate age, days

Certificate validity, days

Page requests

118

Provider verdicts

Engine verdict

Tags: urlscan-ml
urlscan-ml-60c5e22
Score: 99
Malicious: Yes

Overall verdict

Score: 0
Malicious: No

HTTP headers

Server: cloudflare
Content-type: text/html
Priority: u=0,i

Original source fields · JSON

Uuid	019c7152-f466-77bd-b6f2-f30cca5b8462
Final url	https://fluxion.exchange/
Status	200
Redirected	https-only
Redirects	[ { "to": "https://fluxion.exchange/", "from": "http://fluxion.exchange/", "status": 307 } ]
Ip	172.67.153.207
Contacted domains	[ "api.web3modal.org", "cca-lite.coinbase.com", "api.ipify.org", "cdnjs.cloudflare.com", "fonts.googleapis.com", "secure.walletconnect.org", "cdn.jsdelivr.net", "pulse.walletconnect.org", "app.fluxion.network" ]
Contacted IP addresses	[ "142.250.186.42", "104.20.34.30", "104.18.35.15", "104.16.175.226", "172.67.74.152", "104.17.24.14", "104.18.19.237", "172.66.157.155", "64.29.17.1", "172.67.153.207" ]
Asns	[ "15169", "13335", "16509" ]
Countries	[ "US" ]
Linked domains	[ "fluxion-dex.notion.site", "x.com", "github.com", "app.mantle.xyz", "refuel.mantle.xyz", "metamask.io", "learn.rainbow.me" ]
Social	[ "https://x.com/Fluxion_dex", "https://github.com/exvulsec/auditreport/blob/main/Smartcontract/Fluxion%20Smart%20Contract%20Audit%20Report-Exvul.pdf" ]
Document hash	352cb627321b3d552a2e3a489b5a888cc1929626c69c09f60256bf67f129f8fb
Script hashes	[ "259e1f3489defc1955dbfd86397244101e2f623dc20135f811345e5d822d60e3", "8b2f4a74bc4e0f5fb3094c65e4e9eb00af8a25058c4e43c0299c07f52ce3d1af", "88485a0dc8464b3161161a9f5de6e7527843fd611be68abc5ca9e6c691aacf4c", "3d297c79a3be0dd50228acbaaa2b43135678b824f1668694a4c48fa9218cddc8", "e34728b0e6c8910f7d4250d2ee2e5e8fd45a1095fc05fbf5bc21ae15b1971dba", "d440f0c765bcca845aa4ce558f2ab8196deb8bc540c6139441d9d61f91101d92", "4b110016758f5a65dac165b91bfbba9523cf098ac2b9755a294c8e2b8d5b15d0", "64a37fc9f02e6cca8ef01e03d81e3f9594e57c0d8d791cb1adb026d1d2f8d66a", "68e0f9f10a713647011aaa5be6b70877c955262b906eb9a6ae25d29bd7c804c6", "fe872ba9f3ea5595f2f53a32500ca94f8939ffa55eaaf294a6cd514acb8f7adc" ]
Globals	[ "crashReport", "do‌", "const‌‌‌‌‌", "return‌‌‌‌", "while‌‌‌‌‌", "__globalObject", "__TextDecoder", "__Uint8Array", "__String", "__Array", "utf8ArrayToStr", "import‌‌‌‌", "finally‌‌‌", "true‌‌‌‌‌‌", "throw‌‌‌‌‌", "false‌‌‌‌‌", "else‌‌‌‌‌‌", "try‌‌‌‌‌‌‌", "public‌‌‌‌", "export‌‌‌‌‌", "yield‌‌‌‌‌‌", "throw‌‌‌‌‌‌", "of‌‌‌‌‌‌‌‌‌", "default‌‌‌‌", "debugger‌‌‌", "false‌‌‌‌‌‌", "e46jvfbmmj", "__next_f", "ensureButton", "myconnections", "webpackChunk_N_E", "next", "_N_E_STYLE_LOAD", "_walletConnectCore_clientTwo_count", "downloadLogsBlobInBrowser", "_walletConnectCore_clientTwo", "_walletConnectCore_clientOne_count", "_walletConnectCore_clientOne", "ClientAnalytics", "litPropertyMetadata" ]
Cookies	[ "gacfxdn1x7", "__cf_bm", "_cfuvid" ]
Storage keys	[ "wagmi.store", "rk-version", "cbwsdk.store", "@appkit/active_caip_network_id", "@appkit/active_namespace", "@appkit/connection_status" ]
Tls	{ "san": [ "fluxion.exchange", "*.fluxion.exchange" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "fluxion.exchange", "protocol": "QUIC", "valid_to": "2026-05-07T04:37:20Z", "valid_from": "2026-02-06T03:39:40Z" }
Domain age days	231 Differs from the registration date in RDAP (2025-12-28), which gives 52 days on the scan date 2026-02-18. The two sources disagree; both values are kept as recorded.
Apex age days	231 Differs from the registration date in RDAP (2025-12-28), which gives 52 days on the scan date 2026-02-18. The two sources disagree; both values are kept as recorded.
Tls age days	12
Tls valid days	90
Requests	118
Provider verdicts	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }
HTTP headers	{ "server": "cloudflare", "content-type": "text/html", "priority": "u=0,i" }

Separate monitor record · date not recorded

Separate stored monitor snapshot; does not replace the primary report record or establish current availability.

record_source: domain_monitor.urlscan
uuid: 019c7152-f466-77bd-b6f2-f30cca5b8462
report_url: https://urlscan.io/result/019c7152-f466-77bd-b6f2-f30cca5b8462/
score: null
malicious: null
result_at: null
enriched_at: 2026-03-27T12:07:51Z
source_timestamps: {"urlscan_result_at":null,"urlscan_enriched_at":"2026-03-27 13:07:51"}
timestamp_basis: Europe/Berlin, as used by the existing report; source timestamps are retained verbatim

URLQuery

checked — no detections recorded

2026-10-25 13:28 UTC

Open report

OTX

24 community references

2026-10-27 23:37 UTC

Open report