floarex[.]com

Analysis of floarex.com indicates a confirmed brand impersonation campaign targeting x.com, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, and resolves to IP address 104.21.36.238, hosted on Cloudflare's infrastructure (AS13335) in the United States. The SSL certificate is issued by WE1, a provider commonly used for both legitimate and malicious domains, offering no definitive signal on its own. The page title 'Just a moment...' suggests a Cloudflare interstitial or proxy challenge page, which may have been used to obscure the actual phishing content from automated scanners or security researchers.

The domain appears on at least one security blocklist (PhishDestroy) and is flagged by 2 of 95 security vendors on VirusTotal, confirming detection by multiple independent sources. While the domain is currently offline, defenders should treat it as a high-confidence indicator of compromise (IOC) for x.com brand impersonation. The use of Cloudflare hosting is consistent with phishing campaigns seeking to evade IP-based blocking and leverage the provider's reputation to delay takedowns. No evidence of a specific phishing kit or additional infrastructure (e.g., redirect chains, associated domains) is present in the available data.

The domain's creation date (February 2026) and rapid detection suggest it was likely deployed for short-term use, a common tactic in brand impersonation attacks. Defenders are advised to block the domain at the DNS and proxy levels, monitor for re-registration or re-emergence on new IPs, and correlate with other x.com-themed domains registered during the same period. If internal logs show any traffic to floarex.com, investigate for credential theft or unauthorized access linked to the x.com brand.