insiderx[.]fi

Analysis of insiderx.fi shows a short‑lived domain that was created on 21 February 2026 and is presently taken offline, returning a 522 connection‑timed‑out page title. The domain resolves to the IPv6 address 2606:4700:3036::ac43:c7a2, which belongs to Cloudflare’s AS13335 network in the United States. DNS resolution is handled by greg.ns.cloudflare.com and amanda.ns.cloudflare.com, confirming that the site was protected by Cloudflare and was serving content over HTTP/3. The TLS certificate presented is issued by Google Trust Services under the WE1 certificate profile, indicating a valid SSL chain at the time of observation.

Intelligence feeds have listed the domain on two blocklists and two commercial detection platforms (PhishDestroy and ScamSniffer) have flagged it as malicious. VirusTotal reports that 2 of 93 scanners flagged the domain, providing additional corroboration of its malicious nature. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of high risk.

While the exact phishing content has not been captured, the combination of a recent registration, Cloudflare‑hosted infrastructure, a valid Google‑issued certificate, and multiple independent detections strongly suggests a purpose‑built phishing operation. Defenders should add insiderx.fi to blocklists, deny outbound connections to its IP address, and monitor for any residual traffic from internal hosts. Because the site is offline, investigators should still preserve logs that reference the domain and consider threat‑intel sharing with partners to prevent future abuse of the same infrastructure.