flux-ti5[.]shop

Analysis indicates that flux-ti5.shop remains active under a high-risk classification tied to generic phishing. The domain resolves to IP 172.67.165.196 in the United States under AS13335 Cloudflare, Inc. and uses nameservers garrett.ns.cloudflare.com plus grannbo.ns.cloudflare.com. Detected technologies include PHP, Cloudflare Browser Insights, Cloudflare, and HTTP/3. The certificate was issued by Google Trust Services under the WE1 profile, and the server returns HTTP status 200. Registration was completed through Cloudflare, Inc.

The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. VirusTotal shows 4 detections out of 95 vendors while Gridinsoft records a trust score of 0 out of 100. The page title contains Korean text referencing non-face-to-face loans, same-day deposits, easy limit checks, and small loans for business owners, workers, and freelancers along with a reference to gnuboard5. No brand name is present in the supplied data, so the site is treated as a generic phishing domain. Exact page content has not been examined beyond the title string.

Defenders should add the observed IP and nameservers to internal block lists and monitor for HTTP/3 traffic to 172.67.165.196. Continued tracking of the single blocklist appearance and the low VirusTotal count is advised, as these metrics alone do not confirm or refute the high-risk label. Any future changes to the nameserver or certificate configuration should trigger immediate re-evaluation of the domain's status.