flexpay-solution[.]icu

flexpay-solution.icu was registered on March 06, 2026 through NiceNIC International Group Co., Limited and is delegated to Cloudflare’s authoritative name servers ed.ns.cloudflare.com and sneh.ns.cloudflare.com. DNS resolution points the domain to IP address 172.67.154.219, which is owned by AS13335 Cloudflare, Inc. and is geolocated to the United States. The site does not present an SSL/TLS certificate, meaning it is delivered over plain HTTP, a characteristic often observed in fraudulent landing pages. The domain is presently taken offline; it has been actively blocked by the PhishDestroy mitigation network and appears on a single external security blocklist.

VirusTotal analysis recorded one positive detection among ninety‑four scanning engines, providing a concrete indicator that at least one security vendor identified malicious behavior associated with the host. The only page title observed reads “FlexPay Solutions | Infraestructura Financiera para Liverpool,” implying an attempt to masquerade as a financial service for Liverpool, and the intelligence classification lists the scam type as a crypto scam. No public evidence of the specific payload, credential‑harvesting forms, or redirection mechanisms has been released, so the exact tactics employed by the site remain uncertain.

Defenders should ensure that perimeter firewalls and secure web gateways deny any outbound or inbound traffic to the domain and the associated Cloudflare IP, propagate the indicator set to URL filtering and threat‑intel platforms, and monitor for any resurgence of the domain or look‑alike registrations. Hosts that previously contacted the domain should be inspected for signs of credential compromise or crypto‑related fraud, and any suspicious outbound connections to known crypto‑exchange addresses should be investigated.