flash[.]buyaccounts[.]store

The domain flash.buyaccounts.store was observed hosting a credential‑phishing page identified by the title “Flash BTC USDT Instantly – Flash Crypto Instantly”. The site was taken offline prior to the report date of 24 July 2026, and no TLS certificate was presented when the HTTP service was probed, indicating that traffic was unencrypted. Registration data show the domain was created on 21 February 2026 through NameCheap, Inc., and it resolves to the IPv4 address 162.55.65.66, which belongs to the Hetzner Online GmbH network (AS24940) located in Germany. DNS resolution is handled by ns1.goviralhost.com and ns2.goviralhost.com.

Reputation checks reveal a Scamadviser trust score of 25 / 100 and a Gridinsoft score of 0 / 100, both reflecting a high likelihood of malicious intent. VirusTotal analysis recorded detections by two of ninety‑three scanning engines, and the domain appears on a single external blocklist. PhishDestroy has also listed the domain as blocked.

The site is classified as a credential‑phishing operation that impersonates the brand “across”, though the exact nature of the impersonated content cannot be confirmed without visual inspection of the page. Given the observed infrastructure, defenders should add the domain and its resolving IP address to URL and IP blocklists, enforce TLS inspection for outbound connections to the host, and monitor for any future re‑registration of the same name or use of the same name servers. Continuous tracking of the Hetzner AS24940 range for similar phishing deployments is advisable, as is periodic re‑scanning of the domain should it become active again.