truoasisfluxx[.]online

The domain truoasisfluxx.online was registered on May 17, 2026 through Ultahost, Inc. and is currently resolved to the IPv4 address 198.251.84.200, which is geolocated to Luxembourg and associated with the organization FranTech Solutions. The authoritative name servers ns5.asurahosting.com and ns6.asurahosting.com serve the domain, and the site presents a valid Let's Encrypt R12 TLS certificate, indicating that HTTPS connections are correctly negotiated. HTTP requests return a 200 status code and the rendered page carries the title "Truoasisfluxx - Loans - Personal and Business," a typical lure used to entice victims into disclosing personal or financial information.

Threat intelligence sources provide corroborating signals: AlienVault OTX includes the domain in a single pulse, and the domain appears on one external blocklist where it is explicitly flagged by PhishDestroy. VirusTotal analysis shows three out of ninety‑five scanners raising detections, while Gridinsoft assigns a trust score of 32 out of 100, reflecting a low confidence in the site’s legitimacy. The combination of a recent registration, a low trust score, and active blocklist listings aligns with a high‑risk profile for credential‑stealing operations targeting loan‑related inquiries.

Defenders should prioritize immediate containment of truoasisfluxx.online. Recommended actions include adding the domain and its resolving IP (198.251.84.200) to DNS and web‑filtering deny lists, monitoring outbound traffic for connections to the identified name servers, and deploying heuristic email filters that flag messages referencing loan offers or the phrase "Truoasisfluxx." Continuous re‑evaluation is advised, as future observations may reveal additional indicators such as payload delivery mechanisms or compromised user accounts. Maintaining up‑to‑date threat feeds and correlating internal logs with the listed indicators will enhance detection and response capabilities against this active phishing campaign.