flexcontrol[.]app

Analysis of the domain flexcontrol[.]app indicates active phishing infrastructure targeting users through a generic marketplace-themed lure. The domain was registered on March 04, 2026, and remains operational as of July 12, 2026, resolving to the IP address 89.117.9.62. It appears on two security blocklists, PhishDestroy and BLP-Malware, and is flagged by 4 out of 95 security vendors on VirusTotal. The domain has also been referenced in 25 threat intelligence pulses within AlienVault OTX, suggesting broader recognition of its malicious nature. Technical indicators reveal the use of common web technologies, including WordPress, MySQL, PHP, and LiteSpeed, alongside client-side libraries such as Underscore.js, jQuery Migrate, and jQuery. The domain is hosted on infrastructure associated with Hostinger and secured with a Let's Encrypt SSL certificate, which provides encryption but does not validate the legitimacy of the site. The page title, 'Marketplace,' aligns with the phishing classification, though the exact nature of the fraudulent activity—whether it involves credential harvesting, payment redirection, or other schemes—remains unconfirmed due to the absence of deeper content analysis. The domain's registration through GoDaddy.com, LLC, and its low Gridinsoft trust score of 0 out of 100 further support its classification as high-risk. While the infrastructure appears typical for a phishing operation, no specific brand impersonation or scam subtype has been identified in available data. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS or network level. Additional monitoring of related IP addresses and certificate issuances may help identify connected infrastructure, though no direct links to other campaigns have been established at this time.