flexy[.]9jasubplug[.]com[.]ng

The domain flexy.9jasubplug.com.ng is a phishing site engaged in brand impersonation, specifically targeting WhatsApp users. It presented itself as a service for sending money via WhatsApp under the false identity 'Flexy - Send money with WhatsApp,' aiming to deceive victims into disclosing login credentials or personal information. No crypto drainer kit was associated with this campaign. The site is currently taken offline, reducing immediate risk but not eliminating potential follow-up threats from harvested data.

Technical analysis of flexy.9jasubplug.com.ng reveals limited detection, with 2 of 95 VirusTotal security vendors flagging the domain. The registrar is listed as CC-192-3-190-184-29 (ASN: 36352), and the domain resolves to the IP address 192.3.190.186, hosted in the US under AS36352 (HostPapa). It appears on 1 security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0/100. No SSL certificate was observed, and the HTTP status returned was 429. Nameservers were not found, and no creation date is available for the domain.

Individuals who interacted with flexy.9jasubplug.com.ng should immediately change any passwords entered on the site, particularly for WhatsApp or linked accounts. Enable two-factor authentication (2FA) on all sensitive platforms to mitigate unauthorized access. Monitor financial accounts and communications for signs of fraud or identity theft. Report the phishing domain to relevant authorities, including Google Safe Browsing, PhishTank, or local cybercrime units, to aid in broader takedown efforts.