florexy[.]com

The domain florexy.com was registered on 2026-03-06 through NiceNIC International Group Co., Limited. Intelligence classifies it as a generic_phishing campaign delivering a fake cryptocurrency exchange front‑end. The risk rating is high and the campaign remains active as of the 2026‑07‑12 report. Infrastructure analysis shows the domain resolves to 104.21.21.83, an address owned by AS13335 Cloudflare, Inc., located in the United States. Both authoritative name servers, annalise.ns.cloudflare.com and jim.ns.cloudflare.com, are hosted on Cloudflare’s network, indicating the attacker is leveraging a reputable CDN to hide origin infrastructure. The site serves a valid TLS certificate from Let’s Encrypt (E8), and HTTP requests return a 200 status with the title “Florexy: Secure Cryptocurrency Exchange | Buy & Trade Crypto”. Detection signals are limited but notable. VirusTotal reports a single positive detection out of 95 scanning engines, suggesting early-stage awareness among security vendors. Gridinsoft assigns a trust score of 0/100, effectively flagging the domain as malicious. The URL appears on one public blocklist maintained by PhishDestroy, confirming that at least one downstream provider is already blocking access. Defenders should block DNS resolution for florexy.com and any associated subdomains, enforce TLS inspection to intercept the fraudulent front‑end, and monitor outbound traffic to the Cloudflare IP range for suspicious credential submissions. Incident response teams should also educate users about the counterfeit exchange narrative and advise verification of legitimate exchange URLs before providing any personal or financial information.