florix[.]tech

This domain, www.florix.tech, is flagged as an active crypto airdrop scam infrastructure as of July 12, 2026. Analysis indicates the site presents itself as a 'Crypto Airdrop Hub,' a common lure for fraudulent cryptocurrency schemes. The domain was registered on January 3, 2026, through HOSTINGER operations, UAB, and currently resolves to IP address 187.77.109.199, hosted on AS47583 (Hostinger International Limited) in Lithuania. Nameservers are configured as ns1.dns-parking.com and ns2.dns-parking.com, a pattern observed in other phishing operations leveraging low-cost or automated hosting solutions. Infrastructure analysis reveals the use of Ubuntu and Nginx, typical for phishing kits designed to mimic legitimate cryptocurrency platforms. The SSL certificate (identifier E8) does not provide additional trust indicators, as such certificates are routinely issued for malicious domains. The domain is currently blocked by one security vendor (PhishDestroy) and is flagged by 12 of 94 security vendors on VirusTotal, confirming its classification as malicious. The Gridinsoft trust score of 0/100 further supports the high-risk assessment. While the exact mechanics of the scam remain unconfirmed due to lack of deeper behavioral analysis, the combination of a crypto-themed page title, recent registration, and detection by multiple security vendors aligns with known airdrop scam tactics. Defenders should treat this domain as active phishing infrastructure and implement blocking measures at the DNS, IP, and certificate levels. Additional monitoring of associated IP ranges and nameservers may reveal related malicious activity.