flare[.]gift

The domain flare.gift was registered on May 16 2026 through Key‑Systems, LLC. It resolves to the IP address 104.21.46.104, which belongs to Cloudflare, Inc. and is geolocated to Canada. The site is served behind Cloudflare’s network and supports HTTP/3, indicating use of modern web protocols. Technical indicators show the site presents a generic phishing page titled “Just a moment…”, returning HTTP status 200. The SSL certificate is issued by Let’s Encrypt (certificate identifier E7). Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 2 of 95 scanned security vendors have flagged the domain, reflecting limited but present detection. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX cites one threat‑intelligence pulse that references flare.gift, reinforcing its inclusion in shared intel feeds. Despite these detections, the domain remains active as of the report date, July 12 2026. Defenders should implement proactive filtering for flare.gift at DNS and proxy layers, enforce TLS inspection to verify the Let’s Encrypt certificate, and monitor outbound connections to the 104.21.46.104 address. Continuous re‑evaluation of blocklist status and correlation with endpoint telemetry are recommended to mitigate exposure to this high‑risk generic phishing campaign.