flarefoundation-rewards[.]xyz

PhishDestroy identifies flarefoundation-rewards.xyz as an active crypto drainer domain under investigation for impersonating reward programs. The site leverages deceptive branding to trick users into connecting wallets or submitting seed phrases, enabling direct fund theft. Current risk level remains under_investigation, but the absence of detections on VirusTotal (5/95) demands urgent attention. This domain was flagged by PhishDestroy with the following indicators: registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolving to IP 172.67.165.147, and created on June 24, 2026. VirusTotal shows 0 detections despite active hosting, while IP 172.67.165.147 is associated with Cloudflare infrastructure—a common tactic to obscure malicious origins. The domain’s recent creation and clean VT score suggest either a newly launched campaign or evasion of detection mechanisms. Mitigation requires immediate blocking of flarefoundation-rewards.xyz at the network level (DNS, firewall, or endpoint solutions). Users must verify reward program URLs manually and avoid clicking unsolicited links. Wallet extensions should be checked for unauthorized connections, and seed phrases must never be shared. Report this domain to security teams and cryptocurrency platforms to prevent further victimization.