voting-flarefdn[.]xyz

This domain operates as a fraudulent crypto rewards portal designed to steal user credentials and private keys from Flare (FLR) token holders. The site mimics legitimate Flare Network reward programs, presenting a fake voting interface that prompts visitors to connect wallets or enter sensitive account details. Once credentials are captured, attackers can drain associated crypto assets or gain unauthorized access to user accounts on the genuine Flare platform. Analysis indicates multiple high-confidence indicators of malicious activity. The domain was registered on June 18, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent operations. Security vendors on VirusTotal flag this domain at a 4/95 detection rate, with specific classifications including credential theft and brand impersonation. Infrastructure analysis reveals the site resolves to 104.21.47.153, hosted behind Cloudflare's network (AS13335), which is commonly used to obscure malicious infrastructure. The SSL certificate issued by Google Trust Services provides a false sense of security while the site remains active on three security blocklists. If you visited voting-flarefdn.xyz and entered any credentials or connected a wallet, immediate action is required. First, revoke all connected wallet permissions through the official Flare Network interface. Next, transfer all assets from the compromised wallet to a new, secure wallet address. Monitor all linked accounts for unauthorized transactions and enable additional security measures such as hardware-based authentication. Report the incident to the legitimate Flare Network support team and consider filing a report with your local cybercrime authority. Do not interact with any communications claiming to be from Flare regarding this incident, as they may be additional phishing attempts.