# PhishDestroy domain threat record: flarenetwork.mom

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/flarenetwork.mom/
Machine-readable companion: https://phishdestroy.io/domain/flarenetwork.mom/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-29 04:40:33 UTC
- Last availability or vendor check: 2026-10-21 02:06:45 UTC
- Stored record updated: 2026-10-22 14:22:18 UTC
- VirusTotal detections in the stored snapshot: 10/91
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Eranet International Limited
- Registrar country in stored WHOIS data: Unknown
- Registration date (registry RDAP, flarenetwork.mom): 2026-09-27 21:39:23 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eb91-fed0-726e-806a-dd733d3bb94f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/flarenetwork.mom
- Certificate Transparency search: https://crt.sh/?q=%25.flarenetwork.mom
- Web Archive lookup: https://web.archive.org/web/*/https://flarenetwork.mom/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
flarenetwork.mom posed as the official site of Flare Network, using the title "Flare: The blockchain for data" to pass as the real project. It targeted Flare users and FLR holders who might land on a lookalike domain while searching for the network or its tools. PhishDestroy first flagged it on 2026-09-29. The site has been offline since 2026-09-30 and was still dead at the last check on 2026-10-19.

How the scam works
Impersonation pages like this one copy a project's branding so visitors trust them, then steer them toward an action that hands over control of their funds. In crypto schemes, that action is usually connecting a wallet and signing a transaction, or typing a recovery phrase into a fake form. The signed transaction can quietly approve token transfers to the attacker. A leaked seed phrase gives away the whole wallet. Either way, the victim can lose every asset the wallet holds, and on-chain transfers cannot be reversed.

Evidence
Ten of 91 VirusTotal engines flagged the domain on 2026-09-29, including ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, Kaspersky, Netcraft and Webroot. That is a modest count, but the flagging vendors are mainstream ones. urlscan.io returned a malicious verdict and recognized the Flare Network brand on the page. Beyond PhishDestroy, the domain is on the MetaMask and SEAL blocklists, both of which focus specifically on threats to crypto wallets.

Infrastructure
The domain was registered on 2026-09-27 through Eranet International Limited and was caught two days later. It went dark one day after that, a short lifespan typical of throwaway phishing domains. The .mom extension has nothing to do with Flare, so the brand name in front of it is doing all the work. The site sat behind Cloudflare, with an IP located in Canada, which hides where the real server lives. Its Let's Encrypt certificate only means the connection was encrypted; the padlock says nothing about who runs the site.

What to do
If you connected a wallet to this site, use a token-approval revocation tool to review and revoke any approvals you don't recognize, and move your funds to a fresh wallet if anything looks wrong. If you entered a seed phrase or private key, treat that wallet as compromised: create a new wallet with a new phrase and transfer whatever remains right away. Only reach Flare through bookmarks or links from the project's verified channels. Defenders should block the domain and look for similar Flare lookalikes registered on unrelated extensions.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eb91-fed0-726e-806a-dd733d3bb94f/
VirusTotal report: https://www.virustotal.com/gui/domain/flarenetwork.mom
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=flarenetwork.mom
Archived copy: https://web.archive.org/web/20260929044357/https://flarenetwork.mom/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:15:13 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png
  Captured: 2026-09-29 05:10:57 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eb91-fed0-726e-806a-dd733d3bb94f.png
  Captured: 2026-09-29 05:10:57 UTC
  Source report: https://urlscan.io/result/01a0eb91-fed0-726e-806a-dd733d3bb94f/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e979-89b3-71ff-9571-f93286f19655.png
  Captured: 2026-09-29 04:40:33 UTC
  Source report: https://urlscan.io/result/01a0eb91-fed0-726e-806a-dd733d3bb94f/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/877f2ffc-5f79-4adb-b2de-2f276bf2d6f0.png
  Captured: 2026-09-29 04:42:04 UTC
  Source report: https://radar.cloudflare.com/scan/877f2ffc-5f79-4adb-b2de-2f276bf2d6f0
  SHA-256: da91a0f69504103488fe0d28f8b1f7438a4d40166a1d92786bc917476ca3796f
- URLQuery: https://screenshots.phishdestroy.io/uq/e9967a46-3a7f-4186-a83f-0dad2df59e80.png
  Source report: https://urlquery.net/report/e9967a46-3a7f-4186-a83f-0dad2df59e80
  SHA-256: d07b2ebd5def75f52192147e77b3c02f007710fde3f25fae1114faf3c9d90e60
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e979-8af2-77fc-ab6b-27861a575380.png
  Captured: 2026-09-28 19:24:19 UTC
  Source report: https://urlscan.io/result/01a0e979-8af2-77fc-ab6b-27861a575380/
  SHA-256: 3159fe2d8713f357ec6a99ba627cedc37b6db0d0b814be96dcdc814e9033cd17
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e979-89b3-71ff-9571-f93286f19655.png
  Captured: 2026-09-28 19:24:22 UTC
  Source report: https://urlscan.io/result/01a0e979-89b3-71ff-9571-f93286f19655/
  SHA-256: 3159fe2d8713f357ec6a99ba627cedc37b6db0d0b814be96dcdc814e9033cd17
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb81-8c9e-732f-ac0b-13e80966bb9b.png
  Captured: 2026-09-29 04:52:18 UTC
  Source report: https://urlscan.io/result/01a0eb81-8c9e-732f-ac0b-13e80966bb9b/
  SHA-256: 4ba1ff20ac8a3de7be423a2a55c7b9eb1fdf5eed3aaaba1dddcfb55e4684e373
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb88-a758-74e9-9e9b-69dc1cd20056.png
  Captured: 2026-09-29 05:00:04 UTC
  Source report: https://urlscan.io/result/01a0eb88-a758-74e9-9e9b-69dc1cd20056/
  SHA-256: 4ba1ff20ac8a3de7be423a2a55c7b9eb1fdf5eed3aaaba1dddcfb55e4684e373
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb8c-e6b7-770f-8b55-2288e1aa2a5c.png
  Captured: 2026-09-29 05:04:42 UTC
  Source report: https://urlscan.io/result/01a0eb8c-e6b7-770f-8b55-2288e1aa2a5c/
  SHA-256: 4ba1ff20ac8a3de7be423a2a55c7b9eb1fdf5eed3aaaba1dddcfb55e4684e373

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:54:52Z",
        "uuid": "01a0eb91-fed0-726e-806a-dd733d3bb94f",
        "scanned_at": "2026-09-29T05:10:27Z",
        "final_url": "https://flarenetwork.mom/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://flarenetwork.mom/",
                "from": "http://flarenetwork.mom/",
                "status": 307
            }
        ],
        "ip": "172.67.171.46",
        "domains": [
            "gateway.irys.xyz",
            "fonts.gstatic.com",
            "esm.sh",
            "arbitrum.meowrpc.com",
            "arbitrum.gateway.tenderly.co",
            "arbitrum.drpc.org",
            "rpc.ankr.com",
            "arbitrum-one.publicnode.com",
            "arb1.arbitrum.io",
            "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com",
            "hxjnnbfgmzureusmhjgltavcqubaut2yzqx23rrlalgrwm4nynga.mainnet-1.datasprite-cdn.com",
            "7hle7g76hwhzkcgcytuleelhk7lwp5k2ivnywsyp5umgak26bktq.mainnet-1.datasprite-cdn.com",
            "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com",
            "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com",
            "crwj4ebgvb7k4zcwmmxrnzxbs2gaegjyku7rc4eqjkvdnsvrehsa.mainnet-1.datasprite-cdn.com",
            "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com",
            "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com",
            "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com",
            "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com",
            "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com",
            "b6ktecz7yjy6fzgzlivivwfm4xtjvavuqbddceaslq46lxbuw2wq.mainnet-1.datasprite-cdn.com",
            "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com",
            "3zda2p33cro63eoev6gcult7nzm6vegrll7kg6cknocqfq4tavva.mainnet-1.datasprite-cdn.com",
            "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com",
            "tuahnjjbd4ptq2z3dq73mmxdcdpdxt5sjs4uwfluwoxw2i3zrv4q.mainnet-1.datasprite-cdn.com",
            "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com",
            "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com",
            "qyxbba7uefsmigd4oki3zm3hcmilt5fjudhha7n37oeygwrgdcua.mainnet-1.datasprite-cdn.com",
            "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com",
            "ch75ckxualkloc7t5fsfem56e5odt55sl7lel66ksibigpvzxsda.mainnet-1.datasprite-cdn.com"
        ],
        "ips": [
            "209.85.232.94",
            "172.67.163.26",
            "104.21.15.158",
            "172.66.167.42",
            "173.194.204.95",
            "104.26.12.205",
            "104.26.14.209",
            "104.17.207.5",
            "172.67.178.73",
            "104.26.10.181",
            "35.227.193.242",
            "104.18.10.59",
            "198.178.224.35",
            "104.20.24.117",
            "172.66.171.45"
        ],
        "asns": [
            "15169",
            "13335",
            "396982",
            "396356"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.cookieyes.com",
            "flare.network",
            "portal.flare.network",
            "merch.flare.network",
            "dev.flare.network",
            "flarescan.com",
            "flare-explorer.flare.network",
            "flare-systems-explorer.flare.network",
            "xrpfi.flare.network",
            "twitter.com",
            "t.me",
            "drive.google.com",
            "github.com",
            "www.youtube.com",
            "www.linkedin.com",
            "discord.com",
            "medium.com",
            "forum.flare.network"
        ],
        "social": [
            "https://twitter.com/FlareNetworks",
            "https://t.me/FlareNetwork",
            "https://github.com/flare-foundation",
            "https://www.youtube.com/c/Flare_Networks",
            "https://discord.com/invite/flarenetwork",
            "https://medium.com/flarenetwork"
        ],
        "doc_hash": "b54bbbde05ffd86b689f6829a79dae5047b94345ece237e884d59bdf3a5b5961",
        "script_hashes": [
            "b9838c97850bf4f463727cf5458d53d0940b4d93564ac40803b320518c79c38c"
        ],
        "globals": [
            "requestResize",
            "__earlyClickAction",
            "__removeEarlyClick",
            "__cfBeacon",
            "Cap",
            "downloadLogsBlobInBrowser"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "*.flarenetwork.mom",
                "flarenetwork.mom"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "flarenetwork.mom",
            "protocol": "QUIC",
            "valid_to": "2026-12-26T20:43:28Z",
            "valid_from": "2026-09-27T20:43:29Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 182,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "flarenetwork"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Flare"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:38Z",
        "uuid": "877f2ffc-5f79-4adb-b2de-2f276bf2d6f0",
        "scanned_at": "2026-09-29T04:42:04Z",
        "final_url": "https://flarenetwork.mom/",
        "status": 200,
        "history": [
            {
                "url": "https://flarenetwork.mom/",
                "status": 200
            }
        ],
        "dom_hash": "744c77dfcffbf0004d31dbe5b7460d65292616a5e242a95f1bb9e4082b3baf6f",
        "doc_hash": "b54bbbde05ffd86b689f6829a79dae5047b94345ece237e884d59bdf3a5b5961",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "flarenetwork.mom",
                "type": "A",
                "value": "104.21.39.184"
            },
            {
                "name": "flarenetwork.mom",
                "type": "A",
                "value": "172.67.171.46"
            },
            {
                "name": "flarenetwork.mom",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:ab2e"
            },
            {
                "name": "flarenetwork.mom",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:27b8"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.39.184",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Eranet International Limited",
            "created": "2026-09-27T21:39:23Z",
            "updated": "2026-09-27T21:39:24Z",
            "expires": "2027-09-27T23:59:59Z",
            "nameservers": [
                "lauryn.ns.cloudflare.com",
                "oswald.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:43:40Z",
        "analysis_at": "2026-10-14T07:03:51Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 14,
            "suspicious": 0,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "LevelBlue": "phishing",
            "BitDefender": "phishing",
            "ChainPatrol": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Eranet International Limited",
        "created": "2026-09-27T21:39:23Z",
        "expires": "2027-09-27T23:59:59Z",
        "updated": "2026-09-27T21:39:24Z",
        "first_seen": "2026-09-28T20:10:54Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "lauryn.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "oswald.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.39.184"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.171.46"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:ab2e"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "lauryn.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:27b8"
            }
        ],
        "dns_at": "2026-09-29T15:07:48Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.flarenetwork.mom",
                "flarenetwork.mom"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "53c24e20bd0feded2fc49212d546016a816",
            "sha256": "3e827e4dda9d3b9268ad04cd6b2bb747a7764e7e631de4d464aa559795e06bab",
            "subject": "flarenetwork.mom",
            "valid_to": "2026-12-26T20:43:28Z",
            "valid_from": "2026-09-27T20:43:29Z"
        },
        "whois": {
            "registrar": "Eranet International Limited",
            "registrar_iana_id": "1868",
            "registrar_url": "http://www.eranet.com",
            "created": "2026-09-27T21:39:23Z",
            "updated": "2026-09-27T21:39:24Z",
            "expires": "2027-09-27T23:59:59Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "lauryn.ns.cloudflare.com",
                "oswald.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```