# PhishDestroy domain threat record: rewards-flarenetwork.asia

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/rewards-flarenetwork.asia/
Machine-readable companion: https://phishdestroy.io/domain/rewards-flarenetwork.asia/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-07 08:02:25 UTC
- Last availability or vendor check: 2026-10-22 10:49:29 UTC
- Stored record updated: 2026-10-22 15:46:10 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 3
- Matching public blocklists: MetaMask, ScamSniffer, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: flarenetwork

## Stored infrastructure

- Observed IP address: 2606:4700:3031::ac43:b35a
- Registrar in stored WHOIS data: Spaceship, Inc.

## Evidence links

- URLScan report: https://urlscan.io/result/01a113fe-13c7-7429-838e-2b3a138ddffa/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/rewards-flarenetwork.asia
- Certificate Transparency search: https://crt.sh/?q=%25.rewards-flarenetwork.asia
- Web Archive lookup: https://web.archive.org/web/*/https://rewards-flarenetwork.asia/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
rewards-flarenetwork.asia is an impersonation phishing page built to pass as Flare Network, the blockchain project. It targets Flare users and wallet holders who might expect a rewards or claim campaign. PhishDestroy first saw it on 2026-10-07. When last checked on 2026-10-19, its DNS was no longer resolving, so the content was offline. The name could be reactivated or reused at any time.

How the scam works
The page uses Flare's real headline, "Flare: The blockchain for data," so it looks like the official site at a glance. The "rewards" prefix on an unofficial .asia domain is the bait. Schemes like this usually promise a reward or airdrop, then ask the visitor to connect a wallet and sign a transaction, or to type in a recovery phrase to "verify" eligibility. A malicious signature can let the attacker move tokens out of the wallet. A recovery phrase hands over the entire wallet. Either way, losses are typically immediate and cannot be reversed.

Evidence
urlscan.io rated the page malicious and recognized Flare Network as the brand being copied. MetaMask, ScamSniffer and SEAL list the domain alongside PhishDestroy. Those blocklists matter most here because wallets and wallet-security tools check them before a user connects. VirusTotal tells a different story: none of its 92 engines flagged the domain on 2026-10-07. That shows how freshly launched crypto phishing pages can slip past general-purpose scanners.

Infrastructure
The domain pairs the brand name with a "rewards" lure on a .asia extension, a pattern built to look official in a link or search result. It was served over an IPv6 address with a valid TLS certificate, so the browser padlock gave no warning. By 2026-10-19, roughly twelve days after PhishDestroy flagged it, the domain had stopped resolving. That short lifespan is typical of disposable phishing campaigns.

What to do
If you connected a wallet to this site, use a token-approval checker to revoke any approvals or permissions you granted. Move remaining funds to a new wallet if you signed anything you did not understand. If you entered a recovery phrase, treat that wallet as compromised and transfer assets to a wallet with a fresh seed right away. Use only Flare's official channels for rewards or claims, and be wary of lookalike domains offering them. Defenders should block the domain and watch for similar Flare-themed rewards domains.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a113fe-13c7-7429-838e-2b3a138ddffa/
VirusTotal report: https://www.virustotal.com/gui/domain/rewards-flarenetwork.asia
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rewards-flarenetwork.asia
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:14:30 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a113fe-13c7-7429-838e-2b3a138ddffa.png
  Captured: 2026-10-07 08:02:25 UTC
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a113fe-12bb-71ce-bc18-2ed487b1c935.png
  Captured: 2026-10-07 01:33:07 UTC
  Source report: https://urlscan.io/result/01a113fe-12bb-71ce-bc18-2ed487b1c935/
  SHA-256: 3159fe2d8713f357ec6a99ba627cedc37b6db0d0b814be96dcdc814e9033cd17

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T19:27:24Z",
        "uuid": "01a113fe-13c7-7429-838e-2b3a138ddffa",
        "scanned_at": "2026-10-07T01:33:08Z",
        "final_url": "https://rewards-flarenetwork.asia/",
        "status": 200,
        "ip": "172.67.179.90",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.79.73",
            "172.67.179.90"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cookieyes.com",
            "flare.network",
            "portal.flare.network",
            "merch.flare.network",
            "dev.flare.network",
            "flarescan.com",
            "flare-explorer.flare.network",
            "flare-systems-explorer.flare.network",
            "xrpfi.flare.network",
            "twitter.com",
            "t.me",
            "drive.google.com",
            "github.com",
            "www.youtube.com",
            "www.linkedin.com",
            "discord.com",
            "medium.com",
            "forum.flare.network"
        ],
        "social": [
            "https://twitter.com/FlareNetworks",
            "https://t.me/FlareNetwork",
            "https://github.com/flare-foundation",
            "https://www.youtube.com/c/Flare_Networks",
            "https://discord.com/invite/flarenetwork",
            "https://medium.com/flarenetwork"
        ],
        "doc_hash": "6888cc60e2db5417c93b2a66204921a56b15fe1593c026891e6560d2d668fe7b",
        "script_hashes": [
            "f68d6d8ce951a55c900e2f0b10726c1a1ef97f7074536ef9641f8214b1a74159"
        ],
        "globals": [
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "*.rewards-flarenetwork.asia",
                "rewards-flarenetwork.asia"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "rewards-flarenetwork.asia",
            "protocol": "QUIC",
            "valid_to": "2027-01-04T22:56:33Z",
            "valid_from": "2026-10-06T22:56:34Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 46,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "flarenetwork"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Flare"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T19:37:18Z",
        "uuid": "ac1ae6e5-6bb9-4a22-8a50-9c4297711757",
        "scanned_at": "2026-10-07T08:05:20Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T09:00:47Z",
        "analysis_at": "2026-10-10T10:18:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 2,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "CyRadar": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "Spaceship, Inc.",
        "created": "2026-10-06T23:46:02Z",
        "expires": "2027-10-06T23:46:02Z",
        "updated": "2026-10-06T23:46:11Z",
        "first_seen": "2026-10-07T01:33:11Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.179.90"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.91.206"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "jerome.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jocelyn.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jerome.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:5bce"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:b35a"
            }
        ],
        "dns_at": "2026-10-07T01:33:14Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.rewards-flarenetwork.asia",
                "rewards-flarenetwork.asia"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "643a2de828e2a4ff06fdad5f1cd19dc25d8",
            "sha256": "b7af808c2bf71c404e1fffc8ced46676ec42a729f61d06076f921a6dc28024e5",
            "subject": "rewards-flarenetwork.asia",
            "valid_to": "2027-01-04T22:56:33Z",
            "valid_from": "2026-10-06T22:56:34Z"
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862",
            "created": "2026-10-06T23:46:02Z",
            "updated": "2026-10-06T23:46:11Z",
            "expires": "2027-10-06T23:46:02Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "jerome.ns.cloudflare.com",
                "jocelyn.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "last changed": "2026-10-06T23:46:11Z",
                "registration": "2026-10-06T23:46:02Z",
                "registrar expiration": "2027-10-06T23:46:02Z",
                "last update of RDAP database": "2026-10-07T01:33:14Z"
            }
        }
    }
}
```