submit-flare[.]network

This domain is flagged as a credential harvesting site targeting cryptocurrency wallet users. The site presents a fraudulent login interface mimicking legitimate wallet services, designed to capture sensitive authentication details such as private keys, recovery phrases, or account passwords. Victims are typically redirected from malicious ads, social engineering links, or compromised platforms, with the site employing urgency tactics to pressure users into entering credentials without verification. Analysis indicates the domain was registered on June 07, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 188.114.96.3 and is detected by 7 out of 95 security vendors on VirusTotal, including specialized blockchain security tools. The domain appears on three security blocklists and has been referenced in four threat intelligence pulses on AlienVault OTX, confirming its malicious classification. Infrastructure analysis reveals the use of Cloudflare services, including Browser Insights and HTTP/3, to obfuscate hosting details and evade detection. If a user has visited submit-flare.network or entered credentials on the site, immediate action is required. First, revoke any active sessions or authorizations linked to the compromised wallet. Transfer remaining assets to a new, secure wallet using a clean device to prevent follow-up attacks. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams or platforms to assist in tracking the threat. Users should also scan their devices for malware, as phishing sites often deploy additional payloads to maintain persistence or exfiltrate data.