flcer[.]network

flcer.network has been positively identified as hosting an active cryptocurrency wallet-stealing phishing operation. The site lures victims with fake giveaways and login prompts, exfiltrating private keys and recovery phrases to drain wallets within minutes. Given the current risk assessment level of under_investigation combined with the absence of third-party detection, immediate defensive action is warranted for anyone who may have visited the domain.

PhishDestroy identifies flcer.network as a live phishing vector posing as a legitimate cryptocurrency platform. VirusTotal currently reports 3 out of 95 scanners detecting malicious content, indicating this threat has not yet propagated to public blocklists. The domain was registered on April 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 172.67.213.127. Technical infrastructure includes a valid Let’s Encrypt SSL certificate, which is commonly abused to lend superficial credibility to phishing pages. Despite the fresh registration date, the rapid deployment of wallet-draining infrastructure suggests premeditated threat actor activity aimed at exploiting current market hype.

This precise mix of early-stage registration, low detection coverage, and wallet-focused lure content creates a high-impact, low-friction attack profile highly likely to succeed against unsuspecting users. Victims typically lose 100% of wallet contents within minutes of credential submission. To mitigate exposure, immediately block flcer.network at DNS and firewall levels, revoke any wallet passwords entered on the site, and transfer remaining assets to a newly generated, hardware-isolated wallet. If private keys or recovery phrases were ever entered, assume immediate compromise and cease using associated addresses. Always verify destination URLs via multiple independent sources before entering cryptographic secrets.