flare-votings[.]live

This domain, flare-votings.live, is actively engaged in credential theft operations targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to harvest usernames, passwords, and session tokens, which are then exfiltrated to attacker-controlled infrastructure. The threat is particularly acute for users accessing the domain via unsolicited links in emails or social media, where it may appear as part of a fake voting or survey platform to lend credibility to the request for sensitive information.

Infrastructure analysis reveals the domain was registered on July 03, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.149.123 and employs an SSL certificate issued by Google Trust Services, which does not mitigate the malicious intent. VirusTotal detection metrics show 8 out of 95 security vendors have flagged the domain as malicious, while blocklist aggregators confirm its presence on multiple threat intelligence feeds. The domain remains active as of the latest verification, indicating ongoing operational status.

Users who have visited flare-votings.live or entered credentials on the site should immediately revoke any active sessions tied to the account, rotate passwords for all associated services, and enable multi-factor authentication where available. Network administrators are advised to block the domain and its resolving IP (172.67.149.123) at the perimeter. Endpoint protection tools should be updated to include the domain in deny lists, and affected users should monitor accounts for unauthorized activity, particularly those linked to financial or email services. Incident response teams should treat any interaction with this domain as a potential compromise requiring full credential reset protocols.