flare[.]co[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Ledger cryptocurrency wallet users. Analysis indicates the infrastructure was designed to deceive victims into believing they were interacting with official Flare Network or XRP Ledger services, likely to harvest wallet credentials or private keys through fraudulent interfaces. Infrastructure analysis reveals the domain flare.co.com was registered through Moniker Online Services LLC and resolves to IP address 172.67.172.96, a Cloudflare-hosted endpoint. Security vendors on VirusTotal detected malicious activity in 4 out of 95 scans, while three independent blocklists have listed the domain. The site employed a Let's Encrypt SSL certificate and utilized Cloudflare Browser Insights alongside HTTP/3 protocol implementation. Gridinsoft's trust scoring system assigned the domain a 0/100 rating, indicating high confidence in its malicious nature. The page title 'Flare Network — The Data Blockchain for XRP Ledger' directly references legitimate blockchain terminology to enhance credibility. Mitigation requires immediate verification of all cryptocurrency wallet interactions. Users should cross-check domain names against official Ledger documentation and avoid entering credentials on any non-Ledger-prefixed domains. Network-level protections should block connections to 172.67.172.96 and domains registered through Moniker Online Services LLC exhibiting similar characteristics. Security teams should monitor for Let's Encrypt certificates issued to domains mimicking blockchain infrastructure, particularly those using Cloudflare's network. Wallet providers are advised to implement domain verification warnings for any non-official endpoints referencing their brand.