flarextra[.]com

This domain, flarextra.com, is identified as a high-risk phishing site designed to impersonate the legitimate Flare Network, an EVM-compatible blockchain platform. The site uses the page title 'Flare Network- EVM Hub for Web3.0' to deceive users into believing it is the official Flare Network portal. Analysis indicates the domain specifically targets Web3 users, likely attempting to harvest cryptocurrency wallet credentials, private keys, or other sensitive authentication details through fraudulent login interfaces or wallet connection prompts. The use of a familiar and trusted brand name increases the likelihood of successful social engineering, particularly among users seeking to interact with decentralized applications or manage digital assets. Evidence supporting the malicious classification includes detection by 18 out of 95 security vendors on VirusTotal, with the domain appearing on three distinct security blocklists. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Cosmotown, Inc., and resolves to the IP address 102.209.117.25, hosted on AS329184 (Host Africa (Pty) Ltd) in South Africa. The domain currently uses a Let's Encrypt SSL certificate (serial number E7), a common tactic among phishing sites to appear legitimate. The creation date, set in the future (2026), suggests the use of domain age manipulation techniques to evade detection by security systems that rely on domain maturity as a trust indicator. Users who have visited flarextra.com or interacted with its content should assume potential compromise of any credentials or wallet details entered. Immediate actions include revoking access for any connected wallets or decentralized applications, changing passwords for associated accounts, and monitoring for unauthorized transactions. Wallet addresses used on the site should be considered exposed, and users are advised to transfer assets to new, secure wallets. System scans using updated security tools are recommended to detect any malware or persistent threats that may have been introduced during the interaction. Network logs should be reviewed for connections to 102.209.117.25 or related indicators of compromise.