voting-flare[.]com

The domain voting-flare.com was registered on April 23, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The live page presents the title “Flare: The blockchain for data,” yet the HTTP response returns a 403 status code, indicating that the site is intentionally restricting direct access while likely serving malicious content to targeted browsers. The domain remains active as of the report date, July 12, 2026.

Open source intelligence shows the domain appears in one AlienVault OTX pulse and is listed on three security blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the view that the site is being used for credential harvesting. Technical analysis reveals the site is fronted by a CDN that provides HTTP/3 support, and its authoritative nameservers resolve to bruce.ns.cloudflare.com and kallie.ns.cloudflare.com, consistent with a cloud‑based delivery network.

VirusTotal scans have flagged the domain by 2 of 95 security vendors, and Gridinsoft assigns a trust score of 0 out of 100, both indicating a high likelihood of malicious intent despite the low vendor count. The combination of a recent registration, a deceptive blockchain‑related page title, and the presence on multiple blocklists leads to a high‑risk classification for this infrastructure. Uncertainty remains regarding the exact payload delivered after the initial page load, as the 403 response limits direct observation of malicious scripts.

Defenders should immediately add voting-flare.com to deny‑list rules at perimeter firewalls and DNS filtering services. Continuous monitoring of DNS queries for the associated Cloudflare nameservers can help detect any pivoting activity. Given the domain’s active status and its alignment with known credential‑harvesting campaigns, organizations should also educate users about unsolicited requests that reference blockchain or data platforms, and enforce multi‑factor authentication to mitigate potential credential compromise.