bonus-flaresnetwork[.]app

The domain bonus-flaresnetwork.app is currently active and classified as a high-risk cryptocurrency credential harvesting phishing site. Analysis indicates the domain is designed to impersonate legitimate cryptocurrency wallet or exchange login portals, tricking users into submitting sensitive credentials, private keys, or recovery phrases. The page title 'Even geduld...' suggests a loading or waiting prompt, a common tactic to delay user suspicion while malicious scripts execute in the background. Infrastructure analysis reveals the domain was registered on May 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an offshore registrar frequently associated with malicious domains. It resolves to the IPv6 address 2606:4700:3030::6815:1037, hosted on AS13335 Cloudflare, Inc., a network commonly leveraged to obfuscate origin servers. The domain is flagged by 4 of 95 security vendors on VirusTotal, with additional detections on three independent security blocklists, including PhishDestroy and SEAL. The SSL certificate is issued by Let's Encrypt (serial number E7), a legitimate certificate authority often abused by threat actors to lend false legitimacy to phishing sites. Current status remains active, with no evidence of takedown or mitigation. The risk level is assessed as high due to the domain's direct targeting of cryptocurrency users, a demographic frequently subjected to irreversible financial theft. Organizations and individuals are advised to block the domain at the DNS or network level, revoke any associated SSL certificates, and monitor for credential exposure. Users who may have interacted with the domain should immediately revoke active sessions, rotate credentials, and audit wallet transactions for unauthorized activity. Proactive threat hunting is recommended to identify related infrastructure, including subdomains or IP adjacencies, which may indicate a broader campaign.