flarefnd-prelaunch[.]live

This domain is flagged as an active generic phishing infrastructure. flarefnd-prelaunch.live was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and its creation timestamp is 23 July 2026, matching the report date, which suggests a newly‑minted credential‑harvesting site. The authoritative nameservers are hera.ns.cloudflare.com and walt.ns.cloudflare.com, indicating the hosting provider is Cloudflare. DNS resolution points to 172.67.134.73, a Cloudflare edge address that is shared by many unrelated legitimate services, complicating IP‑based blocking but allowing network‑level filtering of the specific domain name.

VirusTotal analysis shows that four out of ninety‑one scanning engines have classified the domain as malicious, providing independent confirmation of its phishing intent. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service, demonstrating that at least one community‑driven feed already treats it as hostile. Current status is listed as active, meaning the site is reachable and likely serving phishing pages. Defenders should immediately add flarefnd-prelaunch.live to URL filtering, DNS sinkhole, and proxy block lists.

Because the IP belongs to a shared Cloudflare pool, host‑based blocks may cause collateral impact; therefore, name‑based controls are preferred. Continuous monitoring of DNS queries for the domain and its associated Cloudflare nameservers is recommended to detect any rapid re‑registration or pivot to additional subdomains. Sharing the indicator set—including the domain, registrar, creation date, nameservers, and IP address—with internal threat‑intel platforms and external information‑sharing communities will improve collective visibility and enable faster remediation across the ecosystem.