phase-flarefn[.]live

The domain phase-flarefn.live was registered on July 23, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. Its authoritative name servers are carrera.ns.cloudflare.com and marvin.ns.cloudflare.com, indicating the use of Cloudflare's DNS infrastructure. DNS resolution points to the IPv4 address 188.114.96.3, which is the sole host observed for this domain.

Threat intelligence sources have recorded five detections out of ninety‑one security vendors on VirusTotal, suggesting that multiple anti‑malware engines have identified malicious characteristics associated with the domain. Additionally, the domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment of malicious intent. The classification provided is generic phishing, and the risk level is high, reflecting the potential for credential harvesting or other fraudulent activity.

No further technical details such as SSL certificate attributes, HTTP response codes, or page titles have been disclosed, leaving the exact payload and phishing vector unverified. Consequently, defenders should treat phase-flarefn.live as a confirmed phishing infrastructure, enforce network‑level blocking, add the domain to endpoint and email filtering deny lists, and continue to monitor for any associated IP or DNS changes. Ongoing observation of threat feeds for additional detections or related infrastructure is recommended to maintain situational awareness.