proposal-flarefoundation[.]xyz

The domain proposal-flarefoundation.xyz is currently under investigation for brand impersonation phishing targeting Flare (FLR) cryptocurrency users. Analysis indicates the site presents itself as an official Flare rewards voting portal, using the page title 'Flare — FLR Rewards Vote' to deceive visitors into interacting with malicious infrastructure. The domain remains active and has not yet been widely flagged by detection engines. Infrastructure analysis reveals the domain was registered on June 13, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3 and has been blocked by three security blocklists, including MetaMask and PhishDestroy. Despite these indicators, the domain shows 0 detections out of 95 vendors on VirusTotal, suggesting limited initial detection coverage. AlienVault OTX records include the domain in two threat intelligence pulses, further corroborating its malicious classification. Current status indicates the domain is actively serving content and poses a credible threat to users seeking Flare-related services. Security teams are advised to monitor network traffic for connections to 188.114.96.3 and block the domain at perimeter security controls. Users should verify the legitimacy of any Flare-related portals through official channels and avoid interacting with unsolicited reward or voting pages. Organizations should update detection rules to include this domain and its associated IP in threat intelligence feeds.