receive-flarefoundations[.]xyz

This domain, receive-flarefoundations.xyz, operates as a crypto drainer targeting users of the Flare (FLR) network by presenting a fraudulent rewards voting page. The site mimics legitimate Flare token distribution events, tricking visitors into connecting their wallets under the guise of claiming rewards. Once connected, the site executes unauthorized transactions, draining cryptocurrency assets from victims' wallets without consent. The page title, 'Flare — FLR Rewards Vote,' is designed to deceive users into believing they are interacting with an official Flare platform, while the underlying infrastructure is entirely malicious. Analysis indicates this domain is a confirmed threat based on multiple technical indicators. As of the latest scan, 5 out of 95 security vendors on VirusTotal flag receive-flarefoundations.xyz as malicious. The domain was registered on June 20, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.72.194, hosted on Cloudflare's network (AS13335), which is commonly used to obfuscate the true origin of phishing infrastructure. Additionally, the domain appears on 3 security blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL, further confirming its malicious intent. Users who have visited receive-flarefoundations.xyz or interacted with its content should take immediate action to mitigate risk. First, disconnect any wallets connected to the site and revoke all active sessions via wallet management tools. Scan the device used to access the site with updated antivirus software to detect potential malware. Monitor wallet transactions for unauthorized activity and report any suspicious transfers to the relevant blockchain explorer or support channels. If credentials or private keys were entered, consider migrating assets to a new wallet address and updating security settings. Avoid interacting with any communications or links associated with this domain, as they may lead to further compromise.