flarefoundation-vote[.]app

This domain, flarefoundation-vote.app, is actively engaged in crypto credential theft, targeting users through a fabricated voting platform interface. Analysis indicates the site is designed to harvest wallet credentials, private keys, or seed phrases under the guise of a legitimate cryptocurrency governance or community voting system. The domain employs social engineering tactics, likely distributed via phishing emails, social media, or malicious advertisements, to lure victims into entering sensitive information on the fraudulent site. Infrastructure analysis reveals the domain was registered on June 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 188.114.97.3 and is currently served behind Cloudflare, utilizing HSTS and HTTP/3 protocols. Despite its active status, the domain has not yet been flagged by antivirus engines, with 0/95 detections on VirusTotal. However, it appears on 3 security blocklists and is proactively blocked by browser extensions and security tools, including MetaMask and PhishDestroy. The page title, 'Suspected Phishing | Cloudflare,' further indicates its malicious nature, as Cloudflare typically assigns this label to domains under investigation for fraudulent activity. Users who have visited flarefoundation-vote.app or entered any credentials on the site should immediately revoke access to any connected cryptocurrency wallets or accounts. Rotate all passwords, private keys, and seed phrases associated with the compromised credentials. Monitor linked accounts for unauthorized transactions or logins, and enable multi-factor authentication where available. If wallet credentials were exposed, transfer remaining assets to a new, secure wallet. Report the incident to relevant security teams or platforms to aid in mitigation efforts. Avoid interacting with any communications or links associated with this domain, as they may lead to further compromise.