flarefoundation-votes[.]app

This domain, flarefoundation-votes.app, is currently flagged as an active crypto wallet phishing site targeting users through deceptive infrastructure. Analysis indicates the threat type is highly specific to credential harvesting and wallet private key theft, with no legitimate association to any official blockchain foundation or voting platform. The domain remains operational despite security interventions, posing an elevated risk to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on June 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk registrations. It resolves to the IP address 104.21.27.250, which is proxied through Cloudflare services, masking its true origin. Security vendors have detected the domain with 1 of 95 flagging it on VirusTotal, while it appears on 3 independent security blocklists. Additional threat intelligence confirms its presence in 2 AlienVault OTX pulses, and it holds a Gridinsoft trust score of 0 out of 100. Technologies detected include HSTS, Cloudflare Browser Insights, and HTTP/3, which are often leveraged to enhance perceived legitimacy while obscuring malicious intent. Current status confirms the domain remains active and continues to resolve, despite being blocked by multiple wallet security extensions and enterprise phishing protection systems. Users are strongly advised to avoid interaction with flarefoundation-votes.app and any associated subdomains or redirects. Organizations should update firewall rules to block the IP 104.21.27.250 and monitor for related indicators of compromise, including unusual wallet transaction patterns or unauthorized access attempts. Immediate revocation of any credentials or private keys exposed to this domain is critical to prevent asset loss. Security teams are recommended to correlate this domain with other known phishing campaigns targeting blockchain infrastructure.