governance-flare[.]finance

This domain, governance-flare.finance, is identified as an active phishing site specifically designed to execute cryptocurrency wallet-draining attacks. Analysis indicates the domain impersonates Flare Network governance portals to deceive users into connecting their wallets, subsequently siphoning digital assets. The site remains operational as of the latest verification, posing an immediate threat to users engaging with decentralized finance platforms. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 10, 2026, an unusual future date suggesting potential registration data manipulation. It resolves to IP address 104.21.21.107, hosted on Cloudflare's network (AS13335) in the United States. The domain appears on three security blocklists and is flagged by 6 of 95 security vendors on VirusTotal, including detection as generic_phishing. The SSL certificate is issued by Let's Encrypt (serial number E7), providing encrypted connections that may lend false legitimacy to the malicious site. Current trust scores and detection counts indicate a high-risk classification. The domain remains active and continues to resolve, requiring immediate mitigation measures. Users are advised to block the domain and associated IP address at the network level. Cryptocurrency wallet providers should integrate the domain into their real-time phishing detection systems. Network administrators should monitor for connections to 104.21.21.107 and the domain governance-flare.finance, particularly within decentralized application traffic. Verification of wallet connection prompts against official Flare Network domains is strongly recommended to prevent asset compromise.