flareautoearn[.]com

Analysis of flareautoearn.com, observed on July 24, 2026, indicates that the domain is currently offline but was previously serving content titled “Flare Auto Earning”. The domain was registered through DreamHost on October 28, 2025 and resolves to the IPv4 address 67.223.118.223, which is hosted in the United States under AS22612 (Namecheap, Inc.). The hosting server reported an HTTP 200 response and presented a valid SSL certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36. Technical fingerprints show the use of Tailwind CSS, LiteSpeed web server, and Sectigo‑related components. The domain appears on a single public blocklist and has been explicitly blocked by PhishDestroy.

VirusTotal scans returned four positive detections out of ninety‑five scanners, confirming malicious classification by multiple vendors. Additional reputation data includes a Gridinsoft trust score of 0 out of 100, indicating a lack of trust. Nameserver records point to dns1.namecheaphosting.com and dns2.namecheaphosting.com. The evidence collectively points to a phishing‑related infrastructure, consistent with the generic phishing threat type assigned.

However, the public record does not contain a detailed payload description, nor does it disclose the exact phishing campaign vector or targeted brand, leaving the precise operational details uncertain. Defenders should continue to block flareautoearn.com at network perimeter and DNS layers, monitor for any resurgence of the domain, and add the associated IP address 67.223.118.223 to threat‑intel feeds. Given the low trust score and multiple vendor detections, automated web‑filtering solutions should treat the domain as malicious. Ongoing observation of the DreamHost registrar and Namecheap hosting environment may reveal further related domains.