flarefndn-event[.]xyz

Analysis of flarefndn-event.xyz shows a newly created infrastructure that aligns with credential‑phishing operations. The domain was registered on June 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and delegated to the Cloudflare nameservers adam.ns.cloudflare.com and danica.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, a Cloudflare edge node located in Canada, which masks the true hosting environment and is commonly used by malicious actors to hide origin servers. The site employed an SSL certificate issued by Google Trust Services (WE1), confirming the use of HTTPS, and the transport layer advertised HTTP/3, indicating a modern web stack. The only observable page element is the title “Just a moment…”, and the domain’s current status is taken offline, preventing live verification of content.

Reputation data reinforces the malicious assessment. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, reflecting a high confidence of abuse. VirusTotal scans recorded 10 detections out of 91 security vendors, providing independent corroboration of malicious behavior. AlienVault OTX references the domain in one threat‑intelligence pulse, indicating that it has been shared within the security community.

While the exact phishing lure (e.g., targeted service or login portal) cannot be confirmed without page content, the classification as credential phishing is supported by the intelligence feed. Defenders should immediately block flarefndn-event.xyz at DNS and proxy layers, add it to URL filtering policies, and monitor for any newly created subdomains that resolve to the same Cloudflare IP range. Continuous threat‑intel feeds should be consulted for updates, and any observed attempts to contact the domain should be logged and investigated to identify potential credential harvesting campaigns.