flarefoundation-vote[.]com

This domain is flagged as a crypto governance scam specifically targeting Flare (FLR) token holders under the pretense of voting on reward dates. Analysis indicates the site is designed to harvest wallet credentials and facilitate unauthorized asset transfers, commonly referred to as a crypto drainer. The threat is classified as elevated due to its direct financial impact on victims and the targeted nature of the deception. Infrastructure analysis reveals the domain was registered on June 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an uncommon registrar for legitimate crypto projects. It resolves to IP address 188.114.97.3 and employs Cloudflare services, including Browser Insights and HTTP/3, likely to obfuscate backend infrastructure. The SSL certificate is issued by Google Trust Services, adding a false layer of legitimacy. Detection metrics show 8/95 security vendors on VirusTotal flagging the domain, while it appears on four security blocklists and is actively blocked by MetaMask, PhishDestroy, SEAL, and OISD. Gridinsoft assigns a trust score of 0/100, further corroborating malicious intent. Mitigation requires immediate action from both users and network defenders. Users who interacted with flarefoundation-vote.com should revoke all connected wallet permissions, transfer assets to a new wallet, and monitor transaction histories for unauthorized activity. Network administrators should block the domain and associated IP (188.114.97.3) at the firewall level. Crypto projects should proactively warn communities about fake governance portals and implement multi-factor authentication for official voting platforms. Security teams are advised to hunt for related domains registered under the same registrar or resolving to the same IP, as this actor may deploy additional infrastructure.