flarenetworks-vote[.]xyz

This domain, flarenetworks-vote.xyz, is actively flagged as a high-risk phishing site targeting Flare Network governance participants. Registered on June 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to a Cloudflare-hosted IP (172.67.191.222) in Canada and employs Cloudflare nameservers (keaton.ns.cloudflare.com, oaklyn.ns.cloudflare.com). The page title, 'Flare Governance: Vote on the FLR Rewards Date,' explicitly references Flare Network’s governance processes, suggesting an attempt to deceive users into engaging with fraudulent voting or reward mechanisms. Infrastructure analysis reveals the domain is proxied behind Cloudflare, utilizing HTTP/3 and Cloudflare Browser Insights for performance monitoring. A 301 HTTP redirect is present, though the destination remains unconfirmed. The SSL certificate is issued by Google Trust Services (WE1), a common but not exclusive indicator of legitimacy. Detection by four security blocklists (PhishDestroy, MetaMask, SEAL, ScamSniffer) and a Gridinsoft trust score of 0/100 further corroborate its malicious classification. Seven of 91 security vendors on VirusTotal have flagged the domain, though the absence of additional context limits definitive attribution to a specific phishing kit or campaign. Defenders should treat this domain as an active threat. Blocklist the domain and associated IP (172.67.191.222) at perimeter and endpoint levels. Monitor for user reports of credential submission or cryptocurrency transactions linked to this domain, as the governance-themed lure may aim to harvest sensitive data or redirect funds. The domain’s recent registration and Cloudflare obfuscation suggest ongoing operational security measures by the threat actor, warranting continued vigilance.