app-fxrpfi-flare-8eh83djy83n[.]web[.]app

The domain app-fxrpfi-flare-8eh83djy83n.web.app was registered on May 11, 2026 and is hosted on Google Firebase infrastructure. DNS resolution points to IP 199.36.158.100, an address owned by Google LLC located in the United States. The site presents an HTTPS certificate issued by Google Trust Services under the WR4 authority, confirming the use of legitimate TLS assets. HTTP requests return a 200 status code and the page title reads "Flare | Bridge Your XRP to DeFi," indicating an attempt to impersonate the Flare brand and lure users interested in XRP bridging services. VirusTotal analysis shows that 2 of 92 security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on three public blocklists and is already blocked by PhishDestroy, MetaMask, and SEAL. Current status is active, and risk level is assessed as high. While the exact page content beyond the title has not been examined, the combination of brand targeting, recent creation, and low trust scores suggests a deliberate brand‑impersonation campaign. Defenders should add the domain to network and endpoint blocklists, monitor outbound connections to the associated IP, and enforce strict validation of any Flare‑related communications. Continuous observation for new indicators, such as additional hosting changes or payload delivery, is recommended to mitigate potential credential harvest or malicious transaction attempts.