flare-proposals[.]xyz

Analysis as of 2026-08-07 indicates that the domain flare-proposals.xyz is currently active and associated with a generic phishing campaign. The domain resolves to the IP address 104.21.60.41, which is hosted on a cloud service provider commonly abused for malicious infrastructure. VirusTotal has recorded detections from seven of ninety-one scanned security vendors, demonstrating that multiple independent engines have identified malicious characteristics. The domain is listed on at least one public security blocklist and has been actively blocked by the PhishDestroy mitigation service, further confirming its malicious reputation.

No additional public intelligence such as Safe Browsing verdicts, Open Threat Exchange entries, registrar details, SSL certificate information, HTTP response codes, or trust-score metrics have been published for this domain at the time of writing. Consequently, the full scope of the phishing operation—including the specific lure, targeted brand, or credential-harvesting page—remains unknown. Defenders should immediately deny network communications to 104.21.60.41 and add flare-proposals.xyz to local DNS block lists and proxy filtering rules.

Monitoring for any new detections on VirusTotal or other threat-intel feeds is advised, as additional indicators may emerge if the campaign expands. Organizations using web-filtering or email-gateway solutions should ensure the domain is blacklisted across those controls to prevent user exposure. Continuous review of blocklist updates and threat-intel feeds is recommended to capture any evolving activity linked to this infrastructure.