governances-flarefoundation[.]xyz

This domain, governances-flarefoundation.xyz, is flagged as an active brand impersonation threat targeting MetaMask wallet users. Analysis indicates the site operates as a cryptocurrency wallet drainer, designed to exfiltrate credentials and private keys under the guise of official MetaMask governance or security updates. The infrastructure mimics legitimate wallet service portals, employing social engineering tactics such as fake airdrop claims or urgent security alerts to prompt user interaction. Infrastructure analysis reveals the domain was registered on June 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), which is commonly used to obfuscate malicious infrastructure. The domain holds a Google Trust Services SSL certificate (WE1), lending a false sense of legitimacy. VirusTotal reports 5 out of 95 security vendors detecting the domain as malicious, and it appears on three security blocklists, including those maintained by cryptocurrency security teams. No legitimate association with MetaMask or its parent entities has been verified. As of the latest assessment, governances-flarefoundation.xyz remains active and unresolved, posing a continued risk to users. The domain has been blocked by multiple security providers, including cryptocurrency-specific threat intelligence feeds, but no takedown action has been observed. Users are advised to treat any communication or interaction with this domain as fraudulent. Immediate steps include revoking permissions for any connected wallets, rotating private keys, and reporting the domain to relevant abuse channels. The remaining risk is classified as high due to the domain’s persistence, Cloudflare hosting, and targeted nature against cryptocurrency holders.