flarefi[.]eth[.]limo

PhishDestroy identifies flarefi.eth.limo as an active wallet drainer phishing campaign targeting cryptocurrency users. The domain is not associated with any legitimate brand and uses deceptive tactics to trick victims into connecting their wallets to malicious smart contracts.
This domain was flagged by 1 out of 95 VirusTotal security vendors, indicating low but notable detection rates. It resolves to IP address 3.135.72.151 and uses a Let's Encrypt SSL certificate. The domain was created recently and has already been blocked by MetaMask and SEAL security solutions. It appears on two independent threat intelligence blocklists, demonstrating clear malicious intent. The registrar and creation date remain unverified in public records, adding to its suspicious characteristics.
flarefi.eth.limo remains active with an elevated risk level, though it has been blocked by major security platforms. Users should avoid interacting with this domain entirely. If accidentally accessed, disconnect wallets immediately and check for unauthorized transactions. While limited security coverage exists, the presence on blocklists and protections from MetaMask/SEAL reduce immediate risk. Remain vigilant for similar emerging domains using this seed pattern.