flarefoundations-bonus[.]xyz

This domain, flarefoundations-bonus.xyz, is actively engaged in credential harvesting phishing operations designed to deceive users into submitting sensitive login credentials. The site mimics legitimate platforms to trick visitors into entering usernames, passwords, or other authentication details, which are then captured by threat actors for unauthorized access, financial fraud, or further cyberattacks. The lack of basic security measures, such as an SSL certificate, indicates a disregard for user safety and aligns with common phishing infrastructure characteristics. Analysis indicates this domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.215.145 and is currently flagged by 4 out of 95 security vendors on VirusTotal, with additional listings on three security blocklists. The domain remains active, suggesting ongoing malicious activity despite detection by multiple threat intelligence sources. If you or someone in your organization has visited flarefoundations-bonus.xyz or entered credentials on this site, immediate action is required. First, reset all passwords associated with the account, especially if the same credentials are used across multiple platforms. Enable multi-factor authentication where available to add an extra layer of security. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious incidents to your security team or relevant authorities. Avoid interacting with the domain or any links associated with it, and consider blocking the IP address 172.67.215.145 at the network level to prevent further exposure.