test-100-testweb[.]com

This domain, test-100-testweb.com, is actively engaged in a crypto drainer phishing campaign targeting users of the Flare blockchain. The site impersonates the legitimate Flare network, as evidenced by its page title, 'Flare: The blockchain for data,' and is designed to execute unauthorized transactions, draining cryptocurrency assets from victims' wallets. No specific drainer kit has been conclusively identified, but the infrastructure aligns with known crypto-focused phishing tactics, including the use of Cloudflare for obfuscation and rapid domain deployment to evade detection. Analysis indicates the domain was registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.96.3, which is part of a network range historically linked to malicious activity. As of the latest assessment, the domain is flagged by 16 out of 95 security vendors on VirusTotal, indicating a moderate but growing detection rate. It appears on four independent security blocklists and is actively blocked by MetaMask, PhishDestroy, SEAL, and ScamSniffer, further corroborating its malicious intent. The domain's trust score is 0/100, reflecting its high-risk classification. Technologies detected on the site include HSTS, Cloudflare Browser Insights, and HTTP/3, suggesting an attempt to mimic legitimate security and performance features while leveraging Cloudflare's infrastructure to mask its true origin. The domain remains active and poses a significant risk to users interacting with Flare blockchain services or cryptocurrency wallets. Current response actions include widespread blocking by browser extensions and security platforms, though the domain's recent registration and use of Cloudflare may delay broader takedown efforts. Users are advised to verify domain authenticity through official channels before connecting wallets or entering credentials. Wallet providers and security teams should prioritize monitoring for connections to 188.114.96.3 and the domain itself, as well as any associated subdomains or redirects. Given the high-risk nature of this campaign, immediate reporting to registrar abuse contacts and hosting providers is recommended to mitigate further exploitation.