fire-light[.]xyz

PhishDestroy identifies fire-light.xyz as an active brand-impersonation site posing as HTX, a major global cryptocurrency exchange. This domain is under live investigation and currently resolving to IP 172.67.180.174. The site appears designed to harvest credentials and seed wallet addresses for cryptocurrency theft, making it a high-risk crypto drainer. This domain was flagged by PhishDestroy on April 22, 2026. Registration was processed through Dynadot LLC, and the site is secured with a Let's Encrypt SSL certificate. Despite 0 detections on VirusTotal as of today (2/95 engines), the domain mimics HTX branding and infrastructure to deceive users into entering sensitive login or wallet information. The age of the domain—just days old—and its rapid deployment of SSL suggest a deliberate, short-lived campaign aimed at unsuspecting cryptocurrency holders. If you visited fire-light.xyz or entered any information, stop using the supplied credentials and immediately transfer any stored crypto to a new, secure wallet. Disconnect affected devices from your network, run a full antivirus scan, and monitor your financial accounts for unauthorized transactions. Always verify exchange links by typing the official URL (htx.com) directly into your browser or using PhishDestroy’s real-time verification tool. Never click on links from unsolicited messages claiming to be from HTX.