vote-firelight[.]fi

This domain, vote-firelight.fi, is actively flagged as a high-risk phishing resource by multiple threat intelligence sources as of July 12, 2026. Analysis indicates the domain was registered on May 6, 2026, and currently resolves to the IP address 188.114.97.3, which is associated with Cloudflare infrastructure in Canada. The domain is blocked by at least three security blocklists, including PhishDestroy, MetaMask, and SEAL, and has been identified in one AlienVault OTX threat intelligence pulse. A Gridinsoft trust score of 0 out of 100 further corroborates its malicious classification, though only one of 95 security vendors on VirusTotal currently flags it as malicious. Infrastructure examination reveals the site is still operational, returning an HTTP 403 status code, which suggests access restrictions are in place but does not confirm takedown. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains, and does not inherently indicate compromise. The domain's naming convention, combining 'vote' with a seemingly random term, aligns with patterns observed in credential-harvesting campaigns targeting users through fake login portals or survey scams. Defenders should treat this domain as an active threat. While the exact phishing kit or targeted brand remains unconfirmed, the domain's presence on multiple blocklists and its recent registration support its classification as malicious. Network-level blocking is recommended for all endpoints, and security teams should monitor for connections to 188.114.97.3 or related subdomains. Given the domain's use of Cloudflare, additional scrutiny of other domains sharing the same IP or ASN may uncover related malicious activity. No evidence currently suggests this domain is part of a broader campaign, but further investigation is warranted if internal logs show attempted access.