vote-firelightfoundation[.]xyz

This domain, vote-firelightfoundation.xyz, is identified as a cryptocurrency phishing site targeting users of digital asset protection platforms. Analysis indicates the page mimics the branding of Firelight, presenting itself as a legitimate security layer for cryptocurrency holdings. No specific drainer kit signatures were detected in initial scans, but the site employs standard credential harvesting techniques common in phishing operations targeting wallet logins and private keys.

Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 01, 2026, an unusually future-dated creation that may indicate registry manipulation or typo-squatting. It resolves to IP address 104.21.46.167 and holds an SSL certificate issued by Google Trust Services (WE1). VirusTotal reports 9/95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. Google Safe Browsing currently lists the domain as deceptive, and it has been actively blocked by multiple cryptocurrency security tools.

The domain has since been taken offline, likely following abuse reports and automated takedown procedures. While no longer accessible, residual risk remains for users who may have interacted with the site prior to its removal. Organizations are advised to update web filters, monitor for credential reuse attempts, and alert users who may have visited the domain. Future iterations of this campaign may reappear under similar domains or IP infrastructure, requiring continued vigilance in monitoring newly registered lookalike domains.