firelight-launch[.]xyz

The domain firelight-launch.xyz was registered on July 31, 2026 and is currently active. DNS resolution points to the IP address 188.114.96.3, which is hosted behind Cloudflare’s infrastructure, as indicated by the authoritative nameservers jillian.ns.cloudflare.com and langston.ns.cloudflare.com. The registrar listed for the domain is NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that it is recognized by at least one operational anti‑phishing service.

VirusTotal analysis shows that three of ninety‑one scanning engines have flagged the domain, providing additional corroboration of malicious intent. No further public intelligence such as page titles, brand targets, or detailed payload descriptors is presently available, leaving the exact phishing lure undefined. However, the combination of a newly created domain, Cloudflare‑based hosting, and multiple vendor detections aligns with typical credential‑harvesting campaigns that exploit fresh DNS to evade historical reputation.

Risk assessment classifies the domain as high, reflecting its recent creation, active status, and existing detections. Defensive teams should add firelight-launch.xyz to URL filtering and DNS block lists, monitor outbound connections for attempts to resolve the IP 188.114.96.3, and enforce strict email content controls to reduce the likelihood of users encountering malicious links. Continuous re‑evaluation is advised, as additional detection data or page‑level analysis may emerge, altering the threat profile.