firelighthomes[.]org

The domain firelighthomes.org is currently active and returns HTTP 200 responses. It resolves to the IP address 3.33.130.190, which is hosted by Amazon Web Services Global Accelerator and geolocated to California. Registration details show the domain was purchased through GoDaddy.com, LLC, with authoritative name servers ns13.domaincontrol.com and ns14.domaincontrol.com, and it presents a GoDaddy-issued DV TLS certificate. Malware‑scanning services on VirusTotal have flagged the domain by four of ninety‑one vendors, indicating some level of malicious content, though the exact payload or page content has not been publicly disclosed. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting that multiple sink‑hole and anti‑phishing platforms have identified it as a threat. The precise phishing campaign, target brand, or lure employed by the site remains unknown due to lack of page‑level analysis. Defenders should add firelighthomes.org to URL filtering and DNS blocklists, monitor outbound connections to its AWS‑accelerated IP, and consider sharing indicators of compromise with threat‑sharing communities to improve collective detection. Ongoing observation is advised to capture any evolution of the infrastructure or associated payloads.