phase1-firelight[.]xyz

phase1-firelight.xyz was registered on July 31 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently serviced by Cloudflare nameservers braden.ns.cloudflare.com and davina.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.97.3, which is the sole hosting endpoint observed. VirusTotal records show that three of ninety‑one scanned scanners flagged the domain, indicating that at least a minority of security products consider it malicious. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that threat‑intel feeds have identified it as hostile.

No public Safe Browsing, OTX, SSL certificate, HTTP response code, or page‑title information is available in the current intelligence set, leaving the exact payload or credential‑capture mechanisms unverified. The rapid creation date—only one day prior to the report—combined with the immediate detection by multiple vendors suggests a purpose‑built phishing campaign. Infrastructure analysis shows the use of Cloudflare’s DNS service, which can provide rapid domain turnover and conceal the true hosting provider. The absence of additional contextual data (e.g., brand spoofed, landing‑page details) means that defenders cannot attribute the domain to a specific target sector, but the generic phishing classification warrants broad protective measures.

Defenders should add 188.114.97.3 and the domain phase1-firelight.xyz to network‑level deny lists, enforce email gateway filtering for URLs pointing to the domain, and monitor DNS queries for further resolution changes. Continuous re‑scanning of the domain on VirusTotal and inclusion in endpoint URL reputation feeds are recommended to capture any evolution of the threat. Organizations should also consider sharing any observed malicious activity with upstream threat‑sharing communities to improve collective detection.