votes-firelight[.]app

Analysis shows that votes-firelight.app was registered on June 02, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is presently hosted behind a Cloudflare edge node identified as IP 188.114.96.3, which resolves to a location in Canada. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, indicating a legitimate‑looking HTTPS endpoint. HTTP requests return a 403 status code and the page title displayed is "Just a moment...", a pattern commonly employed to delay automated analysis while prompting users to interact with deceptive content.

Threat intelligence feeds have placed votes-firelight.app on three security blocklists, and it is actively flagged by PhishDestroy, MetaMask, and SEAL as a credential‑phishing vector. VirusTotal scans reveal that six of ninety‑five security vendors have identified the domain as malicious, reinforcing the high‑risk assessment. The combination of a freshly created domain, a reputable certificate, and the use of Cloudflare’s infrastructure suggests an evasive hosting strategy designed to lend credibility while avoiding direct attribution.

Defenders should block traffic to votes-firelight.app at the DNS and firewall levels, monitor for any outbound connections to the resolved IP address, and implement URL filtering to capture attempts to retrieve the "Just a moment..." page. Incident response teams should also scan for credential harvest attempts linked to the domain, especially in contexts where users may be prompted to submit authentication details. Continuous monitoring of the associated IP and related Cloudflare edge nodes is advised, as the operators may shift hosting to additional nodes to maintain persistence.