firelight-finance[.]biz

Analysis indicates that firelight-finance.biz was registered on July 31 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to 172.67.167.22, which is hosted on Cloudflare infrastructure, as evidenced by the authoritative name servers jo.ns.cloudflare.com and lex.ns.cloudflare.com. Google Safe Browsing has classified the URL as a social engineering threat, and the domain appears on the PhishDestroy blocklist, as well as one additional security blocklist. VirusTotal reports that three of ninety‑one scanners have flagged the domain, confirming malicious activity.

The domain is currently active and continues to resolve, suggesting the phishing infrastructure remains operational. The limited detection footprint—only three vendor detections and a single blocklist entry—means that many security products may not yet flag the site, increasing the risk of exposure for organizations that rely on a narrow set of feeds. The recent registration date (less than two weeks before the report) aligns with a fast‑turnaround campaign often observed in generic phishing operations. Cloudflare’s generic IP does not provide clear attribution, and no SSL certificate details, HTTP response codes, page title, or content analysis have been disclosed, leaving the exact phishing payload unknown.

Defenders should proactively block firelight-finance.biz at the DNS or proxy level, add the IP address 172.67.167.22 to network‑level deny lists, and ensure that Google Safe Browsing and PhishDestroy feeds are enabled in email and web gateways. Continuous monitoring of VirusTotal and other multi‑engine scanners for updated detection counts is advised. Because the domain is newly created, threat‑intel teams should watch for related domains that share the same registrar or nameserver pattern, as attackers frequently register clusters of similar domains for campaign expansion.