reallocations-firelight[.]xyz

Analysis indicates that the domain reallocations-firelight.xyz is actively being used for credential harvesting. The domain is listed on three independent security blocklists, demonstrating that multiple threat intelligence sources have identified it as malicious. VirusTotal scans show that six of ninety‑one security vendors have flagged the domain, providing corroborating evidence of its malicious nature.

Specific blocklist entries include PhishDestroy, MetaMask, and SEAL, all of which have taken the domain down in their respective protection layers. No additional public data on registrar details, hosting IP address, SSL certificate attributes, HTTP response codes, Safe Browsing status, or Open Threat Exchange reports were available at the time of this assessment, leaving those vectors unverified. Consequently, the full scope of the infrastructure—such as potential command‑and‑control servers or associated phishing pages—remains uncertain.

Defenders should immediately add reallocations-firelight.xyz to DNS and URL filtering solutions, ensure that endpoint security products reference the latest blocklist feeds, and monitor outbound traffic for connections to the domain’s resolved IP addresses. Continuous re‑evaluation of the domain’s status is advised, as further indicators may emerge from future scans or blocklist updates.