event-firelight[.]xyz

Analysis of the domain event-firelight.xyz indicates active phishing infrastructure targeting login credentials. Registered on July 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 188.114.97.3 and uses Cloudflare nameservers kipp.ns.cloudflare.com and nola.ns.cloudflare.com. As of July 29, 2026, the domain remains operational and appears on one security blocklist, with PhishDestroy marking it as malicious. VirusTotal reports three out of ninety-one security vendors flagging the domain, though the specific detection labels and targeted brand are not yet confirmed.

The registration date suggests recent deployment, a common trait in phishing campaigns aiming to evade detection before widespread blocklisting. The use of Cloudflare nameservers may obscure hosting details and complicate takedown efforts. While the exact content of the site is not analyzed, the domain's classification as a generic phishing threat implies it likely hosts fraudulent login pages designed to harvest credentials.

Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Further investigation into associated IP infrastructure and historical WHOIS records may reveal additional linked domains or campaign patterns. No evidence currently links this domain to a specific brand or phishing kit, and the page title remains unconfirmed.