vote-firelightfinance[.]xyz

The domain vote-firelightfinance.xyz was registered on 2 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The site presents a page titled “Firelight – The Protection Layer for Digital Assets” and returns an HTTP 301 status, indicating a permanent redirect. Its current status is listed as active, and the risk level has been assessed as high. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which is hosted by CloudFlare, Inc. in Canada. The service is protected by an SSL certificate issued by Google Trust Services under the WE1 designation, confirming the use of a valid TLS layer. No additional hosting or CDN layers beyond CloudFlare are observed. Threat intelligence places vote-firelightfinance.xyz on three security blocklists and records six detections out of ninety‑five VirusTotal scanners. The domain is actively blocked by PhishDestroy, MetaMask, and SEAL, and is classified as a crypto‑drainer campaign. These indicators collectively confirm that the site is being used to lure victims into fraudulent transactions aimed at exfiltrating cryptocurrency assets. Defenders should add vote-firelightfinance.xyz to URL filtering policies and ensure DNS resolvers return a negative response for the name. Network monitoring should flag any outbound connections to 188.114.97.3, and TLS inspection may be employed to verify the certificate chain. While the specific phishing kit and targeted user base have not been disclosed, the observed indicators warrant immediate containment and continued observation for related infrastructure.