official-firelightfi[.]live

The domain official-firelightfi.live is currently listed on three public security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services. VirusTotal scans show that five of ninety-one participating security vendors have issued detections against the domain, confirming its association with malicious activity. The intelligence classification identifies the site as a generic phishing resource, and the risk rating is elevated while the operational status remains active.

Infrastructure details such as registrar information, hosting IP address, ASN, SSL certificate status, HTTP response codes, and Safe Browsing scores are not disclosed in the available data, leaving those elements of the attack infrastructure unverified. Likewise, page-title content and any brand-targeting cues have not been published, so the precise lure used by the site cannot be confirmed beyond the generic phishing attribution. Given the confirmed presence on multiple blocklists and the vendor detections, defenders should prioritize immediate containment.

Recommended actions include adding official-firelightfi.live to network-level deny lists, ensuring that endpoint protection and web-gateway solutions reference the PhishDestroy, MetaMask, and SEAL blocklists, and configuring URL filtering to drop any HTTP or HTTPS requests to the domain. Continuous monitoring of DNS queries for this FQDN is advised, and any newly observed traffic should be logged for forensic analysis. Because the underlying hosting infrastructure is unknown, threat-intel teams should consider performing active reconnaissance—such as passive DNS lookups and WHOIS queries—to gather additional context that may support attribution or remediation efforts.