desk-firelight[.]com

The domain desk-firelight.com is currently active and classified as a high-risk phishing infrastructure specifically designed to impersonate cryptocurrency wallet recovery services. Analysis indicates this domain is engineered to harvest wallet credentials, seed phrases, and private keys under the guise of account restoration or security verification processes. No legitimate brand affiliation has been confirmed, though the phishing kit mimics common wallet recovery workflows. Infrastructure analysis reveals the domain was registered on June 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an offshore registrar frequently associated with malicious domains. It resolves to IP address 104.21.12.116, a Cloudflare-protected endpoint that obscures the true hosting origin. The domain appears on two security blocklists and is flagged by 3 of 95 security vendors on VirusTotal, including MetaMask and SEAL threat intelligence feeds. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to potential victims. Despite these detections, the domain remains operational and accessible. Current status shows persistent activity with no takedown observed as of this report. Organizations and individuals are advised to block the domain and its resolving IP at the network perimeter. Cryptocurrency users should verify all wallet recovery requests through official channels only, avoiding any links or forms presented via email, social media, or search results. Security teams should monitor for connections to 104.21.12.116 and review logs for credential submission attempts originating from this infrastructure. The domain's recent registration date and low detection rate suggest it may evade many automated defenses, warranting manual review of related indicators.