firelight-app[.]live

Analysis of the domain firelight-app.live indicates it is actively involved in phishing operations targeting cryptocurrency wallet users. Registered on July 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 188.114.96.3, which is associated with Cloudflare's infrastructure, as evidenced by its nameservers (dan.ns.cloudflare.com and maxine.ns.cloudflare.com). This hosting choice is commonly observed in phishing campaigns to obscure the true origin of malicious content and evade detection. As of July 26, 2026, the domain remains active and is flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL.

These entities classify it as a high-risk threat, specifically linked to phishing attempts aimed at cryptocurrency users. VirusTotal reports that 4 out of 91 security vendors detect the domain as malicious, though the absence of additional context limits the depth of this assessment. The low detection rate does not imply safety; rather, it may reflect the domain's recent registration or evasion tactics. The exact content or phishing kit employed by firelight-app.live has not been fully analyzed, and no specific brand impersonation has been confirmed in the available data.

However, the inclusion of 'app' in the domain name and its targeting by MetaMask suggest a focus on mimicking legitimate cryptocurrency wallet applications or services. Defenders should treat this domain as malicious and prioritize blocking it at the DNS or network level. Organizations are advised to monitor for connections to 188.114.96.3 and the associated nameservers, as these may serve as indicators of compromise for related phishing infrastructure. Further investigation into the domain's HTTP responses, SSL certificates, and any linked subdomains is recommended to assess the full scope of the threat.