stage2-firelight[.]app

Analysis indicates that the domain stage2-firelight.app is actively being used in a phishing campaign. The domain resolves to the IP address 172.67.151.124, which is hosted on a cloud service provider commonly used for legitimate traffic. VirusTotal reports that three out of ninety‑one scanned security vendors have flagged the domain as malicious, suggesting that at least a subset of scanners have identified suspicious behavior. The domain is listed on three independent security blocklists, and it is actively blocked by the extensions PhishDestroy, MetaMask, and SEAL, providing additional evidence of its abusive nature.

The threat is classified as generic phishing with an elevated risk rating, and the current status is marked as active. Publicly available intelligence does not include a page title, SSL certificate details, or explicit indication of the brand being spoofed, so the exact lure presented to victims remains unknown. Without a harvested page snapshot, defenders cannot confirm the specific credential‑collection technique employed. The lack of detailed hosting metadata beyond the IP address limits attribution to a particular autonomous system or geographic region.

Defenders should continue to block stage2-firelight.app at network perimeter and DNS filtering layers, and add the domain to internal blocklists. Monitoring for new resolutions or changes in the hosting infrastructure is advisable, as the attacker may shift to alternative IPs. Security teams should also query threat‑intel platforms for any emerging indicators of compromise that reference the same IP or related domains. Users should be warned not to interact with any unsolicited communications that reference the domain, and any attempted credential submissions should be treated as compromised.