tge--firelight[.]xyz

This domain, tge--firelight.xyz, poses as a legitimate cryptocurrency security service under the name Firelight – The Protection Layer for Digital Assets. Analysis indicates it functions as a crypto drainer, a type of phishing attack designed to deceive users into connecting their digital wallets. Once connected, the site executes unauthorized transactions, siphoning funds directly from the victim’s wallet without consent or notification. The site specifically targets users seeking enhanced security for their digital assets, exploiting trust in security-related services to facilitate financial theft. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on July 07, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing and fraudulent domains. It currently resolves to the IP address 104.21.48.41 and has been flagged by 9 out of 95 security vendors on VirusTotal, including detections for phishing, fraud, and malicious web content. Additionally, the domain appears in one threat intelligence pulse on AlienVault OTX, further corroborating its association with known malicious infrastructure. The page title and branding are designed to mimic legitimate security platforms, increasing the likelihood of successful deception. Users who have visited tge--firelight.xyz or interacted with its content should take immediate action to mitigate potential financial loss. First, disconnect any wallets that were connected to the site using a trusted wallet management tool or browser extension. Next, review all recent transactions for unauthorized activity and revoke any suspicious smart contract approvals. If funds were transferred, report the incident to the relevant blockchain explorer and consider filing a report with local cybercrime authorities. Monitor connected accounts for unusual activity and enable multi-factor authentication where available. Given the high-risk nature of this domain, users are advised to avoid any further interaction and treat all communications or links associated with tge--firelight.xyz as malicious.