Analysis of the domain firelight-fxrp.org indicates it is an active phishing site registered on July 29, 2026, through Key-Systems GmbH. The domain is currently resolving to IP address 172.67.141.95 and utilizes Cloudflare nameservers (alec.ns.cloudflare.com and amalia.ns.cloudflare.com). As of July 30, 2026, the domain appears on one security blocklist, specifically PhishDestroy, which has flagged it for malicious activity. No detections were recorded among the 91 vendors that scanned the domain on VirusTotal, though the absence of detections does not confirm safety.
Infrastructure analysis reveals the domain is hosted on Cloudflare infrastructure, a common tactic to obscure the true origin of phishing sites and evade IP-based blocking. The registration date suggests recent deployment, aligning with typical phishing campaign timelines. No specific brand or scam type has been confirmed in available intelligence, though the domain name includes 'fxrp,' which may imply a targeting of financial or cryptocurrency-related credentials. The exact content and phishing kit in use remain unanalyzed at this time.
Defenders are advised to treat this domain as high-risk and implement blocking at the DNS or network level. Monitoring for connections to 172.67.141.95 or the domain itself is recommended to identify potentially compromised endpoints. Further investigation into associated infrastructure, such as co-hosted domains or related IPs, may uncover additional threats. Given the domain's recent registration and active status, continued vigilance is warranted.