firelightfi-enter[.]live

Analysis of firelightfi-enter.live shows a newly registered domain that is actively serving a generic phishing campaign. The domain was created on July 17, 2026 and is hosted on the IP address 188.114.96.3, which is associated with Cloudflare’s network. Authoritative nameservers listed are amos.ns.cloudflare.com and dorthy.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar that is frequently observed in malicious registrations.

VirusTotal reports indicate the domain has been scanned by 95 antivirus and URL‑reputation vendors, with none reporting a detection at the time of analysis. While the lack of detections does not guarantee safety, it demonstrates that the domain has not yet triggered signatures in the majority of public scanning engines. The domain is currently listed on one security blocklist and has been specifically blocked by the PhishDestroy service, reinforcing the assessment of phishing activity.

No public evidence was found regarding SSL certificate details, HTTP response codes, Safe Browsing status, OTX mentions, or the content of the page title, leaving those aspects of the infrastructure unverified. The absence of such data limits the ability to profile the site’s surface‑level behavior, but the combination of recent creation, Cloudflare hosting, registrar choice, blocklist presence, and the active designation by PhishDestroy provides sufficient indicators for defensive action.

Defenders are advised to add firelightfi-enter.live to URL filtering rules, block the associated IP address 188.114.96.3 at the network perimeter where feasible, and monitor for any outbound connections to this domain. Continuous re‑scanning with multi‑vendor services is recommended to capture any future changes in detection status. Organizations should also consider sharing this indicator with threat‑intel sharing platforms to aid broader community awareness.