interests-firelight[.]app

This domain is flagged as a high-risk crypto wallet drainer, a type of phishing infrastructure designed to deceive users into connecting their cryptocurrency wallets to malicious smart contracts. Once connected, these contracts execute unauthorized transactions, draining funds without the user’s consent. The threat is classified as active and highly targeted, with infrastructure optimized for rapid deployment and evasion of traditional security controls. Analysis indicates the domain interests-firelight.app was registered on June 02, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk registrations. It resolves to the IP address 104.21.63.26, a Cloudflare proxy endpoint commonly used to obscure the true hosting origin. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 6 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the underlying malicious intent. The domain remains active, suggesting ongoing or imminent attack campaigns. To mitigate the risk posed by this crypto wallet drainer, users should immediately block the domain at the network or endpoint level. Wallet software should be configured to reject connection requests from untrusted or newly registered domains. Organizations should update their threat intelligence feeds to include this domain and its associated IP address, and monitor for any attempts to resolve or communicate with it. Users who may have interacted with the domain should revoke all connected wallet permissions and audit their transaction history for unauthorized activity. Given the high-risk nature of this infrastructure, all interactions with interests-firelight.app should be treated as compromised.