votes-firelightfinance[.]com

This domain, votes-firelightfinance.com, was set up as a sophisticated phishing site designed to drain cryptocurrency from unsuspecting victims. It impersonates Firelight, a legitimate digital asset protection service, tricking users into believing they are accessing a secure platform. The site likely aimed to steal login credentials and private keys, giving attackers full control over victims' crypto wallets and funds. Such threats are particularly dangerous because they exploit trust in well-known brands and often use convincing interfaces to lower the user's guard.

PhishDestroy's analysis uncovered multiple red flags. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently abused by malicious actors, and was created on June 02, 2026—a very recent date for a site claiming to be an established service. Security vendors are in agreement about its malicious nature: VirusTotal shows 6 out of 95 vendors flagging the domain, and it appears on three separate security blocklists. The site used an SSL certificate from Google Trust Services, which can lend a false sense of legitimacy, but the underlying IP address 104.21.24.152 is associated with other phishing campaigns. Fortunately, the site has been taken offline, but its infrastructure could be reused.

If you visited this site or entered any information, take immediate action. Change your passwords for any accounts you may have used and enable two-factor authentication wherever possible. If you connected a crypto wallet, transfer your assets to a new wallet with a fresh seed phrase generated on a secure device. Monitor your accounts for unauthorized transactions and consider contacting your financial institution. Always verify a site's legitimacy by checking official sources and using PhishDestroy's database before interacting with any platform that requests sensitive information.