firelight.fi presented itself under the name "Firelight" and operated as a crypto wallet drainer targeting cryptocurrency holders. PhishDestroy first detected it on 2026-09-17. The site went offline the following day, 2026-09-18, and remained dead as of the last check on 2026-10-19. Despite its short active window, it was flagged across multiple independent threat-intelligence platforms before going dark.
How the scam works
Wallet drainers lure victims into connecting their crypto wallets through a convincing web interface, then prompt them to sign transactions or grant token approvals that hand control of their assets to the attacker. Once approval is granted, the drainer contract silently sweeps tokens and NFTs from the victim's wallet without any further interaction required. The victim typically loses all approved assets within seconds of signing, with no way to reverse the transfer.
Evidence
Five of 89 engines on VirusTotal flagged firelight.fi on 2026-09-17, with detections from ChainPatrol, alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, and VIPRE. The domain also appears on four OTX threat-intelligence pulses. It was added to the blocklists maintained by PhishDestroy, MetaMask, and SEAL, meaning active wallet software would have warned users before they could interact with the site.
Infrastructure
The domain was registered on 2026-04-25 through 101Domain GRS Ltd. and sat dormant for nearly five months before becoming active. It was hosted on Cloudflare's network, resolving to an IP geolocated to Canada, and used a Let's Encrypt TLS certificate issued under the YE2 authority, a common low-cost setup that lends a false appearance of legitimacy.
What to do
If you visited firelight.fi and connected your wallet, immediately revoke all token approvals granted during that session using a trusted approval-management tool, then transfer remaining assets to a fresh wallet address. If you signed any transaction, assume those assets are lost and report the incident to your wallet provider. Defenders and security teams should ensure firelight.fi is present in their blocklists and distribute the domain to any threat-feed subscribers; the MetaMask and SEAL blocklist entries mean most major wallet interfaces already block it.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
