firelightfi-panel[.]live

The domain firelightfi-panel.live was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and created on July 17, 2026. It resolves to the IP address 172.67.164.126 and is served by Cloudflare infrastructure, as indicated by the authoritative nameservers hope.ns.cloudflare.com and patrick.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 certificate authority, confirming that HTTPS connections are encrypted but offering no indication of legitimate ownership. VirusTotal records show that the domain was scanned by 91 security vendors; at the time of analysis no vendor reported a detection, though the absence of a detection does not constitute assurance of safety. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the assessment that it is being used for malicious purposes. No public page title, brand targeting, or detailed page content has been disclosed, leaving the exact phishing lure unknown. Infrastructure analysis therefore relies on registration data, hosting details, and blocklist presence. Defenders should treat firelightfi-panel.live as an active phishing vector, add the domain and its IP address to network deny lists, monitor DNS queries for the associated Cloudflare nameservers, and enforce web filtering policies that block HTTPS traffic to the host. Continuous re‑scanning with multi‑vendor engines is recommended to capture any future payload changes, and any observed credential capture attempts should be reported to incident response teams for containment.