tge-firelight[.]finance

This domain poses a high-risk threat as a crypto drainer impersonating MetaMask, a widely used cryptocurrency wallet. Users who interact with this site risk unauthorized access to their wallet credentials and the irreversible theft of digital assets. The site mimics legitimate MetaMask interfaces, tricking victims into entering sensitive recovery phrases or private keys, which are then harvested by threat actors for immediate fund extraction. Analysis indicates the domain was registered on June 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. It resolves to the IP address 104.21.90.236, hosted on Cloudflare’s network (AS13335), which is commonly used to obscure the true origin of phishing sites. The SSL certificate, issued by Google Trust Services (WE1), adds a superficial layer of legitimacy. Security vendors on VirusTotal flag this domain at a ratio of 3 out of 95, and it appears on three independent blocklists, including those maintained by MetaMask and SEAL. If a user has visited tge-firelight.finance or entered any credentials, immediate action is required. First, disconnect any connected wallets from the site and revoke all active sessions. Next, transfer remaining funds to a new, secure wallet with a fresh recovery phrase. Monitor all linked accounts for unauthorized transactions and enable additional security measures such as hardware-based authentication. Report the incident to the targeted brand’s official abuse channels and consider filing a report with local cybercrime authorities. Users should also scan their devices for malware, as phishing sites often deploy secondary payloads to maintain persistence.