x-firelight[.]icu

This domain is flagged as an elevated-risk crypto wallet drainer phishing site targeting cryptocurrency users. Analysis indicates the infrastructure is designed to intercept private keys or seed phrases through deceptive wallet connection prompts, a common tactic in cryptocurrency theft operations. Infrastructure analysis reveals the domain x-firelight.icu was registered on April 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with phishing campaigns. The domain resolves to IP address 172.67.204.28 and employs Cloudflare services, likely to obfuscate the true hosting origin. A Let's Encrypt SSL certificate is present, though invalid, which is atypical for legitimate wallet services. Detection metrics show 9 out of 95 security vendors on VirusTotal flag the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL wallet protection systems. The page title, 'x-firelight.icu | 526: Invalid SSL certificate,' further suggests an attempt to mimic technical errors to deceive users. Mitigation steps for users include immediately revoking any wallet permissions granted to this domain and avoiding interaction with any prompts or pop-ups originating from x-firelight.icu. Users should verify domain authenticity through official project documentation or community channels before connecting wallets. If exposure is suspected, affected parties should transfer assets to a new wallet using a fresh seed phrase and monitor transaction histories for unauthorized activity. Wallet software should be updated to the latest version to ensure protection against known phishing domains.