checker-firelight[.]app

This domain, checker-firelight.app, is actively engaged in cryptocurrency wallet credential phishing operations. Analysis indicates the site mimics legitimate wallet verification interfaces to harvest seed phrases, private keys, and login credentials from unsuspecting users. The infrastructure is designed to drain funds from compromised wallets by tricking victims into entering sensitive authentication details under the pretense of security verification or transaction confirmation. Infrastructure analysis reveals the domain was registered on June 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. The domain resolves to IP address 172.67.207.21 and is currently flagged by 3 out of 95 security vendors on VirusTotal. Additionally, checker-firelight.app appears on 2 security blocklists, and its SSL certificate is issued by Google Trust Services, which is commonly exploited to lend false legitimacy to phishing sites. The domain remains active despite being blocked by multiple wallet security providers. Users who have visited checker-firelight.app or entered credentials on the site should immediately revoke access to any connected wallets and transfer remaining assets to a new, secure wallet address. All devices used to access the domain should undergo a full malware scan using updated security tools. If seed phrases or private keys were exposed, consider the compromised wallet permanently at risk, as attackers can drain funds even after initial detection. Monitor transaction histories for unauthorized activity and report the incident to relevant security teams for further mitigation.