firelight-allocation[.]live

Analysis of the domain firelight-allocation.live indicates a high-risk phishing infrastructure active as of July 26, 2026. The domain was registered on July 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with newly observed malicious domains. It resolves to the IP address 104.21.5.125, which is part of Cloudflare’s network, a common hosting choice for threat actors due to its privacy and proxy services. The nameservers isla.ns.cloudflare.com and mitchell.ns.cloudflare.com further confirm Cloudflare’s infrastructure usage.

The domain is currently flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, suggesting detection by both general phishing and cryptocurrency-focused security tools. While the page title 'Just a moment...' is consistent with Cloudflare’s interstitial or challenge pages, it may also indicate a holding or redirection page awaiting malicious content deployment. The SSL certificate, issued by Google Trust Services (WE1), is valid and does not raise immediate concerns, though legitimate certificates are routinely exploited in phishing operations to appear trustworthy. VirusTotal reports that 3 out of 91 security vendors have flagged this domain, a modest detection rate that may reflect its recent registration and limited exposure.

No specific brand impersonation or scam category is confirmed in the available data, and the exact content or target of the phishing page remains unanalyzed. Defenders should treat this domain as active and high-risk, particularly given its inclusion on multiple blocklists and its use of Cloudflare’s infrastructure to obscure origin details. Network-level blocking or monitoring of connections to 104.21.5.125 and the domain itself is recommended until further analysis clarifies its intent or it is confirmed inactive.