genesis-firelight[.]live

On July 26, 2026, analysts recorded that the domain genesis-firelight.live is actively being used for generic phishing attacks. The domain was created on July 20, 2026 and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points to the IP address 172.67.157.106, which is part of Cloudflare’s hosting network, as confirmed by the authoritative nameservers april.ns.cloudflare.com and byron.ns.cloudflare.com. VirusTotal has processed the domain and 4 of 91 security vendors have flagged it, indicating that a minority of scanners already recognize malicious behavior.

The domain is listed on three public blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that multiple anti‑phishing services have taken mitigation steps. Current status is marked as active, and no public Safe Browsing, OTX, or page‑title information is available, leaving the specific phishing lure or credential‑stealing page content undocumented at this time. The high risk rating reflects the combination of a recent registration, rapid deployment, presence on blocklists, and detection by multiple security engines.

Defensive recommendations include: adding genesis-firelight.live to local DNS blocklists, enforcing firewall rules to deny outbound connections to 172.67.157.106, and monitoring for anomalous traffic that traverses Cloudflare’s edge infrastructure. Organizations should continue periodic rescanning on VirusTotal and other sandbox services to capture any payloads that may be delivered after initial URL resolution. User awareness training and mandatory multi‑factor authentication are advised to reduce the likelihood of credential compromise should an end‑user encounter the malicious site.