treasurypool-firelight[.]foundation

This domain, treasurypool-firelight.foundation, operates as a brand impersonation scheme designed to deceive users of the legitimate hardware wallet service. The site mimics the appearance and functionality of the authentic platform, presenting itself as 'Firelight – The Protection Layer for Digital Assets.' Its primary objective is to harvest sensitive credentials, such as recovery seeds or private keys, under the guise of enhanced security features. Users who interact with this domain risk unauthorized access to their digital assets, financial theft, or complete account compromise. The threat is particularly insidious due to its polished presentation and targeted exploitation of trust in established security brands. Analysis indicates this domain is a confirmed malicious entity with substantial evidence supporting its fraudulent nature. It was registered on May 12, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to the IP address 172.67.161.90, which is hosted behind Cloudflare, a common tactic to obscure origin servers and evade detection. Security vendors have flagged this domain extensively, with 10 out of 95 engines on VirusTotal identifying it as malicious. Additionally, it appears on four security blocklists and is actively blocked by multiple browser-based protection tools, further confirming its classification as a high-risk impersonation threat. Users who have visited treasurypool-firelight.foundation or interacted with its content should take immediate action to mitigate potential damage. First, cease all interaction with the domain and avoid entering any credentials or sensitive information. If login details or recovery phrases were submitted, assume they are compromised and initiate a full security review of all associated accounts. This includes revoking access to any connected wallets or applications, generating new recovery seeds, and monitoring for unauthorized transactions. It is also recommended to scan local devices for malware, as phishing sites often deploy additional payloads. Finally, report the domain to relevant security communities and the impersonated brand to aid in broader threat mitigation efforts.