firelight-phase1[.]xyz

The domain firelight-phase1.xyz was registered on July 31, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IP address 104.21.32.13. Analysis of public threat intelligence shows that the domain is flagged by three of ninety‑one security vendors on VirusTotal, indicating that multiple anti‑malware engines have identified malicious behavior associated with the host. The domain also appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming its classification as a phishing operator.

The authoritative name servers keanu.ns.cloudflare.com and ziggy.ns.cloudflare.com are Cloudflare‑provided, which is consistent with the use of a CDN to hide the true hosting location and to provide fast DNS resolution. The hosting provider for the IP 104.21.32.13 is not disclosed in the supplied data, leaving the underlying server environment uncertain. No SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts are available, so the content served by the domain cannot be verified at this time.

The combination of recent registration, rapid deployment, detection by multiple vendors, and inclusion on a phishing blocklist suggests a high‑risk generic phishing campaign that is actively targeting users. Defensive teams should add firelight-phase1.xyz to web‑filter and DNS block lists, monitor outbound connections to the associated IP, and enforce strict email filtering for messages that reference the domain. Continuous re‑evaluation is advised, as further analysis of the web payload and any associated command‑and‑control infrastructure may reveal additional indicators of compromise.