firelight-phase2[.]xyz

Analysis indicates that the domain firelight-phase2.xyz is actively involved in credential phishing operations as of August 1, 2026. Registered on July 31, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 104.21.53.158, which is associated with Cloudflare infrastructure, as evidenced by its nameservers (adrian.ns.cloudflare.com and jay.ns.cloudflare.com). This hosting choice is consistent with tactics observed in phishing campaigns, where Cloudflare services are frequently leveraged to obscure the origin of malicious traffic and evade detection. The domain has been flagged by at least one security blocklist, and PhishDestroy has explicitly blocked it, suggesting prior detection of phishing-related activity.

VirusTotal reports that 3 out of 91 security vendors have marked the domain as malicious, though the specific nature of the detections—whether related to credential harvesting, malware distribution, or other threats—remains unconfirmed. The exact content or target of the phishing page is not yet analyzed, and no brand or scam category has been definitively associated with the domain based on available data. Infrastructure analysis reveals that the domain remains active, with no indications of takedown or mitigation efforts.

Defenders are advised to treat firelight-phase2.xyz as a high-risk resource and implement blocking measures at the DNS or network level. Security teams should monitor for connections to the IP 104.21.53.158 and investigate any user interactions with the domain, particularly in environments where credential theft could lead to unauthorized access. Given the domain's recent registration and active status, further monitoring is recommended to assess whether additional detections or blocklist inclusions emerge in the coming days.