firelighteligiblity[.]com

The domain firelighteligiblity.com was created on 13 March 2026 and is currently taken offline. It resolves to the Cloudflare‑owned address 188.114.96.3, located in the United States and announced as AS13335 Cloudflare, Inc. The site is protected by a Let's Encrypt certificate (issuer E8) and enforces HSTS, while Cloudflare services such as Browser Insights and HTTP/3 are observed. Nameservers aurora.ns.cloudflare.com and martin.ns.cloudflare.com confirm the use of Cloudflare DNS. The page title returned by the site was "Firelight Phase 2 – Insurance Rewards," indicating an attempt to lure victims with a purported insurance rewards offering.

VirusTotal analysis shows three of ninety‑four security vendors flagged the domain, suggesting at least limited malicious detection. The domain appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious classification. Registration was performed through NiceNIC International Group Co., Limited, a registrar known to host a variety of legitimate and illicit domains.

While the exact phishing kit or credential‑capture mechanism has not been observed, the combination of blocklist presence, vendor flags, and the deceptive page title provides sufficient evidence to treat the domain as a malicious phishing infrastructure. Defenders should add firelighteligiblity.com to deny‑list rules, monitor DNS queries for the associated IP and Cloudflare nameservers, and ensure that any inbound traffic to the address is dropped. Continuous re‑scanning with multi‑vendor tools is advised to capture any future changes in detection status.