firelight-foundations[.]xyz

This domain, firelight-foundations.xyz, is identified as a high-risk cryptocurrency wallet phishing site. Analysis indicates it targets users of decentralized finance platforms, likely deploying credential harvesting forms or fake wallet interfaces to steal private keys and seed phrases. No specific brand impersonation is confirmed, but the infrastructure aligns with known crypto-drainer kits used in recent campaigns. Infrastructure analysis reveals the domain resolves to IP address 104.21.4.28 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 10, 2026. VirusTotal detection shows 12 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists, and its Gridinsoft trust score is 0/100. AlienVault OTX records it in two threat intelligence pulses, further confirming its association with malicious activity. The domain is currently offline, likely due to takedown or suspension. However, residual risk remains as threat actors may re-deploy the infrastructure under a new domain or IP. Recommended actions include monitoring for related indicators of compromise (IOCs), such as the IP 104.21.4.28, and implementing blocklist updates to prevent access. Users who interacted with the domain should revoke active sessions, rotate credentials, and scan for unauthorized transactions.