firelight-fxrp[.]biz

Analysis indicates that firelight-fxrp.biz was registered on July 30, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the Cloudflare‑hosted address 188.114.97.3 via the nameservers jo.ns.cloudflare.com and lex.ns.cloudflare.com. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming that it has been identified as a phishing vector. VirusTotal records show that the site has been scanned by 91 antivirus and URL‑reputation engines, none of which reported a detection at the time of scanning; this absence of alerts does not constitute evidence of safety and may reflect the early stage of the campaign or limited visibility in the scanning engines.

The short lifespan of the domain, combined with its Cloudflare front‑end, is consistent with infrastructure choices frequently observed in newly created phishing sites that aim to obscure the true backend location. No public information is available regarding SSL certificates, HTTP response codes, page titles, or the specific brand being impersonated, so the exact content and lure employed by the site remain unknown. Defenders should treat the domain as malicious until further analysis clarifies its payload.

Recommended actions include adding the domain to corporate blocklists, updating DNS filtering policies to deny resolution of 188.114.97.3 for this host, monitoring for any surge in traffic toward the domain, and initiating deeper sandbox analysis if a sample URL becomes available. Continuous observation of the registrar and associated nameservers is advised, as changes may indicate a handoff to other malicious infrastructure. Until additional technical artifacts are gathered, the safe posture is to assume the domain is part of an active phishing campaign and to enforce preventative controls accordingly.