vote-firelight[.]icu

This domain, vote-firelight.icu, is flagged as a high-risk phishing site with active malicious infrastructure. Registered on April 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, it currently resolves to IP 172.67.155.123, a Cloudflare-hosted address in Canada. The domain uses Cloudflare nameservers (cesar.ns.cloudflare.com, colette.ns.cloudflare.com) and HTTP/3, returning an HTTP 526 status due to an invalid SSL certificate issued by Let's Encrypt (serial E7). The page title explicitly states 'vote-firelight.icu | 526: Invalid SSL certificate,' indicating misconfigured or intentionally broken TLS. Analysis reveals the domain appears on three security blocklists and is referenced in 23 AlienVault OTX threat intelligence pulses, suggesting widespread detection. Nine of 91 security vendors on VirusTotal flag this domain, though the exact nature of the phishing content remains unconfirmed as the site has not been directly analyzed. The domain is actively blocked by multiple security providers, reinforcing its malicious classification. Defenders should treat this domain as hostile and implement immediate blocking at the DNS, IP, and SSL certificate levels. The use of Cloudflare infrastructure is consistent with threat actors leveraging CDN services to obscure origin servers. Given the invalid SSL certificate and HTTP 526 response, automated systems may fail to inspect payloads, necessitating manual review of related network traffic. No specific brand or scam type is identified in the available data, so generic phishing detection rules should apply.