firelight-trusted[.]live

Analysis of firelight-trusted.live indicates that the domain is actively being used for a generic phishing campaign and is classified as high risk. The domain was registered on July 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, and it is hosted on Cloudflare infrastructure, using the authoritative nameservers kellen.ns.cloudflare.com and samara.ns.cloudflare.com. DNS resolution points to the IP address 172.67.190.113, which is owned by Cloudflare and commonly leveraged by threat actors to hide the true origin of malicious traffic. VirusTotal scans show that three of ninety‑one security vendors have flagged the domain, providing independent confirmation of malicious intent.

The domain is listed on three security blocklists, specifically PhishDestroy, MetaMask, and SEAL, and these listings are reflected in multiple defensive feeds. Current threat intelligence sources label the activity as generic phishing, but no further details such as the targeted brand, page title, or specific login lure have been disclosed. Consequently, the exact content of the landing page and any associated SSL certificate or HTTP response codes remain unknown.

Defenders should block DNS resolution to firelight-trusted.live at the network perimeter, add the IP address 172.67.190.113 to outbound deny lists, and ensure that endpoint security solutions incorporate the three blocklist entries. Continuous monitoring of Cloudflare‑hosted IP ranges for anomalous traffic patterns is advised, as the shared infrastructure could host additional malicious domains. Organizations are encouraged to update web filtering policies to include the domain and to educate users about unsolicited requests that may originate from newly created domains such as this one.