firelightfi-auth[.]live

Analysis of the domain firelightfi-auth.live indicates it is an active cryptocurrency phishing site, first registered on July 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain currently resolves to the IP address 172.67.146.205, hosted on Cloudflare infrastructure, as evidenced by its nameservers (maya.ns.cloudflare.com and yisroel.ns.cloudflare.com). This hosting choice is frequently observed in phishing campaigns due to Cloudflare's privacy and proxy services, which obscure the true origin of malicious traffic. As of July 26, 2026, the domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, all of which specialize in cryptocurrency threat detection.

VirusTotal reports that 3 out of 91 security vendors flag the domain as malicious, though the absence of additional context from these vendors limits further classification of the specific attack vector. The domain's registration age—just five days old at the time of this report—aligns with common phishing timelines, where domains are rapidly deployed and discarded to evade detection. No public details are available regarding the exact content or structure of the site, such as page titles, SSL certificates, or HTTP response codes, which could provide further indicators of compromise. However, the inclusion of 'auth' in the domain name suggests an intent to mimic authentication portals, a tactic frequently used in credential harvesting or wallet-draining attacks targeting cryptocurrency users.

Defenders should treat this domain as high-risk and implement immediate blocking at the DNS or proxy level. Network monitoring for connections to 172.67.146.205 or the associated Cloudflare nameservers may reveal additional compromised endpoints. Given the domain's recent registration and active status, continued vigilance and re-evaluation of detection rules are recommended.