check-firelight[.]finance

This domain, check-firelight.finance, was registered on June 09, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points exclusively to the address 104.21.26.142, an IP currently associated with multiple abuse reports. The domain appears on three independent security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, indicating that at least three mitigation platforms have observed malicious traffic. VirusTotal analysis shows that six of ninety‑one scanning engines flag the domain, reinforcing the suspicion of malicious intent.

The threat is classified as a generic phishing campaign and is presently listed as active with an elevated risk rating under seed identifier 2d0674. Publicly available intelligence does not disclose a page title, SSL certificate details, HTTP response codes, Safe Browsing or OTX entries, nor any trust‑score metrics, leaving the exact content and delivery vector unconfirmed. Nonetheless, the convergence of blocklist listings, vendor detections, and the rapid registration-to‑abuse timeline suggests a purpose‑built infrastructure for credential harvesting or financial fraud.

Defenders should immediately add check-firelight.finance to DNS and web‑filter blocklists, monitor outbound connections to 104.21.26.142, and enforce email gateway rules that quarantine messages referencing the domain. Continuous re‑scanning on VirusTotal and periodic checks against emerging blocklists are recommended to capture any evolution of the payload or additional hosting changes. Organizations that employ MetaMask or similar wallet extensions should verify that the domain is denied by existing protection layers, as it has already triggered a block in that environment.