firelightfinances-drop[.]live

This domain, firelightfinances-drop.live, is flagged as an active credential-harvesting phishing site targeting financial services. Analysis indicates the domain was registered on July 8, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent domains. Infrastructure reveals the use of Cloudflare nameservers (kipp.ns.cloudflare.com and nola.ns.cloudflare.com) and resolves to IP 172.67.200.92, hosted under Cloudflare’s network in Canada. The site employs HTTP/3 and a Google Trust Services SSL certificate (WE1), which may lend an appearance of legitimacy to potential victims while obscuring backend infrastructure. Security vendors have detected malicious activity, with 5 out of 95 engines on VirusTotal flagging the domain. While the current HTTP status returns a 403 Forbidden response, this does not indicate inactivity—phishing domains often cycle through such states to evade automated detection. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including those focused on financial fraud prevention. The use of Cloudflare further complicates attribution, as it masks the true origin of the phishing kit and hosting provider. Defenders should treat this domain as high-risk due to its association with credential theft targeting financial users. The combination of a newly registered domain, Cloudflare obfuscation, and active blocklisting suggests an intent to deceive victims into submitting sensitive information. Network-level blocking is recommended for all endpoints, particularly those handling financial transactions or user authentication. Monitoring for related domains registered under the same registrar or using similar naming conventions (e.g., 'finances-drop') may help identify additional threats from the same actor. No legitimate business use has been identified for this domain, and its infrastructure aligns with known phishing campaigns.