incentives-firelight[.]com

PhishDestroy identifies incentives-firelight.com as an active credential theft domain posing as a rewards platform to harvest user credentials. The threat level is under investigation but remains active, warranting immediate caution. This domain employs deceptive tactics to mimic legitimate incentive programs, aiming to trick users into submitting sensitive login information. This domain exhibits several technical indicators of malicious intent. It resolves to IP address 188.114.97.3 and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain was created on May 13, 2026, suggesting a recent and potentially opportunistic registration. Notably, incentives-firelight.com has not yet been flagged by security vendors, with 0 detections out of 95 VirusTotal scans conducted as of the latest intelligence. The use of a Let's Encrypt SSL certificate further normalizes the domain, potentially lulling users into a false sense of security. The absence of blocklist detections indicates this campaign is either newly active or employing evasion techniques. To mitigate risk, users should avoid interacting with incentives-firelight.com entirely. If credentials were entered, immediately reset passwords on all associated accounts and enable multi-factor authentication where available. Organizations should block the domain at the network level using DNS filtering tools and report the domain to threat intelligence platforms like VirusTotal and PhishDestroy. Monitoring for follow-on attacks targeting compromised credentials is strongly advised. Treat all communications referencing this domain as highly suspicious.