firalend[.]xyz

Analysis of firalend.xyz shows a high‑risk, active generic phishing campaign. The domain was created on 13 March 2026 and registered through Dynadot LLC. Current threat intelligence marks the site as active with a high risk rating, indicating that the infrastructure remains in operation and is being used to lure victims.

Infrastructure analysis reveals that firalend.xyz resolves to the IP address 172.67.134.79, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Authoritative nameservers alexa.ns.cloudflare.com and randall.ns.cloudflare.com confirm the use of Cloudflare’s DNS and CDN services. The site presents a Let’s Encrypt certificate (E7) and negotiates HTTP/3, demonstrating modern transport capabilities. An HTTP 403 response is returned, and the page title displays “504: Gateway time‑out,” a tactic frequently employed to obscure malicious landing pages.

Detection metrics reinforce the malicious assessment. The domain appears on three security blocklists—PhishDestroy, MetaMask, and SEAL—and one of ninety‑five VirusTotal scanners has flagged the site. Gridinsoft assigns a trust score of 0 out of 100, and the overall classification is generic phishing. These indicators collectively confirm that the domain is being leveraged for credential‑harvesting or related fraudulent activity.

Defenders should block firalend.xyz at both DNS and network layers and add the associated IP address 172.67.134.79 to threat‑intel feeds. Continuous monitoring for new subdomains or changes to the Cloudflare configuration is recommended, as the infrastructure could be repurposed for additional campaigns. End‑user awareness messages should warn that any login or data‑collection pages hosted on this domain are likely fraudulent, and security operations should treat related alerts as high priority.