firelightfinances[.]com

PhishDestroy identifies firelightfinances.com as an active credential theft domain currently under investigation. The threat actor impersonates Firelight Finance to harvest login credentials and sensitive financial data. The domain operates at high risk with confirmed malicious intent based on current behavioral analysis.

This domain was flagged by 1 of 95 VirusTotal vendors as of the latest scan, indicating a low detection rate despite its malicious nature. It resolves to IP 188.114.96.3, is registered through HOSTINGER operations, UAB, and was created on December 02, 2025. Users should avoid any interaction with this domain, as its SSL certificate issued by Google Trust Services increases its perceived legitimacy. The combination of a newly registered domain, low VirusTotal detection, and known malicious IP behavior signals a significant threat to potential victims.

The credential theft domain firelightfinances.com remains active and dangerous. Users must avoid accessing or entering any credentials on this site. Organizations should block the domain and IP address at the network level and update firewall rules to prevent data exfiltration. Immediate reporting to cybersecurity teams or authorities is strongly recommended to mitigate potential financial fraud. Share threat intelligence to prevent further compromise.