foundation-firelight[.]com

Analysis of foundation-firelight.com indicates an active high‑risk phishing infrastructure targeting cryptocurrency users. The domain was registered on June 02, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 188.114.96.3, which is hosted by CloudFlare, Inc. in Canada. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 identifier, and the page title "Firelight – The Protection Layer for Digital Assets" is observed. Cloudflare Browser Insights, Cloudflare and HTTP/3 are detected, confirming the use of Cloudflare’s performance and security services. Reputation services have flagged the domain: six of ninety‑one VirusTotal scanners reported detections, Gridinsoft assigns a trust score of 0/100, and the domain appears on four external blocklists. It is also listed by PhishDestroy, MetaMask, SEAL and ScamSniffer as a blocked entity, with the specific scam type identified as a Crypto Drainer. While the exact phishing payload and user‑facing content have not been analysed, the convergence of a recent registration, low trust score, multiple vendor detections, and inclusion on anti‑phishing blocklists demonstrates a clear malicious intent. Defenders should block the domain at network perimeter, update endpoint detection signatures to include the 188.114.96.3 address, and monitor for related indicators of compromise. Continuous observation is advised to capture any evolution of the site’s content or additional infrastructure components.