governances-firelightfoundation[.]xyz

This domain, governances-firelightfoundation.xyz, is a confirmed credential phishing threat. It was registered on June 3, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains active as of July 12, 2026. The domain resolves to IP address 188.114.96.3, which is hosted by CloudFlare, Inc. in Canada. An SSL certificate issued by Google Trust Services (WE1) is present, and the page title returned is 'FASTPANEL', indicating a default or placeholder landing page. The domain has a Gridinsoft trust score of 0/100, reflecting high risk. It appears on at least three security blocklists and is flagged by 14 of 91 security vendors on VirusTotal. AlienVault OTX shows this domain in four threat intelligence pulses. It is blocked by PhishDestroy, MetaMask, and SEAL. The HTTP status is 301, suggesting redirection. The specific phishing kit or brand being imitated is not identified in the available data; the threat is classified as generic credential phishing. Defenders should block the domain at the network level, monitor for related subdomains or IPs, and add the indicators to threat intelligence feeds. Users who may have interacted with this domain should be notified and their credentials checked for compromise.