vote-firelight[.]finance

This domain, vote-firelight.finance, poses as a legitimate digital asset protection service under the Firelight brand to execute credential phishing attacks targeting cryptocurrency users. The site mimics security infrastructure, presenting itself as a "Protection Layer for Digital Assets" to deceive victims into entering wallet credentials, private keys, or recovery phrases. Analysis indicates the domain is designed to harvest sensitive authentication data, which attackers can then use to drain digital wallets or gain unauthorized access to blockchain-based assets. The threat is particularly elevated due to the domain’s use of technical obfuscation and infrastructure commonly associated with legitimate crypto security providers. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on April 30, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently exploited for fraudulent schemes. It resolves to the IP address 104.21.53.212, which is protected by Cloudflare, a service often leveraged to mask the true origin of phishing sites. The domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and ScamSniffer, and is flagged by 2 out of 95 security vendors on VirusTotal. Detected technologies include Framer Sites, React, and Cloudflare Browser Insights, further confirming the use of modern web frameworks to enhance the site’s credibility while evading detection. Users who visited vote-firelight.finance should immediately revoke any permissions granted to the site via wallet connections or browser extensions. If credentials, private keys, or recovery phrases were entered, affected wallets must be transferred to new, secure addresses, and all associated devices should be scanned for malware. Monitor transaction histories for unauthorized activity and report the incident to relevant blockchain security teams. Given the domain’s current offline status, users should remain vigilant for similar phishing attempts, particularly those impersonating crypto security services, and verify all URLs against official sources before interacting with them.