vote-firelightfi[.]com

The domain vote-firelightfi.com was registered on June 9, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to IP address 188.114.97.3, which is hosted by Cloudflare, Inc. in Canada. The site presents the page title "Firelight - The Protection Layer for Digital Assets" and serves a 301 redirect over HTTP/3. Technical fingerprints show the use of Framer Sites, React, Cloudflare Browser Insights, and Cloudflare CDN, while the TLS certificate is issued by Google Trust Services under the WE1 label. Security scoring is extremely low, with Gridinsoft assigning a trust score of 0/100, and 2 of 91 VirusTotal scanners flagging the domain. The domain appears on four public blocklists and is listed in two AlienVault OTX pulses, confirming its classification as a crypto‑drainer scam. Blocklist providers PhishDestroy, MetaMask, SEAL, and ScamSniffer have all flagged the domain. The precise malicious payload or credential‑harvesting mechanisms have not been publicly disclosed; analysis is limited to the infrastructure and metadata available. Defenders should immediately block vote-firelightfi.com at network and endpoint layers, enforce DNS sinkholing, and monitor for any outbound connections to the associated Cloudflare IP. Ongoing surveillance of the domain’s DNS records and any newly observed payloads is recommended to adapt mitigation controls as the threat actor evolves its infrastructure.