# PhishDestroy domain threat record: allocation-standardreserve.icu

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/allocation-standardreserve.icu/
Machine-readable companion: https://phishdestroy.io/domain/allocation-standardreserve.icu/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-29 01:26:25 UTC
- Last availability or vendor check: 2026-10-21 01:17:11 UTC
- Stored record updated: 2026-10-22 14:20:43 UTC
- VirusTotal detections in the stored snapshot: 8/91
- Independent public blocklist matches in the stored snapshot: 3
- Matching public blocklists: MetaMask, ScamSniffer, SEAL
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: firelight

## Stored infrastructure

- Observed IP address: 172.67.157.138
- Registrar in stored WHOIS data: Eranet International Limited
- Registrar country in stored WHOIS data: US
- Registration date (registry RDAP, allocation-standardreserve.icu): 2026-09-27 18:31:56 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eac7-3435-75a2-ae1a-bbbe4dc53474/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/allocation-standardreserve.icu
- Certificate Transparency search: https://crt.sh/?q=%25.allocation-standardreserve.icu
- Web Archive lookup: https://web.archive.org/web/*/https://allocation-standardreserve.icu/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
allocation-standardreserve.icu is an impersonation phishing page posing as Firelight under the title "Firelight – The Protection Layer for Digital Assets". The domain pairs "allocation" with "standard reserve", wording that fits a fake token-allocation or reward claim aimed at people who hold or follow Firelight. PhishDestroy first saw it on 2026-09-29. It went offline on 2026-09-30, and as of 2026-10-19 its DNS no longer resolves.

How the scam works
The page borrows Firelight's name and tagline so visitors believe they are on the real project's site, likely to claim an allocation. Pages like this usually ask the visitor to connect a wallet and approve or sign transactions presented as a claim or verification step. Those signatures can hand control of tokens to the attacker, or the page may ask for a seed phrase outright. Either way the victim can lose the assets in the connected wallet.

Evidence
Eight of 91 VirusTotal engines flagged the domain on 2026-09-29: alphaMountain.ai, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Kaspersky and Netcraft. That count is modest, but these vendors agreed within a day of the site appearing. Google Safe Browsing lists it as social engineering, and urlscan.io returned a malicious verdict and identified Firelight branding on the page. The wallet-focused blocklists of MetaMask, ScamSniffer and SEAL include it alongside PhishDestroy, and three AlienVault OTX pulses reference it.

Infrastructure
The domain was registered on 2026-09-27 through Eranet International Limited, two days before PhishDestroy detected it. It was offline about three days after registration, which matches a throwaway domain built for a short burst of traffic. The site sat behind Cloudflare, Inc. on an address placed in Canada, so the real origin server was not exposed. The cheap .icu extension and the generic, finance-flavoured name fit a disposable lure rather than anything tied to the real Firelight project.

What to do
If you connected a wallet to this site, use a token-approval checker to revoke any permissions you granted while it was live. Move remaining funds to a fresh wallet if you signed anything you did not fully understand. If you typed in a seed phrase, treat that wallet as compromised and transfer everything to a new wallet created with a new phrase immediately. Reach Firelight only through its official channels and ignore allocation claims promoted in direct messages or replies. Security teams should block the domain and watch for lookalike .icu domains using allocation or reserve wording with Firelight branding.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eac7-3435-75a2-ae1a-bbbe4dc53474/
VirusTotal report: https://www.virustotal.com/gui/domain/allocation-standardreserve.icu
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=allocation-standardreserve.icu
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:15:26 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png
  Captured: 2026-09-29 01:29:34 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eac7-3435-75a2-ae1a-bbbe4dc53474.png
  Captured: 2026-09-29 01:29:34 UTC
  Source report: https://urlscan.io/result/01a0eac7-3435-75a2-ae1a-bbbe4dc53474/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e461-adb0-7319-ba37-5a7b77b13e80.png
  Captured: 2026-09-29 01:26:25 UTC
  Source report: https://urlscan.io/result/01a0eac7-3435-75a2-ae1a-bbbe4dc53474/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8ee5a214-27ca-4397-92fb-ff696a6166c7.png
  Captured: 2026-09-29 01:29:47 UTC
  Source report: https://radar.cloudflare.com/scan/8ee5a214-27ca-4397-92fb-ff696a6166c7
  SHA-256: 244da117d3629e80960157db4001b45d9894e22aecedd7c5ce65ee6c2557730e
- URLQuery: https://screenshots.phishdestroy.io/uq/4be3cb00-0c8a-4dff-acd6-12275e4615f3.png
  Source report: https://urlquery.net/report/4be3cb00-0c8a-4dff-acd6-12275e4615f3
  SHA-256: 915faca7438bc0fab28d1a9a4d0f21deefec44d384d0086ec670048b70ef1f7f
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e45e-e973-761b-b6dd-49887dbfeac4.png
  Captured: 2026-09-27 19:37:06 UTC
  Source report: https://urlscan.io/result/01a0e45e-e973-761b-b6dd-49887dbfeac4/
  SHA-256: 9ca2dde7ebc4677da398d393c5f0536fba8f6ade063a94d669dbf6b67f2d1c1a
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e45e-eb1c-7471-a140-8cad8ad460e6.png
  Captured: 2026-09-27 19:37:13 UTC
  Source report: https://urlscan.io/result/01a0e45e-eb1c-7471-a140-8cad8ad460e6/
  SHA-256: 132ca024c8c3606bc25be896ca8387652dc5162361c062c6e0f56fde72438986
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e461-adb0-7319-ba37-5a7b77b13e80.png
  Captured: 2026-09-27 19:40:08 UTC
  Source report: https://urlscan.io/result/01a0e461-adb0-7319-ba37-5a7b77b13e80/
  SHA-256: f7b51be3f90fe0cadf578699174a97fa840f255d70ff7c0cf6da1d847a209eb5
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eacb-1a11-7239-88e3-a334cd6194df.png
  Captured: 2026-09-29 01:33:35 UTC
  Source report: https://urlscan.io/result/01a0eacb-1a11-7239-88e3-a334cd6194df/
  SHA-256: 1d9a51f35d3bb987453f5d30f911bbe4ea1b77adca7e1bfee1d68d64ab49f865

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:55:12Z",
        "uuid": "01a0eac7-3435-75a2-ae1a-bbbe4dc53474",
        "scanned_at": "2026-09-29T01:28:45Z",
        "final_url": "https://allocation-standardreserve.icu/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://allocation-standardreserve.icu/",
                "from": "http://allocation-standardreserve.icu/",
                "status": 307
            }
        ],
        "ip": "172.67.157.138",
        "domains": [
            "gateway.irys.xyz",
            "esm.sh",
            "arbitrum.meowrpc.com",
            "arbitrum.gateway.tenderly.co",
            "arbitrum.drpc.org",
            "rpc.ankr.com",
            "arbitrum-one.publicnode.com",
            "arb1.arbitrum.io",
            "fonts.gstatic.com",
            "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com",
            "hxjnnbfgmzureusmhjgltavcqubaut2yzqx23rrlalgrwm4nynga.mainnet-1.datasprite-cdn.com",
            "7hle7g76hwhzkcgcytuleelhk7lwp5k2ivnywsyp5umgak26bktq.mainnet-1.datasprite-cdn.com",
            "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com",
            "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com",
            "crwj4ebgvb7k4zcwmmxrnzxbs2gaegjyku7rc4eqjkvdnsvrehsa.mainnet-1.datasprite-cdn.com",
            "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com",
            "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com",
            "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com",
            "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com",
            "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com",
            "b6ktecz7yjy6fzgzlivivwfm4xtjvavuqbddceaslq46lxbuw2wq.mainnet-1.datasprite-cdn.com",
            "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com",
            "3zda2p33cro63eoev6gcult7nzm6vegrll7kg6cknocqfq4tavva.mainnet-1.datasprite-cdn.com",
            "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com",
            "tuahnjjbd4ptq2z3dq73mmxdcdpdxt5sjs4uwfluwoxw2i3zrv4q.mainnet-1.datasprite-cdn.com",
            "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com",
            "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com",
            "qyxbba7uefsmigd4oki3zm3hcmilt5fjudhha7n37oeygwrgdcua.mainnet-1.datasprite-cdn.com",
            "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com",
            "ch75ckxualkloc7t5fsfem56e5odt55sl7lel66ksibigpvzxsda.mainnet-1.datasprite-cdn.com"
        ],
        "ips": [
            "142.251.14.94",
            "104.21.15.158",
            "172.67.163.26",
            "172.66.167.42",
            "142.251.20.95",
            "104.26.13.205",
            "104.26.15.209",
            "104.17.207.5",
            "104.21.17.203",
            "104.26.11.181",
            "35.227.193.242",
            "104.18.10.59",
            "152.236.9.75",
            "172.66.150.162",
            "172.66.171.45"
        ],
        "asns": [
            "15169",
            "13335",
            "396982",
            "396356"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "link_domains": [
            "x.com",
            "firelight.finance",
            "app.firelight.finance",
            "sentora.com",
            "docs.firelight.finance",
            "framerusercontent.com",
            "medium.com",
            "discord.gg"
        ],
        "social": [
            "https://x.com/Firelightfi",
            "https://medium.com/@Firelight/step-by-step-guide-to-staking-on-firelight-in-phase-1-65678fcc49c5",
            "https://medium.com/@Firelight",
            "https://discord.gg/Q3K6S6N8hy"
        ],
        "doc_hash": "c372dbf0a9fe8d0b235835bf712f8bee7e4ea8d94212d00255532420c9d5cc17",
        "script_hashes": [
            "b9838c97850bf4f463727cf5458d53d0940b4d93564ac40803b320518c79c38c"
        ],
        "globals": [
            "requestResize",
            "__earlyClickAction",
            "__removeEarlyClick",
            "Cap",
            "downloadLogsBlobInBrowser"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "*.allocation-standardreserve.icu",
                "allocation-standardreserve.icu"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "allocation-standardreserve.icu",
            "protocol": "QUIC",
            "valid_to": "2026-12-26T17:39:22Z",
            "valid_from": "2026-09-27T17:39:23Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 142,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "firelight"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Firelight"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:50Z",
        "uuid": "8ee5a214-27ca-4397-92fb-ff696a6166c7",
        "scanned_at": "2026-09-29T01:29:47Z",
        "final_url": "https://allocation-standardreserve.icu/",
        "status": 200,
        "history": [
            {
                "url": "https://allocation-standardreserve.icu/",
                "status": 200
            }
        ],
        "dom_hash": "c8d747fc8564e7eddecddc35868eb478c03e94b04702ae1e7a6a0a38a007d79b",
        "doc_hash": "09e78d87195592735b18897fae5a0a2aecad7c84ed4c886e1e2e971efc055529",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "allocation-standardreserve.icu",
                "type": "A",
                "value": "172.67.157.138"
            },
            {
                "name": "allocation-standardreserve.icu",
                "type": "A",
                "value": "104.21.50.61"
            },
            {
                "name": "allocation-standardreserve.icu",
                "type": "AAAA",
                "value": "2606:4700:3031::6815:323d"
            },
            {
                "name": "allocation-standardreserve.icu",
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:9d8a"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.157.138",
        "whois": {
            "registrar": "Eranet International Limited",
            "created": "2026-09-27T18:31:56Z",
            "updated": "2026-09-27T18:31:57Z",
            "expires": "2027-09-27T23:59:59Z",
            "nameservers": [
                "aaden.ns.cloudflare.com",
                "nia.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:44:04Z",
        "analysis_at": "2026-10-14T07:24:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 8,
            "suspicious": 3,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "Lionic": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "LevelBlue": "suspicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "suspicious",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "ERANET INTERNATIONAL LIMITED",
        "created": "2026-09-28T02:31:56Z",
        "expires": "2027-09-27T23:59:59Z",
        "updated": "2026-09-28T00:00:00Z",
        "first_seen": "2026-09-27T19:37:12Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "nia.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:323d"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:9d8a"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.50.61"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "aaden.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "aaden.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.157.138"
            }
        ],
        "dns_at": "2026-09-29T06:47:19Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.allocation-standardreserve.icu",
                "allocation-standardreserve.icu"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "667d4cfc0dac40fe9084e96982ebfcfb692",
            "sha256": "350b877550c0f19441d3c7fb4b2553fac3596c19de28c56644b9e5c933bf539c",
            "subject": "allocation-standardreserve.icu",
            "valid_to": "2026-12-26T17:39:22Z",
            "valid_from": "2026-09-27T17:39:23Z"
        },
        "whois": {
            "registrar": "ERANET INTERNATIONAL LIMITED",
            "registrar_iana_id": "1868",
            "registrar_url": "http://www.eranet.com",
            "created": "2026-09-27T18:31:56Z",
            "updated": "2026-09-27T18:31:57Z",
            "expires": "2027-09-27T00:00:00Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "aaden.ns.cloudflare.com",
                "nia.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```