# PhishDestroy domain threat record: allocations-embercurve.xyz

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/allocations-embercurve.xyz/
Machine-readable companion: https://phishdestroy.io/domain/allocations-embercurve.xyz/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-29 01:26:11 UTC
- Last availability or vendor check: 2026-10-21 22:32:44 UTC
- Stored record updated: 2026-10-22 14:20:43 UTC
- VirusTotal detections in the stored snapshot: 3/91
- Independent public blocklist matches in the stored snapshot: 3
- Matching public blocklists: MetaMask, ScamSniffer, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Curve

## Stored infrastructure

- Observed IP address: 104.21.63.218
- Registrar in stored WHOIS data: Eranet International Limited
- Registrar country in stored WHOIS data: US
- Registration date (registry RDAP, allocations-embercurve.xyz): 2026-09-27 09:16:03 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eac9-9e63-7018-ad2b-8aa77ec4f5bd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/allocations-embercurve.xyz
- Certificate Transparency search: https://crt.sh/?q=%25.allocations-embercurve.xyz
- Web Archive lookup: https://web.archive.org/web/*/https://allocations-embercurve.xyz/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
allocations-embercurve.xyz is an impersonation phishing page that borrowed the Curve name and paired it with an "allocations" lure. It targeted DeFi users who might believe they qualify for a token distribution. PhishDestroy first flagged it on 2026-09-29. The site has been offline since 2026-09-30 and was still dead when last checked on 2026-10-19.

How the scam works
The page carried the title "Firelight – The Protection Layer for Digital Assets", and urlscan.io recognised Firelight branding on it, while we classified the site as impersonating Curve. The domain name pairs the Curve brand with "allocations" to suggest a claimable airdrop or reward. Pages built around fake allocation claims usually ask the visitor to connect a wallet and then sign a transaction or approval presented as the claim step. That signature can hand an attacker permission to move tokens out of the wallet, so the victim loses assets rather than gaining any.

Evidence
VirusTotal flagged the domain with only 3 of 91 engines on 2026-09-29: alphaMountain.ai, Forcepoint ThreatSeeker and Gridinsoft. That low count reflects how quickly the site appeared and vanished, not its safety. urlscan.io returned a malicious verdict. The wallet-security community moved faster than the antivirus engines, with MetaMask, ScamSniffer and SEAL all listing the domain alongside PhishDestroy, so many wallet users would have seen a warning before reaching it.

Infrastructure
The domain was registered on 2026-09-27 through Eranet International Limited and was caught two days later. It went dark the day after that. This short lifecycle is typical of disposable phishing domains that are used for a brief campaign burst and then abandoned. The site sat behind Cloudflare, Inc. on an address geolocated to Canada, which hides the actual origin server.

What to do
If you connected a wallet to this site and signed anything, check your token approvals with a revocation tool and revoke any permission you do not recognise. If you entered a seed phrase, treat the wallet as compromised and move the remaining funds to a newly created wallet. Only claim Curve-related rewards through Curve's official channels, and be wary of "allocation" links shared in DMs or replies. Defenders should block the domain and watch for lookalikes that combine "allocations" or "claim" wording with DeFi brand names on cheap TLDs.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eac9-9e63-7018-ad2b-8aa77ec4f5bd/
VirusTotal report: https://www.virustotal.com/gui/domain/allocations-embercurve.xyz
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=allocations-embercurve.xyz
Archived copy: https://web.archive.org/web/20260929012722/https://allocations-embercurve.xyz/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:15:23 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png
  Captured: 2026-09-29 01:32:15 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eac9-9e63-7018-ad2b-8aa77ec4f5bd.png
  Captured: 2026-09-29 01:32:15 UTC
  Source report: https://urlscan.io/result/01a0eac9-9e63-7018-ad2b-8aa77ec4f5bd/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e454-a2b4-7728-b243-fdb7a984c5d9.png
  Captured: 2026-09-29 01:26:11 UTC
  Source report: https://urlscan.io/result/01a0eac9-9e63-7018-ad2b-8aa77ec4f5bd/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/95172c63-14bd-43d4-bc66-b71229296572.png
  Captured: 2026-09-29 01:27:38 UTC
  Source report: https://radar.cloudflare.com/scan/95172c63-14bd-43d4-bc66-b71229296572
  SHA-256: 8ab0083f68011e9bb4372e264877ad65352817a913db9d793df9bc3dea269ed1
- URLQuery: https://screenshots.phishdestroy.io/uq/fbfc4b43-7ba9-4e4c-a7c2-b7438079268c.png
  Source report: https://urlquery.net/report/fbfc4b43-7ba9-4e4c-a7c2-b7438079268c
  SHA-256: 7ae12b77a4d3166ee01bf9f1fa858c4c345b80f9e5e581f142cfd29fcffd776a
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e454-8de7-72be-894f-9a69d0ea1cc0.png
  Captured: 2026-09-27 19:25:47 UTC
  Source report: https://urlscan.io/result/01a0e454-8de7-72be-894f-9a69d0ea1cc0/
  SHA-256: a7e62fadaa0a4a6862a39a3eff086bd8dbf76d112dcda120b617eef65d5a14d7
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e454-a2b4-7728-b243-fdb7a984c5d9.png
  Captured: 2026-09-27 19:25:52 UTC
  Source report: https://urlscan.io/result/01a0e454-a2b4-7728-b243-fdb7a984c5d9/
  SHA-256: a7e62fadaa0a4a6862a39a3eff086bd8dbf76d112dcda120b617eef65d5a14d7
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eac5-3371-706a-a782-e6af5b4b3fd8.png
  Captured: 2026-09-29 01:26:46 UTC
  Source report: https://urlscan.io/result/01a0eac5-3371-706a-a782-e6af5b4b3fd8/
  SHA-256: 9bed5d78dc6e21ac0a0c0ec2dc606b05948aa0513164bbd9a627e12c967c8585
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eacb-2a0c-7093-b9a1-5bafef7e649c.png
  Captured: 2026-09-29 01:33:05 UTC
  Source report: https://urlscan.io/result/01a0eacb-2a0c-7093-b9a1-5bafef7e649c/
  SHA-256: 9cd15e654f8b94eb30f83a9940add2560c5c6e17d164109713f2ba45265d847f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:55:16Z",
        "uuid": "01a0eac9-9e63-7018-ad2b-8aa77ec4f5bd",
        "scanned_at": "2026-09-29T01:31:26Z",
        "final_url": "https://allocations-embercurve.xyz/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://allocations-embercurve.xyz/",
                "from": "http://allocations-embercurve.xyz/",
                "status": 307
            }
        ],
        "ip": "104.21.63.218",
        "domains": [
            "gateway.irys.xyz",
            "esm.sh",
            "arbitrum.meowrpc.com",
            "arbitrum.gateway.tenderly.co",
            "arbitrum.drpc.org",
            "rpc.ankr.com",
            "arbitrum-one.publicnode.com",
            "arb1.arbitrum.io",
            "static.cloudflareinsights.com",
            "fonts.gstatic.com",
            "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com",
            "hxjnnbfgmzureusmhjgltavcqubaut2yzqx23rrlalgrwm4nynga.mainnet-1.datasprite-cdn.com",
            "7hle7g76hwhzkcgcytuleelhk7lwp5k2ivnywsyp5umgak26bktq.mainnet-1.datasprite-cdn.com",
            "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com",
            "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com",
            "crwj4ebgvb7k4zcwmmxrnzxbs2gaegjyku7rc4eqjkvdnsvrehsa.mainnet-1.datasprite-cdn.com",
            "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com",
            "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com",
            "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com",
            "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com",
            "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com",
            "b6ktecz7yjy6fzgzlivivwfm4xtjvavuqbddceaslq46lxbuw2wq.mainnet-1.datasprite-cdn.com",
            "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com",
            "3zda2p33cro63eoev6gcult7nzm6vegrll7kg6cknocqfq4tavva.mainnet-1.datasprite-cdn.com",
            "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com",
            "tuahnjjbd4ptq2z3dq73mmxdcdpdxt5sjs4uwfluwoxw2i3zrv4q.mainnet-1.datasprite-cdn.com",
            "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com",
            "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com",
            "qyxbba7uefsmigd4oki3zm3hcmilt5fjudhha7n37oeygwrgdcua.mainnet-1.datasprite-cdn.com",
            "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com"
        ],
        "ips": [
            "142.251.40.227",
            "172.67.163.26",
            "104.21.15.158",
            "104.20.31.170",
            "142.251.179.95",
            "172.67.74.152",
            "104.26.15.209",
            "104.17.208.5",
            "172.67.178.73",
            "104.26.10.181",
            "35.227.193.242",
            "104.18.10.59",
            "198.178.224.35",
            "172.66.150.162",
            "172.66.171.45"
        ],
        "asns": [
            "15169",
            "13335",
            "396982",
            "396356"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "x.com",
            "firelight.finance",
            "app.firelight.finance",
            "sentora.com",
            "docs.firelight.finance",
            "framerusercontent.com",
            "medium.com",
            "discord.gg"
        ],
        "social": [
            "https://x.com/Firelightfi",
            "https://medium.com/@Firelight/step-by-step-guide-to-staking-on-firelight-in-phase-1-65678fcc49c5",
            "https://medium.com/@Firelight",
            "https://discord.gg/Q3K6S6N8hy"
        ],
        "doc_hash": "a243d5074049119519757c8cdbb9566a79e7350baa156592fafeae72c7e73791",
        "script_hashes": [
            "b9838c97850bf4f463727cf5458d53d0940b4d93564ac40803b320518c79c38c"
        ],
        "globals": [
            "requestResize",
            "__earlyClickAction",
            "__removeEarlyClick",
            "__cfBeacon",
            "Cap",
            "downloadLogsBlobInBrowser"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "*.allocations-embercurve.xyz",
                "allocations-embercurve.xyz"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "allocations-embercurve.xyz",
            "protocol": "QUIC",
            "valid_to": "2026-12-26T08:46:36Z",
            "valid_from": "2026-09-27T08:46:37Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 130,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 92,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "firelight"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Firelight"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:53Z",
        "uuid": "95172c63-14bd-43d4-bc66-b71229296572",
        "scanned_at": "2026-09-29T01:27:38Z",
        "final_url": "https://allocations-embercurve.xyz/",
        "status": 200,
        "history": [
            {
                "url": "https://allocations-embercurve.xyz/",
                "status": 200
            }
        ],
        "dom_hash": "c8d747fc8564e7eddecddc35868eb478c03e94b04702ae1e7a6a0a38a007d79b",
        "doc_hash": "a243d5074049119519757c8cdbb9566a79e7350baa156592fafeae72c7e73791",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "allocations-embercurve.xyz",
                "type": "A",
                "value": "104.21.63.218"
            },
            {
                "name": "allocations-embercurve.xyz",
                "type": "A",
                "value": "172.67.172.13"
            },
            {
                "name": "allocations-embercurve.xyz",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:3fda"
            },
            {
                "name": "allocations-embercurve.xyz",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:ac0d"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.63.218",
        "whois": {
            "registrar": "Eranet International Limited",
            "created": "2026-09-27T09:16:03Z",
            "updated": "2026-09-27T09:16:04Z",
            "expires": "2027-09-27T23:59:59Z",
            "nameservers": [
                "adele.ns.cloudflare.com",
                "doug.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:44:06Z",
        "analysis_at": "2026-10-14T07:38:15Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 7,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "phishing",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "suspicious"
        },
        "reputation": 0,
        "registrar": "ERANET INTERNATIONAL LIMITED",
        "created": "2026-09-27T17:16:03Z",
        "expires": "2027-09-27T23:59:59Z",
        "updated": "2026-09-27T09:16:04Z",
        "first_seen": "2026-09-27T19:25:58Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "doug.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "adele.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.172.13"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "adele.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.63.218"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:ac0d"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:3fda"
            }
        ],
        "dns_at": "2026-09-29T04:12:33Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.allocations-embercurve.xyz",
                "allocations-embercurve.xyz"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5c5958fd4f107e626e3147881967a1c3823",
            "sha256": "70db63e05a865cc946034feaed2487b2af8d92f898b05edc47f32cf5fa0ce147",
            "subject": "allocations-embercurve.xyz",
            "valid_to": "2026-12-26T08:46:36Z",
            "valid_from": "2026-09-27T08:46:37Z"
        },
        "whois": {
            "registrar": "ERANET INTERNATIONAL LIMITED",
            "registrar_iana_id": "1868",
            "registrar_url": "http://www.eranet.com",
            "created": "2026-09-27T09:16:03Z",
            "updated": "2026-09-27T00:00:00Z",
            "expires": "2027-09-27T00:00:00Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "adele.ns.cloudflare.com",
                "doug.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```