# PhishDestroy domain threat record: allocations-standardreserve.lol Content language: English Canonical HTML report: https://phishdestroy.io/domain/allocations-standardreserve.lol/ Machine-readable companion: https://phishdestroy.io/domain/allocations-standardreserve.lol/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-29 04:38:30 UTC - Last availability or vendor check: 2026-10-21 01:17:28 UTC - Stored record updated: 2026-10-22 14:20:43 UTC - VirusTotal detections in the stored snapshot: 1/91 - Independent public blocklist matches in the stored snapshot: 3 - Matching public blocklists: MetaMask, ScamSniffer, SEAL - Google Safe Browsing stored result: flagged ## Stored classification - Targeted brand: firelight ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Eranet International Limited - Registrar country in stored WHOIS data: Unknown - Registration date (registry RDAP, allocations-standardreserve.lol): 2026-09-27 20:19:49 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0eb96-d379-7608-b0ec-3edcab3b793f/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/allocations-standardreserve.lol - Certificate Transparency search: https://crt.sh/?q=%25.allocations-standardreserve.lol - Web Archive lookup: https://web.archive.org/web/*/https://allocations-standardreserve.lol/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview allocations-standardreserve.lol is an impersonation phishing page that copied Firelight, using the title "Firelight – The Protection Layer for Digital Assets". Its domain name points to an allocation lure, aimed at crypto users who expect to claim tokens or rewards tied to the brand. PhishDestroy first saw it on 2026-09-29. The site went offline on 2026-09-30, and as of 2026-10-19 its DNS no longer resolves. How the scam works The page uses Firelight's name and tagline so visitors believe they are on the official project. Fake "allocation" pages like this usually tell the visitor they have an unclaimed allocation and must connect a wallet, sign a transaction or enter a recovery phrase to receive it. That step hands the attacker the wallet's assets or its keys. Someone who trusts a security-branded product is less likely to question the request, so the claimed protection role makes the lure more convincing. Evidence Google Safe Browsing flags the domain as SOCIAL_ENGINEERING. urlscan.io rates it malicious and recognised Firelight branding on the page. Wallet-focused blocklists also cover it: MetaMask, ScamSniffer and SEAL, along with PhishDestroy. VirusTotal coverage was thin, with only CRDF flagging it out of 91 engines on 2026-09-29, so most antivirus scanners would not have warned a visitor. Three AlienVault OTX pulses reference it. Infrastructure The domain was registered through Eranet International Limited on 2026-09-27. PhishDestroy detected it two days later, and it went dark the day after that. This short, disposable lifespan on a cheap .lol domain is typical of campaigns that rotate domains. The site was served through Cloudflare, Inc., which hides the real origin server, and the hosting address is located in Canada. What to do If you connected a wallet or signed anything on this page, revoke all token approvals and permits you granted there. Move any remaining funds to a new wallet. If you typed in your recovery phrase, treat that wallet as fully compromised and stop using it. Only claim Firelight allocations through links on the project's verified official channels. Defenders should block the domain and look for other recently registered domains that use Firelight branding or "allocation" wording. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0eb96-d379-7608-b0ec-3edcab3b793f/ VirusTotal report: https://www.virustotal.com/gui/domain/allocations-standardreserve.lol Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=allocations-standardreserve.lol Archived copy: https://web.archive.org/web/20260929044112/https://allocations-standardreserve.lol/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:15:17 UTC ## Stored page captures - Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png Captured: 2026-09-29 05:16:25 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0eb96-d379-7608-b0ec-3edcab3b793f.png Captured: 2026-09-29 05:16:25 UTC Source report: https://urlscan.io/result/01a0eb96-d379-7608-b0ec-3edcab3b793f/ - URLScan capture 2: https://urlscan.io/screenshots/01a0e835-b9eb-7268-9fc8-8aa459e1903d.png Captured: 2026-09-29 04:38:30 UTC Source report: https://urlscan.io/result/01a0eb96-d379-7608-b0ec-3edcab3b793f/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b3ab6c18-5cdb-40bd-a296-a0297d5193e3.png Captured: 2026-09-29 04:43:10 UTC Source report: https://radar.cloudflare.com/scan/b3ab6c18-5cdb-40bd-a296-a0297d5193e3 SHA-256: 004192fc17296708b93b8e92b0622081085b0cde433953be3750a9cd70c01226 - URLQuery: https://screenshots.phishdestroy.io/uq/b9f9c487-9470-4cf8-b5ed-6464a73ffc9e.png Source report: https://urlquery.net/report/b9f9c487-9470-4cf8-b5ed-6464a73ffc9e SHA-256: e13c54a4a5d191badd21ac4b41ea4e7c4c1b794485ecb835b872a9d9bf4d7765 - URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e835-b5cf-777d-aa34-aac8b815492d.png Captured: 2026-09-28 13:30:36 UTC Source report: https://urlscan.io/result/01a0e835-b5cf-777d-aa34-aac8b815492d/ SHA-256: b47ebe07bf8542babc15e40a2a41a38e299f06f2e7ac99a031be55036fdb523e - URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e835-b9eb-7268-9fc8-8aa459e1903d.png Captured: 2026-09-28 13:30:45 UTC Source report: https://urlscan.io/result/01a0e835-b9eb-7268-9fc8-8aa459e1903d/ SHA-256: 132ca024c8c3606bc25be896ca8387652dc5162361c062c6e0f56fde72438986 - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb7d-00b6-7745-b0bd-2f0804e7c4c8.png Captured: 2026-09-29 04:47:20 UTC Source report: https://urlscan.io/result/01a0eb7d-00b6-7745-b0bd-2f0804e7c4c8/ SHA-256: 8e89a7d48a3afdd9732357ecd506f3f1b9861884d87c40a9bafc03ced244ab68 - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb84-f43b-7213-a1f1-1199d664af14.png Captured: 2026-09-29 04:56:02 UTC Source report: https://urlscan.io/result/01a0eb84-f43b-7213-a1f1-1199d664af14/ SHA-256: 62f2d0fd1bb8aefe97d8b609b6dd653f8d86d43b59ffa9b34b5ce8136ac26095 - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb89-aba4-70e8-a6e4-21b2d9b8b6b4.png Captured: 2026-09-29 05:01:10 UTC Source report: https://urlscan.io/result/01a0eb89-aba4-70e8-a6e4-21b2d9b8b6b4/ SHA-256: 8e89a7d48a3afdd9732357ecd506f3f1b9861884d87c40a9bafc03ced244ab68 - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb8c-e6fc-707f-82c7-98d46c469ec7.png Captured: 2026-09-29 05:04:57 UTC Source report: https://urlscan.io/result/01a0eb8c-e6fc-707f-82c7-98d46c469ec7/ SHA-256: 0d5d2bf0909558d065083d3b9e84d13ef16530c3048175452ee5f7ff25a407ff ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T20:54:46Z", "uuid": "01a0eb96-d379-7608-b0ec-3edcab3b793f", "scanned_at": "2026-09-29T05:15:34Z", "final_url": "https://allocations-standardreserve.lol/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://allocations-standardreserve.lol/", "from": "http://allocations-standardreserve.lol/", "status": 307 } ], "ip": "188.114.97.3", "domains": [ "gateway.irys.xyz", "esm.sh", "arbitrum.meowrpc.com", "arbitrum.gateway.tenderly.co", "arbitrum.drpc.org", "rpc.ankr.com", "arbitrum-one.publicnode.com", "arb1.arbitrum.io", "fonts.gstatic.com", "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com", "hxjnnbfgmzureusmhjgltavcqubaut2yzqx23rrlalgrwm4nynga.mainnet-1.datasprite-cdn.com", "7hle7g76hwhzkcgcytuleelhk7lwp5k2ivnywsyp5umgak26bktq.mainnet-1.datasprite-cdn.com", "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com", "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com", "crwj4ebgvb7k4zcwmmxrnzxbs2gaegjyku7rc4eqjkvdnsvrehsa.mainnet-1.datasprite-cdn.com", "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com", "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com", "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com", "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com", "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com", "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com", "3zda2p33cro63eoev6gcult7nzm6vegrll7kg6cknocqfq4tavva.mainnet-1.datasprite-cdn.com", "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com", "tuahnjjbd4ptq2z3dq73mmxdcdpdxt5sjs4uwfluwoxw2i3zrv4q.mainnet-1.datasprite-cdn.com", "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com", "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com", "qyxbba7uefsmigd4oki3zm3hcmilt5fjudhha7n37oeygwrgdcua.mainnet-1.datasprite-cdn.com", "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com", "ch75ckxualkloc7t5fsfem56e5odt55sl7lel66ksibigpvzxsda.mainnet-1.datasprite-cdn.com", "fynfue6gizxdkcyib7qzqxl6yplic3utnguuvmr3vhltij4lrsha.mainnet-1.datasprite-cdn.com" ], "ips": [ "142.251.127.94", "104.21.15.158", "172.67.163.26", "172.66.167.42", "142.251.110.95", "172.67.74.152", "172.67.70.222", "104.17.207.5", "104.21.17.203", "104.26.10.181", "35.227.193.242", "104.18.10.59", "198.178.224.35", "172.66.150.162", "172.66.171.45" ], "asns": [ "15169", "13335", "396982", "396356" ], "countries": [ "US" ], "link_domains": [ "x.com", "firelight.finance", "app.firelight.finance", "sentora.com", "docs.firelight.finance", "framerusercontent.com", "medium.com", "discord.gg" ], "social": [ "https://x.com/Firelightfi", "https://medium.com/@Firelight/step-by-step-guide-to-staking-on-firelight-in-phase-1-65678fcc49c5", "https://medium.com/@Firelight", "https://discord.gg/Q3K6S6N8hy" ], "doc_hash": "c372dbf0a9fe8d0b235835bf712f8bee7e4ea8d94212d00255532420c9d5cc17", "script_hashes": [ "b9838c97850bf4f463727cf5458d53d0940b4d93564ac40803b320518c79c38c" ], "globals": [ "requestResize", "__earlyClickAction", "__removeEarlyClick", "Cap", "downloadLogsBlobInBrowser" ], "cookies": [ "PHPSESSID" ], "tls": { "san": [ "*.allocations-standardreserve.lol", "allocations-standardreserve.lol" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "allocations-standardreserve.lol", "protocol": "QUIC", "valid_to": "2026-12-26T19:24:47Z", "valid_from": "2026-09-27T19:24:48Z" }, "domain_age_days": 1, "apex_age_days": 1, "tls_age_days": 1, "tls_valid_days": 89, "requests": 139, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "firelight" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Firelight" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T21:03:35Z", "uuid": "b3ab6c18-5cdb-40bd-a296-a0297d5193e3", "scanned_at": "2026-09-29T04:43:10Z", "final_url": "https://allocations-standardreserve.lol/", "status": 200, "history": [ { "url": "https://allocations-standardreserve.lol/", "status": 200 } ], "dom_hash": "c8d747fc8564e7eddecddc35868eb478c03e94b04702ae1e7a6a0a38a007d79b", "doc_hash": "a354ade9b6847b5a52201fa12fa7d0ba3f9a6ce056aeb7afea6fe4736c9a4fc0", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "allocations-standardreserve.lol", "type": "A", "value": "188.114.97.0" }, { "name": "allocations-standardreserve.lol", "type": "A", "value": "188.114.96.0" }, { "name": "allocations-standardreserve.lol", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "allocations-standardreserve.lol", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "188.114.97.0", "whois": { "registrar": "Eranet International Limited", "created": "2026-09-27T20:19:49Z", "updated": "2026-09-27T20:19:50Z", "expires": "2027-09-27T23:59:59Z", "nameservers": [ "iris.ns.cloudflare.com", "nero.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T16:43:34Z", "analysis_at": "2026-10-14T07:33:02Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 14, "suspicious": 1, "undetected": 34 }, "detections": { "CRDF": "malicious", "ESET": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "Eranet International Limited", "created": "2026-09-27T20:19:49Z", "expires": "2027-09-27T23:59:59Z", "updated": "2026-09-27T20:19:50Z", "first_seen": "2026-09-28T12:50:04Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "iris.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "iris.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.183.138" }, { "ttl": 300, "type": "A", "value": "104.21.67.249" }, { "ttl": 21600, "type": "NS", "value": "nero.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:b78a" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::6815:43f9" } ], "dns_at": "2026-09-29T05:37:15Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.allocations-standardreserve.lol", "allocations-standardreserve.lol" ], "issuer": "Let's Encrypt / YE2", "serial": "6a5f7f649a0158d7c9fc762c4b5c31b7b57", "sha256": "c14c34026886c2c53f3a40b39e7425c316f81ed5c963bf67d0c0c84205590879", "subject": "allocations-standardreserve.lol", "valid_to": "2026-12-26T19:24:47Z", "valid_from": "2026-09-27T19:24:48Z" }, "whois": { "registrar": "Eranet International Limited", "registrar_iana_id": "1868", "registrar_url": "http://www.eranet.com", "created": "2026-09-27T20:19:49Z", "updated": "2026-09-27T20:19:50Z", "expires": "2027-09-27T23:59:59Z", "status": [ "addPeriod", "clientTransferProhibited", "serverTransferProhibited" ], "nameservers": [ "iris.ns.cloudflare.com", "nero.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```