# PhishDestroy domain threat record: allocations-standardreserve.xyz Content language: English Canonical HTML report: https://phishdestroy.io/domain/allocations-standardreserve.xyz/ Machine-readable companion: https://phishdestroy.io/domain/allocations-standardreserve.xyz/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-29 03:06:52 UTC - Last availability or vendor check: 2026-10-21 22:32:44 UTC - Stored record updated: 2026-10-22 14:20:43 UTC - VirusTotal detections in the stored snapshot: 3/91 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: firelight ## Stored infrastructure - Observed IP address: 172.67.130.245 - Registrar in stored WHOIS data: Eranet International Limited - Registrar country in stored WHOIS data: US - Registration date (registry RDAP, allocations-standardreserve.xyz): 2026-09-27 20:19:19 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0eb2a-60f4-719c-b977-997f4c2ab138/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/allocations-standardreserve.xyz - Certificate Transparency search: https://crt.sh/?q=%25.allocations-standardreserve.xyz - Web Archive lookup: https://web.archive.org/web/*/https://allocations-standardreserve.xyz/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview allocations-standardreserve.xyz was an impersonation phishing page dressed up as Firelight. It carried the title "Firelight – The Protection Layer for Digital Assets" and targeted crypto holders who might trust a security-branded service with their wallets. PhishDestroy first flagged it on 2026-09-29, two days after the domain was registered. The site has been offline since 2026-09-30 and was still unreachable when checked on 2026-10-19. How the scam works The page borrows Firelight's name and its promise of protecting digital assets, and the word "allocations" in the domain fits the common lure of a claim or reward page. Phishing sites of this kind usually push the visitor to connect a wallet and approve a transaction, or to type in a recovery phrase to "verify" eligibility. Signing that request or handing over the phrase gives the operators control over the funds, and those transfers cannot be reversed. A security brand works well as bait because users expect it to ask for wallet access. Evidence urlscan.io rated the page malicious and recognised the Firelight branding on it. On VirusTotal, only 3 of 91 engines flagged the domain as of 2026-09-29: alphaMountain.ai, CRDF and Forcepoint ThreatSeeker. That low count is typical for a domain caught within days of going live, before most vendors have seen it. The wallet-focused blocklists are the stronger signal: MetaMask and SEAL both list the domain alongside PhishDestroy. Infrastructure The whole lifecycle was compressed. The domain was registered on 2026-09-27 through Eranet International Limited, detected on 2026-09-29 and dark by 2026-09-30, the pattern of a disposable domain meant to harvest quickly before blocklists catch up. Traffic was routed through Cloudflare, Inc. with an address geolocated to Canada. That points to Cloudflare's network rather than to where the operators or their origin server actually sit. What to do If you connected a wallet to this page, review and revoke any token approvals or permissions it requested, and move remaining assets to a fresh wallet if you signed anything you did not understand. If you entered a seed or recovery phrase, treat that wallet as compromised and transfer funds to a newly generated wallet immediately. Reach Firelight only through its official channels, and do not trust "allocation" or claim links that arrive by message or ad. Defenders should block the domain, keep MetaMask and SEAL feeds enabled, and watch for lookalike domains that pair Firelight branding with reward or allocation wording. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0eb2a-60f4-719c-b977-997f4c2ab138/ VirusTotal report: https://www.virustotal.com/gui/domain/allocations-standardreserve.xyz Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=allocations-standardreserve.xyz Archived copy: https://web.archive.org/web/20260929030814/https://allocations-standardreserve.xyz/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:15:20 UTC ## Stored page captures - Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png Captured: 2026-09-29 03:17:50 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0eb2a-60f4-719c-b977-997f4c2ab138.png Captured: 2026-09-29 03:17:50 UTC Source report: https://urlscan.io/result/01a0eb2a-60f4-719c-b977-997f4c2ab138/ - URLScan capture 2: https://urlscan.io/screenshots/01a0e6cf-abdf-71ef-be72-134d07e1c52a.png Captured: 2026-09-29 03:06:52 UTC Source report: https://urlscan.io/result/01a0eb2a-60f4-719c-b977-997f4c2ab138/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/692e6fc9-05a9-4ec7-bdb0-dde59109ecfc.png Captured: 2026-09-29 03:09:06 UTC Source report: https://radar.cloudflare.com/scan/692e6fc9-05a9-4ec7-bdb0-dde59109ecfc SHA-256: 28d91a39f100e18fdb02f53b3bd908269da0a0550f97d0a69e1feb157613a0e9 - URLQuery: https://screenshots.phishdestroy.io/uq/de9430e1-6487-4a48-b05e-e3e8503fa745.png Source report: https://urlquery.net/report/de9430e1-6487-4a48-b05e-e3e8503fa745 SHA-256: cd2fe7bc84413ff26efe20199c88ea55453fe83fb502f1d2fb1a2e5de36b1d58 - URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e6c8-1c38-7548-8465-f624f236ce16.png Captured: 2026-09-28 06:51:15 UTC Source report: https://urlscan.io/result/01a0e6c8-1c38-7548-8465-f624f236ce16/ SHA-256: 132ca024c8c3606bc25be896ca8387652dc5162361c062c6e0f56fde72438986 - URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e6c8-197d-7701-9051-27d0619547a3.png Captured: 2026-09-28 06:51:17 UTC Source report: https://urlscan.io/result/01a0e6c8-197d-7701-9051-27d0619547a3/ SHA-256: 132ca024c8c3606bc25be896ca8387652dc5162361c062c6e0f56fde72438986 - URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e6cf-abdf-71ef-be72-134d07e1c52a.png Captured: 2026-09-28 06:59:31 UTC Source report: https://urlscan.io/result/01a0e6cf-abdf-71ef-be72-134d07e1c52a/ SHA-256: 132ca024c8c3606bc25be896ca8387652dc5162361c062c6e0f56fde72438986 - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb23-7c4b-77d4-bb9f-fab0021cdc9d.png Captured: 2026-09-29 03:09:49 UTC Source report: https://urlscan.io/result/01a0eb23-7c4b-77d4-bb9f-fab0021cdc9d/ SHA-256: 7623fc98dad50cad5ef2e6087fe83a3486b2870caa6f4909699209c9a0640c74 - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb26-35c9-77bb-9b78-8d556e33072e.png Captured: 2026-09-29 03:12:32 UTC Source report: https://urlscan.io/result/01a0eb26-35c9-77bb-9b78-8d556e33072e/ SHA-256: 5d7ea931dc249ae4d6df2c7cd2312ee042f925746f32fb5a634a1b673afbd735 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T20:55:10Z", "uuid": "01a0eb2a-60f4-719c-b977-997f4c2ab138", "scanned_at": "2026-09-29T03:17:16Z", "final_url": "https://allocations-standardreserve.xyz/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://allocations-standardreserve.xyz/", "from": "http://allocations-standardreserve.xyz/", "status": 307 } ], "ip": "172.67.130.245", "domains": [ "gateway.irys.xyz", "esm.sh", "arbitrum.meowrpc.com", "arbitrum.gateway.tenderly.co", "arbitrum.drpc.org", "rpc.ankr.com", "arbitrum-one.publicnode.com", "arb1.arbitrum.io", "static.cloudflareinsights.com", "fonts.gstatic.com", "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com", "hxjnnbfgmzureusmhjgltavcqubaut2yzqx23rrlalgrwm4nynga.mainnet-1.datasprite-cdn.com", "7hle7g76hwhzkcgcytuleelhk7lwp5k2ivnywsyp5umgak26bktq.mainnet-1.datasprite-cdn.com", "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com", "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com", "crwj4ebgvb7k4zcwmmxrnzxbs2gaegjyku7rc4eqjkvdnsvrehsa.mainnet-1.datasprite-cdn.com", "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com", "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com", "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com", "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com", "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com", "b6ktecz7yjy6fzgzlivivwfm4xtjvavuqbddceaslq46lxbuw2wq.mainnet-1.datasprite-cdn.com", "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com", "3zda2p33cro63eoev6gcult7nzm6vegrll7kg6cknocqfq4tavva.mainnet-1.datasprite-cdn.com", "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com", "tuahnjjbd4ptq2z3dq73mmxdcdpdxt5sjs4uwfluwoxw2i3zrv4q.mainnet-1.datasprite-cdn.com", "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com", "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com", "qyxbba7uefsmigd4oki3zm3hcmilt5fjudhha7n37oeygwrgdcua.mainnet-1.datasprite-cdn.com", "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com" ], "ips": [ "209.85.232.94", "104.21.15.158", "172.67.163.26", "172.66.167.42", "173.194.204.95", "172.67.74.152", "104.26.15.209", "151.101.1.229", "172.67.178.73", "172.67.70.45", "35.227.193.242", "104.18.11.59", "198.178.224.35", "172.66.150.162", "172.66.171.45" ], "asns": [ "15169", "13335", "54113", "396982", "396356" ], "countries": [ "US" ], "link_domains": [ "x.com", "firelight.finance", "app.firelight.finance", "sentora.com", "docs.firelight.finance", "framerusercontent.com", "medium.com", "discord.gg" ], "social": [ "https://x.com/Firelightfi", "https://medium.com/@Firelight/step-by-step-guide-to-staking-on-firelight-in-phase-1-65678fcc49c5", "https://medium.com/@Firelight", "https://discord.gg/Q3K6S6N8hy" ], "doc_hash": "4154eb29e09b8250c345bb4945b463e783df1568a458187cc96336a28e311e0d", "script_hashes": [ "b9838c97850bf4f463727cf5458d53d0940b4d93564ac40803b320518c79c38c" ], "globals": [ "requestResize", "__earlyClickAction", "__removeEarlyClick", "__cfBeacon", "Cap", "downloadLogsBlobInBrowser" ], "cookies": [ "PHPSESSID" ], "tls": { "san": [ "*.allocations-standardreserve.xyz", "allocations-standardreserve.xyz" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "allocations-standardreserve.xyz", "protocol": "QUIC", "valid_to": "2026-12-26T19:44:14Z", "valid_from": "2026-09-27T19:44:15Z" }, "domain_age_days": 1, "apex_age_days": 1, "tls_age_days": 1, "tls_valid_days": 89, "requests": 163, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 93, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "firelight" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Firelight" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T21:03:47Z", "uuid": "692e6fc9-05a9-4ec7-bdb0-dde59109ecfc", "scanned_at": "2026-09-29T03:09:06Z", "final_url": "https://allocations-standardreserve.xyz/", "status": 200, "history": [ { "url": "https://allocations-standardreserve.xyz/", "status": 200 } ], "dom_hash": "c8d747fc8564e7eddecddc35868eb478c03e94b04702ae1e7a6a0a38a007d79b", "doc_hash": "4154eb29e09b8250c345bb4945b463e783df1568a458187cc96336a28e311e0d", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "Newly Seen Domains", "Security Risks", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "allocations-standardreserve.xyz", "type": "A", "value": "104.21.3.168" }, { "name": "allocations-standardreserve.xyz", "type": "A", "value": "172.67.130.245" }, { "name": "allocations-standardreserve.xyz", "type": "AAAA", "value": "2606:4700:3033::ac43:82f5" }, { "name": "allocations-standardreserve.xyz", "type": "AAAA", "value": "2606:4700:3035::6815:3a8" } ], "dnssec_valid": false, "ip": "104.21.3.168", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Eranet International Limited", "created": "2026-09-27T20:19:19Z", "updated": "2026-09-27T20:19:20Z", "expires": "2027-09-27T23:59:59Z", "nameservers": [ "blakely.ns.cloudflare.com", "braden.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T16:44:01Z", "analysis_at": "2026-10-14T07:30:50Z", "stats": { "timeout": 0, "harmless": 47, "malicious": 10, "suspicious": 1, "undetected": 34 }, "detections": { "CRDF": "malicious", "ESET": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "suspicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "ERANET INTERNATIONAL LIMITED", "created": "2026-09-28T04:19:19Z", "expires": "2027-09-27T23:59:59Z", "updated": "2026-09-28T00:00:00Z", "first_seen": "2026-09-27T20:59:52Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "blakely.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:3a8" }, { "ttl": 300, "type": "A", "value": "172.67.130.245" }, { "ttl": 21600, "type": "NS", "value": "blakely.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:82f5" }, { "ttl": 21600, "type": "NS", "value": "braden.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.3.168" } ], "dns_at": "2026-09-28T09:16:53Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.allocations-standardreserve.xyz", "allocations-standardreserve.xyz" ], "issuer": "Let's Encrypt / YE1", "serial": "6664233f489e2a48c112ebbc51ecacf1a65", "sha256": "06ba67174e6d2ec96957608843ae28f0eb7c1d24254d3e3ebaf198258aaad21e", "subject": "allocations-standardreserve.xyz", "valid_to": "2026-12-26T19:44:14Z", "valid_from": "2026-09-27T19:44:15Z" }, "whois": { "registrar": "ERANET INTERNATIONAL LIMITED", "registrar_iana_id": "1868", "registrar_url": "http://www.eranet.com", "created": "2026-09-27T20:19:19Z", "updated": "2026-09-27T20:19:20Z", "expires": "2027-09-27T00:00:00Z", "status": [ "addPeriod", "clientTransferProhibited", "serverTransferProhibited" ], "nameservers": [ "blakely.ns.cloudflare.com", "braden.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```