proposals-firelight[.]com

PhishDestroy identifies proposals-firelight.com as an active crypto drainer phishing domain designed to steal user credentials and digital assets. This domain was flagged under seed 32d888 and remains unclassified by major blocklists despite suspicious characteristics. The site poses a high risk to cryptocurrency users, particularly those engaging with fake proposal platforms.

This domain exhibits multiple indicators of compromise tied to phishing operations. It was registered on April 27, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently abused in low-effort spam and phishing campaigns. The domain resolves to IP 104.21.68.4, which shares infrastructure with known malicious endpoints. Despite zero detections on VirusTotal (4/95 engines), it maintains a valid Let's Encrypt SSL certificate, increasing its credibility among potential victims. The absence of entries on major threat intelligence feeds suggests either a very recent deployment or deliberate obfuscation.

Mitigation requires immediate user caution. Users encountering this domain should avoid all interactions, including clicking or entering credentials. Block the IP 104.21.68.4 and domain proposals-firelight.com at the network perimeter. Report the site to PhishDestroy using seed 32d888 for collective threat intelligence sharing. For suspected victims, revoke compromised wallet permissions and scan for malware. Always verify domains through independent sources—especially those related to cryptocurrency services—and prioritize hardware wallet usage during transactions.