allocation-firelight[.]foundation

This domain, allocation-firelight.foundation, is identified as a crypto drainer phishing operation designed to compromise digital asset wallets. The site masquerades as Firelight, a purported protection layer for digital assets, using branding elements and messaging consistent with legitimate cryptocurrency security services. Analysis of the site’s infrastructure and content reveals the deployment of malicious scripts intended to execute unauthorized transactions, draining funds from connected wallets upon user interaction. No legitimate association with Firelight or any recognized digital asset protection service has been established, confirming its fraudulent nature. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 11, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which has been linked to other phishing campaigns targeting cryptocurrency users. As of the latest assessment, the domain appears on three security blocklists, and VirusTotal reports 4 out of 95 security vendors flagging it as malicious. The site employs technologies such as Framer Sites, React, and Cloudflare, which are commonly used in both legitimate and malicious web applications. Google Safe Browsing (GSB) has not yet listed the domain, indicating a potential gap in detection coverage. The domain is currently offline, likely due to takedown efforts or abandonment by the threat actors. However, the risk remains elevated for users who may have interacted with the site prior to its deactivation. Historical DNS records and cached content suggest the campaign was active for a limited period, during which it may have successfully compromised wallets. Users who connected wallets or entered credentials on this domain are advised to immediately transfer assets to a new wallet, revoke any connected dApp permissions, and monitor transaction histories for unauthorized activity. The use of Cloudflare services and the domain’s recent creation date highlight the sophistication of this campaign, underscoring the need for heightened vigilance among digital asset holders.