proposals-firelight[.]info

PhishDestroy first observed proposals-firelight.info on Aug 18, 2026. Stored content metadata identifies Genericcrypto as the apparent target. The captured page title is “Firelight - The Protection Layer for Digital Assets”. Current evidence score: 91/100 (critical).

Positive findings are stored from 5 sources: VirusTotal, Spamhaus DBL, Cloudflare Radar, URLQuery, and URLScan. VirusTotal recorded 9 detections among 91 engines: alphaMountain.ai, CRDF, ESET, Emsisoft, Fortinet, Gridinsoft, Kaspersky, Netcraft, Webroot on Aug 19, 2026 at 02:09 UTC. Spamhaus DBL: DBL_SPAM on Aug 18, 2026 at 22:30 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLQuery recorded 2 detections; no observation timestamp was retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Firelight and assigned phishing as its category on Aug 18, 2026 at 23:08 UTC. Non-positive and contextual checks: On Aug 19, 2026 at 02:10 UTC, AlienVault OTX listed 4 community pulse references (not vendor detections); Google Safe Browsing returned no flag. The separate external-blocklist snapshot contained no matches on Aug 19, 2026 at 02:20 UTC.

HTTP 200 was recorded on Aug 19, 2026 at 02:37 UTC. Registration records for the domain list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar and Aug 11, 2026 as the creation date. Registration preceded first observation by 7 days. At collection time, the hostname resolved to 196.251.107.176 on AS214351 (FEMO IT SOLUTIONS LIMITED). The recorded endpoint location is Frankfurt am Main, DE. The stored server header is nginx/1.30.4. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Nov 9, 2026; checked Aug 18, 2026 at 22:02 UTC.

The content indicators and 5 positive source findings support the current Genericcrypto impersonation and phishing classification. The target field identifies Genericcrypto, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.