Is firelight-voting-allocations.web.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This website is a single-page web application titled "Firelight Voting – Phase 2 Voting is live." It runs on a shared web.app subdomain rather than an independently branded domain. Its visitor-facing content is a short campaign-style page, with roughly three thousand characters of text, that presents a voting round and an allocation theme. The apparent purpose is to draw visitors into a time-limited participation event. The page does not clearly state who operates it or what the participation leads to.

Scam/Impersonation Risk

The site shows confirmed contradictory signals. Several independent reputation engines flag the site as malicious, with one more rating it suspicious. This places it on a third-party blacklist, and that alone is decisive for the risk posture. The campaign-style naming ("voting", "allocations", "Phase 2 is live") matches a familiar urgency lure, where visitors are pushed to act in a staged event. The captured content is too thin to confirm which lure, if any, is behind it. No conflicting legal identities, brand impersonation or published phishing page were established, so the concern rests on the blacklist evidence and not on a proven impersonation. A separate set of abuse reports exists against a provider-owned edge address serving the site. Those reports attach to a shared content-delivery address used by many tenants, so they say little about this site specifically and are weighed as a minor corroborating signal only. The behavioral review found no wallet-connection prompts, no wallet-draining routines, no clipboard manipulation, no hidden forms, no credential posts to external hosts and no content cloaking. These are mitigating observations, but they do not offset the external threat detections. The site was captured at a single point in time, and a page can change content after capture. Evidence:

• Homepage: titled "Firelight Voting – Phase 2 Voting is live," a staged-event framing with no identified operator.
• Reputation checks: four engines rate the domain malicious and one suspicious, which constitutes a confirmed blacklist hit.
• Shared edge address 2620:0:890::100: four abuse reports, attributed to shared provider infrastructure and not discounted.
• Behavioral review (three runs): 27 external requests and 10 external posts, none to non-whitelisted hosts. No wallet, clipboard or hidden-form activity was recorded, but 13 console errors were logged.

Regulatory Verification Notes

The site does not make it clear who operates it. Disclosure is unclear, and the homepage shows no legal entity, licence or registration reference. Because the site presents a voting and allocation mechanism, any financial or token-related function would normally warrant a visible operator and regulatory standing. The site is not matched in any third-party broker-reputation dataset, so no broker-level signal is available either way. The missing disclosure is a verification gap and not proof of wrongdoing. Real-world identity connection remains unverified. Transport security is in place, but a domain-validated certificate confirms only control of the hostname, not the identity of the operator. Evidence:

• Homepage: no operator name, legal entity, licence or registration number in the captured content.
• Transport encryption: TLS certificate issued by WR4 (DV), valid to 2026-12-22.
• Hosting: served from AS54113 (FASTLY – Fastly, Inc., US).
• Third-party broker dataset: no match.

What to Verify Next

Before any interaction, confirm independently that a "Firelight" voting or allocation programme exists. Use the official channels of the claimed project, reached through an offline or independently sourced route and not through links on this page. Check that the project publicly announces this exact web address. If any licence or regulatory standing is claimed, confirm it directly with the relevant registry. Also confirm the official support and contact channels through an independent route. Re-test the site later, as its reputation status and content may change. Evidence:

• Homepage: the "Phase 2 voting" claim has no attributable announcement or operator on the page.
• Reputation checks: the blacklist status is current as of this assessment and should be re-checked before any engagement.
• Behavioral review: no external credential posts were observed, but the capture covers only the landing state.

Summary Verdict

The overall posture is high-risk. Confirmed external threat detections decide the assessment, and the unverified operator identity and lack of attributable ownership leave nothing that could offset them. Technically sound transport security and clean on-page behavior in the sandbox do not change this classification. The site should be treated as a hostile or potentially deceptive destination until the detections are cleared.

Infrastructure Integrity

The site is delivered through a recognised content-delivery and edge-security provider, and its observed addresses are all edge nodes. This is a mitigating factor only, as it indicates mainstream delivery and a valid certificate chain. It cannot offset the reputation findings. The origin server was not observable, so hosting cannot be independently verified, and content could be swapped quickly behind the edge without any visible infrastructure change.

Closing Assessment

Use should be limited to passive viewing. Do not log in, connect a wallet, enter credentials, make payments or take any financial action on this site.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2620:0:890::100 (Google LLC, Content Delivery Network), 3% confidence. The reports are attributed to shared infrastructure, not specifically to this website.