Is firelight-voting.web.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

Firelight Voting is a single-page website on a shared web.app subdomain. Its page is titled "Firelight Voting - Phase 2 Voting is live", and it presents itself as the entry point to a second round of a community voting campaign. The captured homepage is a short text page, and the available evidence does not show what a visitor is asked to do or what the site gains from it. Its apparent purpose is to attract participants to a time-sensitive voting event.

Scam/Impersonation Risk

This site carries confirmed contradictory signals. Several independent threat-intelligence engines currently rate the domain as malicious, and one more rates it as suspicious. These detections amount to a confirmed blacklisting, and a known-phishing indicator also fired. Together they trigger the impersonation guard and drive the cautionary assessment. The "Phase 2 voting is live" framing is also a common lure pattern in campaign-themed credential and wallet-phishing pages. The urgency and the generic community-vote pretext give a visitor no way to confirm who is running the vote. Four abuse reports exist against one of the site's edge addresses. These apply to infrastructure shared with many other tenants and carry low confidence, so they are not treated as site-specific proof. They do not offset the direct detections. Dynamic testing found no wallet-connection prompts, clipboard tampering, hidden forms, credential posts to outside destinations, or content cloaking. That reduces the likelihood of an active drainer. It does not neutralize a confirmed blacklist, because a page can be switched to a malicious payload quickly. No conflicting legal identities were found. Evidence:

• Homepage: four security engines flag the domain as malicious and one as suspicious, with a known-phishing indicator also recorded.
• Homepage behavior test: 27 outbound data requests and 10 outbound posts, none to non-whitelisted destinations. No wallet-connect, clipboard-write, or hidden-form activity across three successful runs.
• Homepage behavior test: 15 browser console errors, which points to an unpolished or hastily built page.
• The site's shared edge address: 4 abuse reports with low confidence, attributed to shared provider infrastructure.

Regulatory Verification Notes

The evidence contains no licensing, registration, or regulator reference for this site, and no business or operator disclosure. This is a verification gap only. Combined with the threat detections above, it leaves no independent basis for connecting the page to a real organization. A search of third-party broker-reputation records returned no match, so there is no reputational context in either direction. The page's TLS certificate is valid and issued by a recognised authority. It is a domain-validated certificate, which proves control of the domain and says nothing about the identity or intent of its operator. Evidence:

• Homepage: a short page (about 3,200 characters of text) with no visible licensing number, company name, or registration detail in the captured content.
• Transport encryption: TLS certificate issued by WR4 (DV), valid to 2026-12-22, with about 61 days remaining.
• Hosting: served from AS54113 (Fastly, Inc., US).
• Third-party broker records: no match.

What to Verify Next

Any contact with this page should first be checked against the official channel of the project it claims to represent. That means finding the vote announcement on a source reached independently, such as the project's own verified social accounts or documentation, and not through this page or links that lead to it. If the project does not confirm a Phase 2 vote at this address, the page should be treated as unauthorized. Confirm the official contact and support channels through an offline or independent route. If the page is linked from a message or advertisement, that sender should be validated as well. Evidence:

• Homepage: the "Phase 2 voting is live" announcement carries no verifiable reference to a sponsoring organization.
• Threat intelligence: current malicious ratings mean any link to this address should be treated as unverified until the project confirms it.
• Shared hosting namespace: the web.app subdomain gives no indication of who controls the project.

Summary Verdict

The deterministic assessment places this site in an elevated-risk, clearly cautionary posture. Confirmed threat detections outweigh its technically sound transport security and clean-looking behavioral profile. The real-world identity of the operator remains unestablished, and the available evidence gives no basis for treating the site as trustworthy.

Infrastructure Integrity

The site is delivered through Fastly's content delivery network. All observed addresses are edge servers, and the origin host could not be observed. This protective layer is a mitigating factor only. It does not offset the reputation risk. Edge-only visibility also prevents independent verification of the hosting and can mask rapid content swaps behind a stable-looking front end.

Closing Assessment

Do not log in, connect a wallet, sign any message or transaction, or enter credentials or payment details on this site. Read-only viewing is the most that is advisable. Participation in the vote should happen only through an official channel the project itself confirms.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2620:0:890::100 (Google LLC, Content Delivery Network), 3% confidence. The reports are attributed to shared infrastructure, not specifically to this website.