Is proposals-firelight.finance a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The site at proposals-firelight.finance is a single landing page for "Firelight – The Protection Layer for Digital Assets," a DeFi staking and cover protocol. It invites visitors to stake XRP, bridged through Flare FAssets, in return for a liquid staking token and "Firelight Rewards." It also offers on-chain cover against DeFi risks. The stated business model is that fees paid by third-party cover buyers are shared with stakers, and a governance proposal asks visitors to vote on a rewards-distribution date.

Scam/Impersonation Risk

Contradictory signals are present, and they are severe. Several independent threat-intelligence sources currently flag the domain as malicious, and a critical-severity threshold was crossed, so the domain is blacklisted. Three of the leading security vendors are among those flagging it. Infrastructure reputation cannot offset this. The domain was registered only weeks ago, yet the homepage asserts "$2B deployed" and "institutional-grade" readiness. Neither claim is backed by any verifiable history. The domain name combines the project's brand with the word "proposals". Brand impersonation was not positively detected, but the page cannot be confirmed as the project's official deployment. The homepage pushes a wallet-signed governance vote and offers voters a "1,25x boost in claiming power," which is an incentive to sign. The browser also recorded a wallet-signature request. The sandbox observed three outbound POST requests to non-whitelisted external destinations, a very high share of external traffic, and repeated console errors. Those behaviours are consistent with a deposit-before-service model and with wallet-interaction abuse. The staking model itself is high-yield DeFi: users must deposit XRP before any service is received, and no reward rate is stated. Because the deposit cap was "increased to 65 million FXRP," the page implies large pooled deposits with no verifiable controls. The protocol is also not recognised in the major DeFi protocol directory. No conflicting legal identities were found, so there is no identity contradiction in the strict sense. Evidence:

• Homepage and domain: registered 2026-09-16 (about 34 days, ~0.09 years old) through NICENIC INTERNATIONAL GROUP CO., LIMITED, expiring 2027-09-16.
• Web archive: 2 snapshots spanning 2026-09-16 to 2026-09-17 (1 year tracked), so the domain has no meaningful history behind the claims on the homepage.
• Homepage behaviour: 14 console errors, three non-whitelisted external POSTs and 83.7% peak external traffic during three sandbox runs, plus a wallet-signature request.
• Homepage claims: "$2B deployed," "Ultimate Risk Protection" and a raised deposit cap of 65 million FXRP, with no supporting evidence.

Regulatory Verification Notes

The homepage names no legal entity, jurisdiction, license or registration number, and no team members are identified. Its only legal text is a generic disclaimer that the content is informational and not an offer. Cover sales and yield-bearing staking would normally call for such disclosures. Ownership opacity is also present: the registration data does not connect the domain to an identifiable operator. The page cites two audits (OpenZeppelin and Coinspect), an Immunefi bug bounty and an incubator (Sentora). It links to none of them, so none of these assurances can be treated as corroboration. A quote attributed to a Sentora co-founder is likewise unverifiable. No third-party broker or regulator record was matched for this domain. Those absences are verification gaps and are secondary to the confirmed threat detections. Evidence:

• Homepage disclaimer: generic "informational purposes only" language with no operator, license or jurisdiction.
• Security section: audits and bug bounty are named but not linked.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: DV certificate issued by YE1, valid to 2026-12-15, which shows only that the domain is encrypted, not who runs it.

What to Verify Next

The first step is to establish whether this domain is the project's official site. That means reaching the project through channels known independently of this page, such as the project's established social accounts or a trusted aggregator, and checking whether the governance vote and staking interface are published there. The audit claims should be checked on the auditors' own sites and the bug-bounty program on its own platform. The operating legal entity, and whether any regulator oversees the cover or staking activity, should be confirmed through the relevant registries. Because the page asks for a wallet signature, no signing, approval or deposit should be attempted until official provenance is confirmed. Support and contact channels should likewise be confirmed independently. Evidence:

• Governance proposal: voting requires a wallet signature and rewards a 1,25x claiming boost.
• Security section: audit and bug-bounty claims are unlinked.
• Staking section: the page gives no reward rate, no legal entity and no team identities.

Summary Verdict

The assessment is a critical, high-risk posture. Confirmed adverse threat intelligence combines with a brand-new domain, unverifiable assurances and a deposit-first staking model. Sensitive interaction on this site is unsafe.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF on a trusted network, and every observed address is a CDN edge address. The origin server was not observable. This is a mitigating factor only. It shows that the domain is correctly fronted, but it says nothing about the operator's intent, and it does not offset the external threat detections.

Closing Assessment

The page should be viewed at most for passive reading. No wallet should be connected, no transaction or governance message signed, and no XRP or FXRP deposited. Any funds or approvals already linked to this site should be reviewed and revoked.