Is proposals-firelight.top safe? TrustSniffer's low-trust assessment: 25/100

Overview

The website proposals-firelight.top is a newly established site whose only reachable content is a Cloudflare security interstitial reading "Suspected Phishing", which states the destination "has been reported for potential phishing" and offers an "Ignore & Proceed" button. No products, offers, pricing, branding or payment flow could be observed. The site's purpose and business model therefore cannot be determined from what it presents. The one thing it does present is a third-party warning that it may be used to steal sensitive information.

Scam/Impersonation Risk

The evidence contains confirmed adverse contradictions. Several independent threat-intelligence sources currently flag the domain as malicious, and it is blacklisted by external reputation sources. Cloudflare's own warning that the site was reported for phishing points the same way. The warning is an unverified report, and the destination's content was never visible. It still agrees with the independent blacklist detections, so the signals reinforce one another and are not isolated. No brand impersonation, login or credential form, hidden form, wallet-drainer behaviour or clipboard hijacking was detected, and no conflicting legal identities appear. The risk therefore rests on reputation and provenance, not on observed credential theft. The domain was registered only weeks ago and has no established history to offset the adverse listings. The site's network behaviour was also atypical for a page showing a single static notice. Almost all requests went to external destinations, with a large number of external data requests and repeated browser console errors, and the page changed substantially after interaction. This is consistent with a challenge-protected, rapidly changing deployment. Cloudflare's bot protection was the only classified cause of the cloaking behaviour. Evidence:

• Homepage capture: the only content is a Cloudflare "Suspected Phishing" interstitial with an "Ignore & Proceed" option. The page returned a blocked status (403) behind a bot challenge.
• External reputation: three security engines currently report the domain as malicious, and an external blacklist match is present.
• Domain provenance: registered 2026-09-23 (~25 days old, 0.07 years).
• Sandbox behaviour: about 96% of requests went to external hosts, with 25 external data requests, 9 external POSTs and 20 console errors across three runs. None of the external requests were to non-whitelisted destinations.

Regulatory Verification Notes

The captured page contains no terms, privacy policy, about page, company name, licence or registration number, so no legal or identity disclosure could be assessed. The site claims no licence and no licence was verified. The missing licensing and registration information is a verification gap only. It is not an independent sign of fraud, and the risk conclusion above stands on the blacklist and warning signals. No third-party broker or regulatory-database match links the domain to a regulated entity. Real-world operator identity remains unverified. The valid certificate is a basic domain-validated one, which proves only control of the domain and says nothing about who operates it. Evidence:

• Homepage: no legal-entity name, licence authority or licence number appears anywhere in the captured content.
• Transport encryption: TLS certificate issued by YE2 (DV level), valid to 2026-12-23.
• Hosting network: AS13335 (Cloudflare, Inc., US).

What to Verify Next

Any prospective interaction should begin with an independent check of the reported phishing status through the warning's own explanatory resources and a reputable URL-reputation service. The warning should not be bypassed to inspect the destination. Anyone who received this address through an email, message or advertisement should treat that communication as suspect and contact the claimed organisation through its separately known, official channels. Any claimed licence or registration should be confirmed in the relevant public registry, and a claimed brand should be checked against its official domain. Credentials and payment details should not be supplied until the listings are resolved. Evidence:

• Registration: domain registered via Eranet International Limited, with registrant details redacted.
• Homepage: the interstitial exposes no operator, brand or contact information to check against.
• Sandbox behaviour: the destination's real content was not reachable in any of the three runs.

Summary Verdict

The site carries an elevated risk posture. Convergent reputation evidence, a newly created domain and the absence of any verifiable operator or legitimate content outweigh the technical hygiene signals. Its identity and purpose remain unestablished, and nothing observed supports treating it as a trustworthy destination.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All four observed addresses are edge servers, so the origin host could not be independently identified. Because the origin is masked, hosting cannot be verified directly, and content could be swapped without notice. This protection and the valid certificate are mitigating factors only. They do not offset the external threat detections.

Closing Assessment

The site should not be used for login, credential entry, payments or any financial interaction. The Cloudflare warning should not be bypassed with "Ignore & Proceed". At most, passive read-only exposure from an isolated environment is acceptable, and only if essential. Users who have already interacted should change any reused passwords and report the link to their security team.