Fake Firelight 'vote rewards' pages promise 1.25x claiming power to lure wallet connections
MalwareTips warns that fake Firelight 'vote rewards' pages on lookalike domains promise 1.25x claiming power for voting on a distribution date, to lure crypto wallet connections; the real project is at firelight.finance.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
In a warning published 17 October 2026, MalwareTips describes a Firelight vote rewards scam that presents a supposed community vote on when rewards should be distributed and promises participants 1.25x their usual claiming power. It names the reported lookalike domains vote-firelightfoundations[.]xyz and proposal-firelightfoundation[.]com and says they use the real Firelight project's name to make an unverified rewards process look established. Firelight's genuine website is firelight.finance; MalwareTips stresses the warning concerns the counterfeit pages, not the legitimate project, and is not a recommendation to invest in it. Its lead image is an illustration on a fictional address, not a capture of the campaign.
How the scam works
People who follow Firelight may expect updates about rewards, so a vote on a distribution date seems ordinary. The task is easy to understand (help choose a date, receive a better allocation) and a reasonable-sounding task makes the next request feel reasonable too. If the page offers its own "verification" link, the visitor never leaves the untrusted source; a repost or a direct message from a friend, who may be sharing a bad link sincerely or whose account may be compromised, is also no substitute for an official announcement.
The 1.25x boost is specific enough to imagine without sounding implausible, but it doesn't say who qualifies, which assets are involved or what proposal authorises it. Even if the arithmetic is right, increasing an allocation from 100 units to 125 says nothing about whether those units will ever be distributed.
The key instruction is to "Register & Begin Voting", which opens a wallet selector with recognisable providers. Those providers are not endorsing the site. MalwareTips explains that sharing a public address can reveal holdings without moving them, some approvals let another party spend particular tokens, and signing requests can have different effects depending on their contents and the network. Recovery secrets must never be given to a voting page or its supposed support staff.
Source
MalwareTips, "Firelight Vote Rewards Scam: Fake 1.25x Bonus And Wallet Approval Warning" (published 17 October 2026).
Red flags
- A community 'vote' or proposal that promises a bonus (such as 1.25x claiming power) for taking part.
- Domains that add words like 'vote', 'proposal' or 'foundation(s)' to a project's name.
- A 'register and vote' button that opens a wallet-connection window.
- Verification links supplied by the same page, or any request for recovery secrets.
If you were targeted
- 1Don't connect your wallet, sign, or approve anything on the page.
- 2Never type a recovery (seed) phrase or private key into a website or give it to 'support'.
- 3Check announcements only through the project's official website or accounts that you open yourself.
- 4If you connected and approved something, revoke the token approval with your wallet's or the network's approval tool and move remaining assets to a new wallet if you're unsure what you signed.
- 5If you disclosed a recovery phrase, treat the wallet as compromised and move assets to a new wallet created with a new phrase.
- 6Report the site to your wallet provider and, in the U.S., to the FBI's IC3 at ic3.gov.