proposal-xstocks.com: Crypto Drainer Impersonating xStocks Brand

This domain, proposal-xstocks.com, is actively engaged in crypto asset theft through brand impersonation targeting xStocks, a tokenized equities platform. The site presents itself as a legitimate investment portal under the title 'xStocks - Tokenized Equities,' but analysis confirms it functions as a crypto drainer designed to siphon digital assets from victim wallets upon interaction. Current status remains active, with no takedown observed as of the latest verification. Infrastructure analysis reveals the domain was registered on June 16, 2026, through OwnRegistrar, Inc., and resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. Security telemetry indicates the domain appears on four distinct blocklists and is flagged by 3 of 95 VirusTotal vendors. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious infrastructure. Additional defensive measures include blocking by four independent security entities, further corroborating its malicious classification. The domain remains operational and poses a continued risk to users encountering it through phishing vectors such as fraudulent advertisements, social media links, or compromised third-party sites. Users are advised to treat any interaction with proposal-xstocks.com as hostile. Immediate actions include blocking the domain at the network level, revoking any wallet permissions granted to associated smart contracts, and verifying transaction histories for unauthorized asset transfers. Security teams should update detection rules to include the domain, IP, and SSL certificate fingerprint in monitoring systems to prevent further exploitation.