proposals-yieldfi[.]net

The domain proposals-yieldfi.net was registered on October 13, 2025 through NiceNIC International Group Co., Limited and is currently taken offline. Infrastructure analysis shows that the domain resolves to IP address 216.58.212.142, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain uses Cloudflare nameservers pola.ns.cloudflare.com and ridge.ns.cloudflare.com, but no SSL certificate is presented, indicating an unencrypted HTTP service at the time of observation. The page title returned from the site is a single character "s", providing no additional context about the content hosted.

Threat intelligence classifies the site as a brand impersonation campaign targeting Google, and the scam type is identified as an investment scam. Detection data from VirusTotal indicates that four of ninety‑five security vendors flagged the domain as malicious, and it appears on one external blocklist. The domain has been blocked by the PhishDestroy service, and the Gridinsoft trust score is 0 out of 100, reflecting a high confidence in malicious intent. While the site is offline, the combination of a Google‑owned IP address, lack of TLS, low trust score, and multiple vendor detections suggest that the domain was used to lure victims under the guise of a Google‑related investment offering.

Defenders should continue to monitor the domain for any re‑activation, ensure that network filtering solutions block the associated IP and hostnames, and update any URL or domain blocklists with the observed indicators. Additional scrutiny of traffic to the Cloudflare nameservers and the registrar NiceNIC may reveal related infrastructure used in future campaigns. Given the elevated risk rating, organizations handling Google credentials should educate users about the possibility of brand‑impersonation attempts that use legitimate cloud provider IP ranges to increase credibility.