proposal-chainlink[.]xyz

This domain, proposal-chainlink.xyz, is flagged as a high-risk generic phishing domain currently active as of July 13, 2026. Created on April 14, 2026, through Dynadot LLC, it resolves to IP address 172.67.213.34 located in Canada and hosted by Cloudflare, Inc. The domain uses Cloudflare nameservers (alexa.ns.cloudflare.com and randall.ns.cloudflare.com) and an SSL certificate issued by Let's Encrypt (E8). The page title found is 'Just a moment...', and the HTTP status returned is 403, which may indicate a gateway or blocking page rather than a functional phishing site. VirusTotal reports 3 of 94 security vendors flagging this domain as malicious, and it appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX shows it in 1 threat intelligence pulse. The Gridinsoft trust score is 0 out of 100. Infrastructure analysis indicates the domain is designed to impersonate Chainlink, given the domain name 'proposal-chainlink.xyz', though the exact content of the site has not been analyzed. Defenders should treat this domain as actively malicious, block access at the DNS or proxy level, and monitor for any further infrastructure linked to this campaign. Uncertainty remains about the specific phishing kit or landing page content, as the 403 status may obscure the actual payload. Verification of related subdomains or additional IP resolutions is recommended.