proposal-pepe[.]com

The domain proposal-pepe.com was registered on May 09, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is presently active. It is classified as a high‑risk Google brand impersonation campaign, targeting users who expect legitimate Google services. Infrastructure analysis shows the domain resolves to IP address 104.21.7.5, which belongs to Cloudflare, Inc. and is geolocated to Canada. The authoritative name servers are eoin.ns.cloudflare.com and vera.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS and CDN platform. A Let’s Encrypt certificate (E8) secures the site, and HTTP requests receive a 403 response, suggesting that the front‑end may be restricting direct access while serving malicious content through other vectors. The domain appears on three public security blocklists and has been flagged by three of ninety‑five antivirus engines on VirusTotal. It is also referenced in a single AlienVault OTX pulse and is blocked by three independent filtering services. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. While the available intelligence confirms the domain’s use for Google brand impersonation, the exact delivery mechanism—such as credential‑stealing forms, malicious redirects, or payload distribution—remains unverified. No samples of the malicious pages or associated URLs have been disclosed, and the limited number of detection counts suggests the campaign may be in an early deployment phase or employing targeted distribution. Defenders should add proposal-pepe.com to DNS and URL filtering policies, monitor for outbound connections to the IP 104.21.7.5, and incorporate the domain into threat‑intel feeds. Continuous observation of the associated blocklists and any future VirusTotal detections will help gauge the campaign’s evolution and support rapid remediation.