proposals-unipeg[.]app

The domain proposals-unipeg.app was registered on May 02 2026 through PDR Ltd. operating as PublicDomainRegistry.com. It resolves to the Cloudflare‑owned address 188.114.96.3, which is hosted in Canada. The authoritative nameservers keaton.ns.cloudflare.com and oaklyn.ns.cloudflare.com indicate that the domain is protected by Cloudflare’s DNS and CDN services. An active Let’s Encrypt certificate (issuer E8) secures HTTPS connections, and the web server currently returns HTTP 403 responses.

Threat‑intelligence feeds have flagged the domain. It appears on three public security blocklists and is listed in a single AlienVault OTX pulse. Independent scoring systems assign a zero‑point trust rating (Gridinsoft 0/100). The domain is also blocked by multiple anti‑phishing filters, including PhishDestroy, MetaMask, and SEAL. These indicators collectively point to a high‑confidence phishing operation despite the absence of malware detections on VirusTotal.

Analysis is constrained by the lack of visible content, as the HTTP 403 status prevents direct inspection of the landing page. No detections have been reported on VirusTotal (0/95 scans), and no payload signatures have been observed, leaving the exact phishing lure undefined. However, the classification as a generic phishing threat, combined with the aggressive blocklist presence and the low trust score, suggests the domain is being used to harvest credentials or to redirect victims to malicious sites.

Defenders should treat proposals‑unipeg.app as a high‑risk indicator. Immediate actions include adding the domain to network and email blocking rules, monitoring DNS queries for the associated IP address, and enforcing TLS inspection to capture any attempted HTTPS traffic. Continuous re‑evaluation is advised, as future payloads or changes in the site’s response could raise the threat level further.