proposal-xstock[.]org

The domain proposal-xstock.org has been identified as a confirmed fake investment portal phishing site. Analysis indicates this domain was designed to impersonate legitimate financial or stock trading platforms, likely targeting users with fraudulent investment opportunities or credential harvesting schemes. As of the latest assessment, the domain is currently offline, though prior activity suggests it was actively serving malicious content. Infrastructure analysis reveals the domain was registered on October 09, 2025, through NameSilo, LLC. It resolves to the IP address 104.21.57.144, which may be part of a content delivery network or proxy service used to obfuscate its true hosting origin. The domain appears on one security blocklist and is flagged by 2 of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The page title captured during analysis was 'Just a moment...', a common indicator of intermediary or cloaking pages used to evade automated detection systems. Current status confirms the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated. Organizations and security teams are advised to block the domain and its associated IP address (104.21.57.144) at the network perimeter. Endpoint protection solutions should be updated to include this domain in phishing and malicious site detection rules. Users who may have interacted with the site should be instructed to monitor financial accounts for unauthorized activity and reset credentials for any platforms where the same login details were reused. Continuous monitoring of newly registered domains with similar naming patterns (e.g., 'proposal-', '-xstock') is recommended to detect potential follow-up campaigns.