proposal-apyx[.]xyz

This domain, proposal-apyx.xyz, is flagged as an elevated-risk cryptocurrency credential harvesting operation. Analysis indicates the infrastructure was specifically designed to impersonate legitimate wallet services, targeting users through deceptive interfaces and malicious JavaScript payloads. The domain’s primary threat involves the theft of private keys, seed phrases, and login credentials through fraudulent wallet connection prompts and fake transaction approval workflows. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It is currently blocked by three major security blocklists and flagged by 5 of 95 security vendors on VirusTotal. Additional threat intelligence confirms its presence in two AlienVault OTX pulses, while a Gridinsoft trust score of 0/100 further validates its malicious classification. Detected technologies include jsDelivr for payload delivery, crypto-js for obfuscation, and Cloudflare for content distribution and DDoS protection, alongside HTTP/3 for low-latency exfiltration of stolen credentials. Mitigation requires immediate action from both end-users and security teams. Users who interacted with proposal-apyx.xyz should assume credential compromise and immediately revoke all active wallet sessions, rotate private keys, and monitor transaction histories for unauthorized activity. Security teams should implement DNS-based blocking for the domain and its associated IPs, while also scanning endpoint logs for connections to jsDelivr CDN paths containing crypto-js or other obfuscated JavaScript. Given the domain’s use of Cloudflare, network-level detection should focus on HTTP/3 traffic patterns and anomalous outbound connections to newly registered domains with similar naming conventions. Proactive monitoring of registrar activity from NICENIC INTERNATIONAL GROUP CO., LIMITED may also help identify emerging threats in this campaign.