proposals-trondoa[.]org

Analysis shows that proposals-trondoa.org was registered on April 28, 2026 and resolves to the Cloudflare‑owned address 172.67.148.180. The domain is served over HTTPS using a Let’s Encrypt certificate (issuer E7) and is delegated to the Cloudflare nameservers kipp.ns.cloudflare.com and nena.ns.cloudflare.com. An HTTP 301 response redirects requests to a page titled “Index of /”, indicating that the site presently hosts a directory listing rather than a typical login portal. The domain’s infrastructure is fully hosted behind Cloudflare, which masks the origin server and complicates direct attribution.

Threat intelligence flags the domain with a Gridinsoft trust score of 0 out of 100, placing it at the lowest possible confidence level for legitimacy. It appears on three independent security blocklists and has been referenced in one AlienVault OTX pulse, suggesting that the indicator has already been shared among the security community. VirusTotal reports that 2 out of 95 scanned security vendors have marked the domain as malicious, reinforcing the high‑risk classification. The overall risk level is listed as high, and the domain’s status remains active, confirming ongoing exposure.

Defenders should immediately block proposals‑trondoa.org at the network perimeter and on endpoint protection solutions. Continuous monitoring of DNS queries for this domain is advised, as any resolution attempts may indicate compromised hosts or ongoing phishing campaigns. Because the domain is cloaked behind Cloudflare, additional scrutiny of traffic patterns to the associated IP address may reveal attempts to bypass typical URL filtering. Updating intrusion detection signatures with the observed IP, SSL fingerprint, and the 301 redirect behavior will improve detection accuracy. Organizations should also consider sharing any internal observations with wider threat‑intel platforms to enrich collective awareness of this active phishing infrastructure.