proposaltemplatehub[.]com

proposaltemplatehub.com was registered on May 11, 2026 and is currently hosted behind Cloudflare’s network. The domain resolves to IP address 172.67.218.176, which is geolocated to Canada and is associated with Cloudflare, Inc. The registration and DNS configuration list lily.ns.cloudflare.com and randy.ns.cloudflare.com as authoritative nameservers, indicating that the attacker leveraged Cloudflare’s free registration service to obscure ownership details.

The web server presents a valid SSL certificate issued by Google Trust Services under the WE1 root, and HTTP responses include Strict-Transport-Security and HTTP/3 headers, confirming the use of modern security protocols. Despite the legitimate certificate, the site is listed on three public security blocklists and has been flagged by the PhishDestroy, MetaMask, and SEAL blocklists, providing independent corroboration of malicious intent.

Content analysis shows the page title “Proposal Template Hub”, a name that mimics legitimate services offering document templates. The domain appears in one AlienVault OTX pulse, and three of ninety‑five VirusTotal scanners identified it as suspicious, while the Gridinsoft trust score is 0 out of 100. These signals collectively point to a generic phishing campaign that likely lures victims seeking proposal templates to harvest credentials or deliver malware.

Defenders should block DNS resolution for proposaltemplatehub.com, enforce HTTPS inspection to capture any credential submission, and monitor outbound traffic for connections to the 172.67.218.176 address. Because the infrastructure relies on Cloudflare, any takedown request must be directed to Cloudflare’s abuse reporting channel. Continuous threat‑intel feeds should be updated with the observed indicators to prevent future abuse.