propose-unstable[.]org

The domain propose-unstable.org is currently identified as a credential theft operation specifically targeting users through a fraudulent USDC Rewards proposal scheme. Analysis confirms the domain is designed to impersonate legitimate cryptocurrency reward programs, tricking victims into submitting sensitive login credentials or wallet information under the guise of a promotional offer. As of the latest assessment, the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Infrastructure analysis reveals the domain was registered on July 10, 2025, through NameSilo, LLC, a registrar commonly associated with high-risk domains. It resolved to the IPv6 address 2606:4700:3037::ac43:a79f, which has been linked to other transient malicious infrastructure. Detection metrics indicate minimal but targeted flagging, with only 1 of 95 security vendors on VirusTotal identifying the domain as malicious. Additional threat intelligence sources report the domain appeared on a single security blocklist, suggesting limited but deliberate distribution. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk entity. While propose-unstable.org is no longer actively resolving, users who accessed the site should assume potential credential exposure and take immediate remediation steps. Affected individuals are advised to revoke any active sessions linked to cryptocurrency wallets or exchanges, enable multi-factor authentication where available, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include the domain and its associated IP address, while security teams are encouraged to review logs for connections to 2606:4700:3037::ac43:a79f. Given the domain's recent creation and targeted nature, heightened vigilance is recommended for similar reward-themed phishing campaigns impersonating cryptocurrency brands.