proposal-ethereal[.]trade

proposal-ethereal.trade was registered on February 23, 2026 through NiceNIC International Group Co., Limited. The domain resolves to the Cloudflare edge address 172.67.162.172, which is associated with ASN 13335 in the United States. No TLS certificate was observed, indicating the site was served without HTTPS. The only visible HTTP response yielded the page title “Just a moment…”, which provides no functional context. VirusTotal reported three positive detections out of ninety‑three scanned engines, and the domain appears on three public blocklists.

It has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, and its current status is offline. The nameservers in use are donald.ns.cloudflare.com and etta.ns.cloudflare.com. Analysis indicates that the domain is being used for a crypto‑related phishing campaign, consistent with the “Crypto Scam” label in the intelligence. The presence of multiple vendor detections, blocklist listings, and targeted blocking by wallet‑related tools such as MetaMask reinforces the malicious intent.

However, because the site is offline and only the page title is known, the exact phishing payload, credential‑capture mechanism, or targeted cryptocurrency service cannot be confirmed. Defenders should continue to monitor the domain for any re‑activation, ensure that outbound traffic to 172.67.162.172 is logged and, where feasible, blocked at the network perimeter. Existing security solutions that reference the known blocklists should already be denying connections, but administrators should verify that the Cloudflare IP is included in any custom deny lists. Incident response teams should also flag any user reports of unexpected wallet prompts or transaction requests that reference this domain, and educate users that the site lacks a valid SSL certificate and displays only a generic title, which are typical indicators of a fraudulent host.