proposal-nado[.]xyz

This domain, proposal-nado.xyz, operates as a crypto drainer phishing site designed to harvest wallet credentials and automatically siphon digital assets from victims. Analysis indicates the infrastructure is engineered to mimic legitimate cryptocurrency platforms, tricking users into connecting wallets or entering seed phrases. Once compromised, funds are drained without authorization, often irreversibly due to blockchain transaction finality. The threat primarily targets users of decentralized finance (DeFi) platforms and wallet services, exploiting trust in seemingly official interfaces. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Security vendors flagged the domain on VirusTotal, with 5 out of 95 engines detecting malicious behavior. It appears on three security blocklists and has been actively blocked by wallet security tools and phishing detection systems. The domain resolved to the IP address 188.114.97.3, which has been linked to other phishing campaigns in recent threat intelligence reports. Users who visited proposal-nado.xyz or interacted with its content should immediately revoke any connected wallet permissions and transfer remaining assets to a new, secure wallet. Monitor transaction histories for unauthorized transfers and report any suspicious activity to the respective blockchain explorer or wallet provider. Reset credentials for any accounts that may have been exposed during the interaction. Given the elevated risk level and confirmed offline status, affected users should assume compromise and take proactive measures to secure their digital assets and personal information.