proposal-aevo[.]xyz

This domain, proposal-aevo.xyz, is actively flagged as a phishing threat as of July 19, 2026. Infrastructure analysis reveals it resolves to IP 172.67.143.113, hosted on Cloudflare infrastructure in Canada, with nameservers matiias.ns.cloudflare.com and amy.ns.cloudflare.com. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and holds a valid SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to end users. It currently returns an HTTP 200 status, indicating an operational web presence. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is referenced in one AlienVault OTX threat intelligence pulse. Four of 91 security vendors on VirusTotal flag the domain as malicious, though the specific nature of the threat—such as the targeted brand or phishing kit—remains unconfirmed due to limited public analysis. No concrete evidence links the domain to a specific scam type (e.g., credential harvesting, crypto drainer, or brand impersonation) at this time. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS, proxy, or endpoint level. Given its Cloudflare hosting, traditional IP-based blocking may inadvertently affect unrelated legitimate sites, so domain-based controls are recommended. Security teams should monitor for internal traffic to proposal-aevo.xyz and investigate any connections, particularly from systems with access to sensitive credentials or financial data. If additional context emerges—such as a confirmed phishing kit or targeted brand—further tailored mitigations may be warranted.