proposal-firelight[.]com

This domain, proposal-firelight.com, was registered on 24 April 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses Cloudflare’s DNS (meera.ns.cloudflare.com, rocky.ns.cloudflare.com). The authoritative IP address 188.114.96.3 belongs to Cloudflare, Inc. in Canada and serves a TLS certificate from Let’s Encrypt (issuer E7). An HTTP request returns a 403 status and the page title is “Just a moment…”, indicating that the site is currently restricting access. The domain is listed on three public blocklists and appears in a single AlienVault OTX pulse, confirming its association with malicious activity. Reputation scoring is extremely low, with Gridinsoft assigning a 0 / 100 trust score. Threat intelligence feeds such as PhishDestroy, MetaMask and SEAL have already added the domain to their block lists, and one of ninety‑four VirusTotal scanners reported a detection. The current risk rating is high and the domain remains active. Because the underlying content has not been publicly captured, the exact phishing payload and targeted brand remain unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor DNS queries for the IP 188.114.96.3, and consider sinkholing the address to disrupt any ongoing campaigns. Ongoing intelligence collection is recommended to capture the landing page when it becomes reachable.