stellar-proposal[.]xyz

This domain operates as a fraudulent crypto airdrop or wallet drainer scheme, targeting users with deceptive offers of free cryptocurrency. The site mimics legitimate token distribution events, tricking victims into connecting their wallets to malicious smart contracts that siphon funds. Analysis of the domain structure and historical phishing patterns suggests it is part of a larger campaign impersonating blockchain projects or decentralized finance platforms. The threat primarily affects users engaging with unsolicited crypto promotions or social media links. Infrastructure analysis reveals the domain was registered on May 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 188.114.97.3, hosted on Cloudflare's network (AS13335), a common obfuscation tactic to evade IP-based blocking. The domain is flagged by 4 out of 95 security vendors on VirusTotal and appears on 3 independent blocklists. Notably, the site lacks an SSL certificate, an unusual omission for legitimate crypto platforms, further indicating malicious intent. Users who visited stellar-proposal.xyz should immediately disconnect any connected wallets and revoke permissions for suspicious smart contracts via their wallet interface. Monitor all linked accounts for unauthorized transactions and consider transferring assets to a new wallet if interaction occurred. Report the domain to relevant security teams and avoid engaging with similar unsolicited crypto offers. Organizations should update blocklists to include this domain and its resolving IP to prevent further exposure.