proposals-punksauction[.]com

This domain is flagged as an active credential harvesting phishing threat with an elevated risk level. Analysis indicates the infrastructure is designed to mimic legitimate auction or proposal platforms, likely targeting users through deceptive login portals or fraudulent transaction pages to steal authentication credentials, financial details, or personal information. The domain exhibits multiple technical indicators consistent with phishing operations, including recent registration, low detection thresholds, and association with known malicious infrastructure. Infrastructure analysis reveals the domain proposals-punksauction.com was registered on October 12, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 216.58.206.78, which may be part of a shared hosting environment commonly exploited for phishing campaigns. The domain appears on one security blocklist and is flagged by 4 out of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The page title, 'Home,' suggests minimal effort to disguise the site, a tactic often used to evade automated detection while remaining functional for targeted attacks. No additional subdomains or SSL certificates were identified in initial scans, but the domain remains operational and unmitigated. Mitigation steps for this threat include immediate blocking of the domain and its resolving IP (216.58.206.78) at the network perimeter. Security teams should prioritize monitoring for connections to this domain in proxy logs, DNS queries, or endpoint detection systems. Users who may have interacted with the site should be instructed to reset credentials for any accounts accessed during the exposure window, particularly if login prompts were encountered. Organizations should also review email filtering rules to prevent delivery of messages containing links to proposals-punksauction.com or similar deceptive domains. Given the domain's recent registration and low detection rate, proactive hunting for related infrastructure or phishing kits is recommended to identify broader campaign activity.