rfp-proposal[.]ceo

The domain rfp-proposal.ceo was registered on 2026-03-05 via Porkbun LLC and currently resolves to the IPv4 address 104.225.130.131. The address is allocated to AS395092 Shock Hosting LLC, a U.S.-based hosting provider. DNS resolution is handled by the nameservers curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, and maceio.ns.porkbun.com.

Web service inspection shows the site is running Nginx with the OpenResty module and returns HTTP status code 200. The only visible content is a page titled “One moment, please…”. The TLS handshake presents a certificate issued to loominost4.com, which does not match the rfp-proposal.ceo hostname, a common indicator of phishing infrastructure. Gridinsoft’s trust score for the site is 0 out of 100, and three of ninety‑five VirusTotal scanners have flagged the domain as malicious. The domain is listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

Based on the observed characteristics—mismatched certificate, low trust score, presence on multiple blocklists, and detection by several security vendors—the infrastructure aligns with a high‑risk generic phishing operation. The site’s content is limited to a placeholder page, suggesting that the malicious payload may be delivered through redirect or subsequent script execution not captured in the initial request. No phishing landing page content has been observed, leaving the exact credential‑ harvesting technique uncertain.

Defenders should add rfp-proposal.ceo to network‑level deny lists and ensure that DNS resolvers block the domain. Monitoring of outbound connections to the associated IP address 104.225.130.131 is advisable, as is the capture of any HTTP redirects that may follow the initial placeholder response. Threat‑intel teams should continue to track the domain’s presence on blocklists and watch for any changes in the TLS certificate or server response that could indicate activation of a full phishing page.