35liq[.]proxette[.]cc

This domain 35liq.proxette.cc has been assessed as a credential harvesting infrastructure associated with generic phishing campaigns. Analysis indicates it likely hosted a fake authentication portal designed to capture user login credentials or session tokens. The absence of SSL encryption and the use of a dynamically structured subdomain pattern suggest automated deployment typical of phishing kits. Although currently offline, the infrastructure is consistent with short-lived phishing pages used for rapid credential exfiltration before takedown.

Evidence shows the domain was created on February 21, 2026 and registered through NiceNIC International Group Co., Limited. It resolves to IP 217.60.252.208 located in FR (AS56971 Cloud). It has no SSL certificate. The domain appears on 1 security blocklist. VirusTotal reports 20/95 security vendors flagging it as malicious.

If visited, users should assume any entered credentials are compromised. Immediate password reset across reused credentials is recommended, along with enabling multi-factor authentication and reviewing account activity for unauthorized access. Session tokens and active logins should be revoked where possible. Users should also clear browser sessions and cached authentication data. In enterprise contexts, defenders should block the domain, analyze DNS and proxy logs for connections to 217.60.252.208, and correlate authentication attempts with potential credential submission events. Endpoint telemetry should be reviewed for form submission artifacts or suspicious redirects linked to this infrastructure.