proposal-xyber[.]xyz

This domain, proposal-xyber.xyz, was registered on 23 February 2026 through Dynadot LLC and points to the Cloudflare‑owned address 104.21.88.66 (AS13335, United States). The site is currently offline and returns HTTP 404, with the browser displaying a “504: Gateway time‑out” title. The hosting infrastructure uses Cloudflare’s DNS (sima.ns.cloudflare.com, tate.ns.cloudflare.com) and HTTP/3, indicating reliance on the provider’s edge network. The TLS certificate is issued by Let’s Encrypt (E8), confirming the use of a free, automated certificate.

Threat intelligence feeds have listed the domain on four security blocklists and it is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal analysis shows that two of ninety‑three scanners flagged the domain, reinforcing the suspicion of malicious intent. No additional content or landing‑page details have been captured, so the exact phishing lure remains undefined.

Defenders should continue to deny resolution to this host, monitor for any re‑activation, and add the domain to local deny‑list and DNS filtering policies. Network sensors should flag any outbound connections to 104.21.88.66 originating from internal assets, and incident response teams should treat any user‑reported traffic to proposal-xyber.xyz as potentially hostile. Ongoing observation of the associated IP and related Cloudflare zones is recommended to detect possible re‑use of the infrastructure for future campaigns.