proxofive[.]cc

This domain, proxofive.cc, operates as a confirmed brand impersonation scam targeting Bitcoin users through deceptive mining-themed pages. The site presents itself as a legitimate Bitcoin mining platform, likely designed to harvest credentials, distribute malware, or trick victims into transferring cryptocurrency to attacker-controlled wallets. Analysis of the page title, 'Bitcoin Mining,' and the domain's infrastructure suggests a focus on exploiting users seeking cryptocurrency-related services, a common tactic in crypto drainer and fake investment schemes.

Technical evidence confirms the malicious nature of proxofive.cc. The domain was registered on September 22, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 195.133.197.201, located in Russia under AS48347 (JSC Mediasoft ekspert), an autonomous system with a history of hosting fraudulent sites. VirusTotal detections show 19 out of 95 security vendors flagging the domain as malicious, while it appears on two security blocklists. The absence of an SSL certificate further indicates a lack of basic security measures, a red flag for phishing or scam operations.

Users who visited proxofive.cc should take immediate action to mitigate potential risks. If credentials or wallet information were entered, affected parties must revoke access to any linked cryptocurrency wallets and monitor for unauthorized transactions. Devices used to access the site should undergo a full malware scan, as the domain may have distributed malicious payloads. Additionally, users should report the domain to their security teams or threat intelligence platforms to aid in broader detection efforts. Given the domain's current offline status, ongoing monitoring for related infrastructure or rebranding attempts is recommended.