proposa-falconfinances[.]xyz

This domain is flagged as a high-risk phishing infrastructure specifically designed to impersonate Falcon Finance through a fraudulent rewards voting scheme. Analysis indicates the site presents itself as a legitimate customer loyalty program under the title 'Falcon Rewards Vote | Falcon Finance,' targeting users with credential harvesting or financial data theft tactics typical of brand impersonation phishing. Infrastructure analysis reveals the domain proposa-falconfinances.xyz was registered on June 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. The domain resolves to the IP address 188.114.97.3, which has been observed in prior phishing campaigns. VirusTotal detections show 4 out of 95 security vendors currently flag this domain as malicious, while no major blocklists or trust scores indicate widespread remediation at this time. The domain remains active, with no evidence of takedown or suspension. Mitigation against this specific threat requires immediate action from network defenders and end users. Organizations should implement DNS-based blocking for proposa-falconfinances.xyz and its resolving IP 188.114.97.3 at the perimeter. Endpoint protection systems should be updated to detect and prevent access to the domain. Users should be educated to recognize phishing indicators, such as the domain's recent creation date and lack of association with the legitimate Falcon Finance brand. Financial institutions should monitor for credential reuse patterns linked to this campaign and enforce multi-factor authentication for all customer-facing portals.