proposal-jumper[.]exchange

The domain proposal-jumper.exchange was registered on February 21, 2026 through NiceNIC International Group Co., Limited. It resolves to the Cloudflare edge address 188.114.97.3, which is announced by AS13335 and geolocated to the United States. The authoritative nameservers are adam.ns.cloudflare.com and danica.ns.cloudflare.com, confirming the use of Cloudflare’s DNS and CDN services. The site presents an SSL certificate issued by Google Trust Services under the WE1 trust chain, indicating a valid TLS handshake despite the underlying malicious purpose.

HTTP requests return a 403 status code, and the page title captured by crawlers is "Un instant…", offering no additional context about the content. Technical fingerprints include Cloudflare and HTTP/3 support. The domain has been flagged by multiple defensive feeds: PhishDestroy, MetaMask, and SEAL have listed it as blocked, and it appears on three public blocklists. VirusTotal analysis shows three out of ninety‑five security vendors flag the domain, reinforcing the suspicion of malicious activity.

The identified scam type is a "Fake Exchange" operation, suggesting the site attempts to impersonate a cryptocurrency or financial exchange to harvest credentials. Current operational status is offline, but the infrastructure remains registered and could be re‑activated. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting on alternative IP ranges, and update endpoint protection signatures to include the observed indicators. Further investigation is needed to capture the exact landing page content and any associated payloads, as the present data set does not reveal the specific phishing flow or victim interaction mechanisms.