portal-coins[.]pages[.]dev

Analysis of portal-coins.pages.dev indicates that the domain was registered on 21 February 2026 through Cloudflare, Inc. and is currently taken offline. The authoritative nameservers anderson.ns.cloudflare.com and elaine.ns.cloudflare.com resolve the domain to IP 172.66.44.92, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1) and responded with HTTP status 403, while the page title returned by the server is “Suspected phishing site | Cloudflare”.

Automated scanning on VirusTotal recorded six positive detections out of ninety‑three security vendors, confirming that the domain is associated with credential phishing activity. The domain appears on three independent blocklists—PhishDestroy, ScamSniffer and Enkrypt—and received a Gridinsoft trust score of zero out of one hundred, indicating a high confidence of malicious intent. Detected technologies include HTTP/3, HSTS and Cloudflare’s edge services, which are typical of phishing infrastructure that leverages CDN protection to obscure origin.

While the available data confirms the presence of credential‑phishing indicators, the specific payload, targeted brands and exact phishing page content have not been disclosed. Defenders should continue to block the IP address 172.66.44.92 and the associated domain, update URL filtering rules to include the three listed blocklists, and monitor for any re‑registration attempts under the same second‑level domain. Ongoing observation of Cloudflare‑registered domains is recommended, as the provider’s rapid provisioning can facilitate short‑lived phishing campaigns.