portal-eeseeyield[.]live

The domain portal-eeseeyield.live was registered on March 12, 2026 through NiceNIC International Group Co., Limited and remains active as of the report date. The site presents a minimal page titled “Just a moment…”, returns HTTP 403, and is protected by a Let’s Encrypt certificate (E8) served from Cloudflare edge nodes. Resolution points to IP 104.21.67.161, which belongs to AS13335 Cloudflare, Inc., and the domain’s nameservers are dale.ns.cloudflare.com and love.ns.cloudflare.com. Infrastructure analysis shows the presence of HSTS, Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3, indicating that the attacker is leveraging Cloudflare’s free services to hide origin infrastructure. The Gridinsoft trust score of 0 out of 100 further confirms the malicious nature of the site. VirusTotal reports that 12 of 95 security vendors have flagged the domain, and the domain appears on three independent blocklists. It has also been listed by PhishDestroy, MetaMask, and SEAL as a confirmed staking‑scam vector. The observed behavior aligns with a staking scam, where victims are lured to deposit cryptocurrency under the pretense of earning high returns. The “Just a moment…” page suggests the use of a JavaScript challenge or interstitial that may redirect users to a credential‑harvesting form after the initial check. Because the underlying payload is delivered behind Cloudflare’s protection, direct content inspection is limited without bypassing the challenge. Defenders should block the domain at the DNS and proxy layers, monitor for outbound connections to 104.21.67.161, and add the associated IP range to threat‑intelligence feeds. Continuous observation of new domains registered through the same registrar and with identical nameserver patterns is advisable, as the actor appears to reuse Cloudflare’s infrastructure for rapid deployment. Updating endpoint filters with the current blocklist identifiers will reduce exposure to this high‑risk staking phishing campaign.