portal[.]com-net[.]app

This domain, portal.com-net.app, is flagged as a generic phishing site designed to harvest user credentials through fraudulent login interfaces. Analysis indicates no direct association with known brand impersonation or drainer kits, though its infrastructure aligns with common phishing campaigns. The domain’s design likely mimics legitimate authentication portals to deceive victims into submitting sensitive information, such as usernames, passwords, or multi-factor authentication codes. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain resolves to IP address 195.205.152.187, hosted on AS5617 (Orange Polska Spolka Akcyjna) in Poland. It was registered on February 21, 2026, through Key-Systems LLC, a registrar frequently observed in phishing operations. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for threat actors due to its free and automated issuance process. VirusTotal detection rates show 16 out of 95 security vendors flagging the domain as malicious, while it appears on two independent security blocklists. No Google Safe Browsing (GSB) entries were identified in the current dataset, though this may reflect a lag in propagation rather than absence of risk. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Historical DNS records and cached content could still pose a threat if accessed through local resolvers or archival services. Organizations are advised to block the domain and its associated IP at the network perimeter, monitor for credential reuse attempts, and educate users on recognizing phishing indicators. The elevated risk level is justified by the domain’s technical indicators, detection rates, and prior inclusion on specialized blocklists.