xportal[.]space

Analysis of the domain xportal.space, created on February 21 2026 and hosted behind Cloudflare (AS13335), shows a high‑risk phishing infrastructure. The domain resolves to IP 172.67.221.248, a Cloudflare edge node located in the United States, and uses the nameservers fred.ns.cloudflare.com and sunny.ns.cloudflare.com, indicating a typical Cloudflare‑proxied deployment. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, which provides a valid HTTPS connection but offers no assurance of legitimacy. HTTP requests receive a 403 response, suggesting that the front‑end is deliberately restricting access, a pattern often observed in malicious landing pages that serve content only to specific user agents or after credential capture. Technology fingerprints reveal a Node.js runtime with the Express framework, coupled with HTTP/3 support, confirming a modern web stack that can evade some legacy detection tools.

Reputation data further reinforces the threat profile. The domain appears on one security blocklist and is listed by PhishDestroy as blocked, while the Gridinsoft trust score of 0 / 100 flags it as entirely untrusted. VirusTotal analysis shows that one of ninety‑three scanned security vendors flagged the domain, providing an independent indicator of malicious behavior. The page title returned by the server is simply "xportal.space/", offering no additional context about the intended target or lure.

While the exact phishing lure (e.g., credential harvesting for a specific service) cannot be confirmed without content inspection, the convergence of a recent registration date, low trust scores, blocklist presence, and the use of a reputable SSL issuer to mask malicious intent points to a deliberate phishing campaign. Defenders should block the domain at network perimeter devices, add the IP address 172.67.221.248 to deny‑lists, and update endpoint protection signatures to incorporate the observed indicators.