chatportalseguro2025[.]shop

On July 23 2026 the domain chatportalseguro2025.shop was observed offline but retains several indicators of compromise consistent with a generic phishing campaign. The site previously returned the HTTP page title “Coming Soon” and was hosted behind Cloudflare’s network (IP 172.67.132.164, AS13335, United States). No SSL certificate was presented, indicating the site operated without HTTPS. Registration details show the domain was provisioned through Cloudflare, Inc. and uses the Cloudflare authoritative nameservers lilith.ns.cloudflare.com and noah.ns.cloudflare.com.

Threat intelligence sources have flagged the domain: PhishDestroy listed it as blocked, and it appears on one external security blocklist. AlienVault OTX includes the domain in sixteen separate pulses, suggesting repeated observation across different feeds. VirusTotal analysis recorded fifteen positive detections out of ninety‑five scanned security vendors, reinforcing the malicious assessment. The Scamadviser trust score of 1 out of 100 further reflects a low reputation.

While the exact phishing payload, target brand, or victim interaction flow has not been publicly disclosed, the convergence of blocklist entries, multiple vendor detections, and low trust metrics provides sufficient evidence to classify the domain as malicious. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual traffic to the IP address 172.67.132.164, and update detection signatures to include the observed nameserver and IP attributes. Ongoing observation of Cloudflare‑hosted infrastructure is recommended, as the provider’s shared IP space may host additional malicious actors. Because the site is currently offline, real‑time verification of the hosted content is not possible; however, the existing indicators warrant continued mitigation until the domain is fully retired or re‑registered by a legitimate entity.