portal-x[.]site

Analysis of portal-x.site shows a newly registered domain created on 23 February 2026 that currently resolves to the IPv4 address 178.208.83.13 hosted in the Netherlands under AS216139 (Iron Hosting Centre LTD). The domain is configured with four name servers (ns1.mchost.ru through ns4.mchost.ru) and does not present an SSL/TLS certificate, indicating that any web traffic would be unencrypted. The only visible page attribute is the HTTP response title “PORTAL X Landing Page”, which suggests a generic landing page used for credential harvesting. The domain appears on three independent security blocklists, specifically PhishDestroy, MetaMask, and SEAL, and has been flagged by one of ninety‑three VirusTotal scanners, reinforcing the suspicion of malicious intent.

Registration was performed through Hostinger Operations UAB, a known hosting provider, and the domain has already been taken offline at the time of this analysis. No additional technical artefacts such as malware hashes, payload URLs, or observed phishing kits have been released publicly, leaving the exact phishing campaign details uncertain. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any residual activity targeting the resolved IP address, and consider adding the associated name servers to deny‑list rules.

Because the site lacks TLS, any attempted connections would be visible in network logs, providing an opportunity to detect and alert on suspicious HTTP requests. Organizations that employ web‑proxy or secure web‑gateway controls should ensure that traffic to this host is denied or inspected. Ongoing intelligence gathering should focus on obtaining the full page content, any posted forms, and potential victim reports to refine attribution and assess the scale of the campaign.