portflowltd[.]com

portflowltd.com is currently listed as a high‑risk generic phishing site. The domain was created on 7 April 2025 and remains active as of the 12 July 2026 reporting date. Automated analysis classifies the site under the generic_phishing category, and it appears on one public blocklist maintained by PhishDestroy. Six of ninety‑five VirusTotal scanners have flagged the host, indicating a modest but notable detection rate among security vendors. The domain resolves to the IPv4 address 163.61.188.7, which resolves to a server located in the United States, specifically the MIT network segment. Registration was performed through TuringSign Inc. d/b/a Cosmotown, and the authoritative name servers are dns1.lytehosting.com through dns4.lytehosting.com. The site serves a valid Let’s Encrypt R12 TLS certificate and returns HTTP 200 responses. A review of the page source reveals the presence of Zoho, Bootstrap, LiteSpeed, OWL Carousel, jQuery, Google Tag Manager, Popper, and HTTP/3, indicating a modern web stack that may be leveraged to increase credibility. The visible page title reads “HOME | PORTFLOW SERVICES LTD,” a clear attempt to mimic a legitimate corporate brand. Gridinsoft’s trust scoring system assigns a rating of 26 out of 100, reflecting a low confidence level in the site’s legitimacy. Although only a single blocklist entry is currently recorded, the combination of the phishing classification, the modest vendor detection count, and the low trust score collectively support the high‑risk rating. Defenders should add portflowltd.com and its resolving IP address 163.61.188.7 to network‑level deny lists and monitor DNS queries for the associated name servers. Email gateways ought to enforce URL filtering against known phishing indicators, and any credential‑capture forms observed on the site should be treated as malicious. Continuous re‑evaluation is advised, as changes to the hosting infrastructure or additional vendor detections could alter the threat posture.