# PhishDestroy threat dossier — portalbridge.trade ================================================================ Fetched: 2026-05-19 03:16:58 UTC Canonical: https://phishdestroy.io/domain/portalbridge.trade/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 55/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/92 security vendors flagged this domain URLQuery: 2 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 187.77.66.108 (DE, Frankfurt am Main) ASN: AS47583 Hostinger International Limited Hosting org: Hostinger DE Registrar: Gandi SAS Nameservers: ns-1124.awsdns-12.org, ns-130.awsdns-16.com, ns-1761.awsdns-28.co.uk, ns-554.awsdns-05.net Registered: 2026-05-17 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-17 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-19 00:13:00 UTC (by PhishDestroy tracker) First reported: 2026-05-18 21:13:38 UTC (abuse notice filed) Last verified: 2026-05-19 03:20:13 UTC Neutralised: 2026-05-19 00:40:21 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e3cec-d3c7-72db-8d55-35681b068172/ URLQuery: https://urlquery.net/report/26f69a4b-aa44-4e3d-a4a3-ea62b804b374 Wayback Machine: https://web.archive.org/web/*/portalbridge.trade crt.sh CT logs: https://crt.sh/?q=%25.portalbridge.trade Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=portalbridge.trade AlienVault OTX: https://otx.alienvault.com/indicator/domain/portalbridge.trade URLhaus: https://urlhaus.abuse.ch/host/portalbridge.trade/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-19 00:13:39 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies portalbridge.trade as an active domain engaged in credential theft operations, posing as a legitimate service interface to harvest user login details. The domain leverages a deceptive naming scheme (portalbridge) to mimic trusted financial or transactional platforms, a tactic commonly associated with transparent credential harvesting campaigns. While specific drainer kits or spoofed brands remain unconfirmed at this stage, the domain’s structure and SSL certificate issuance suggest a deliberate attempt to establish trustworthiness through superficial legitimacy. This domain exhibits several technical markers indicative of a newly active threat infrastructure. Registered on May 17, 2026 via Gandi SAS, the domain resolves to IP address 187.77.66.108 and currently shows zero detections across 95 VirusTotal engines. At the time of analysis, no entry was found in Google Safe Browsing (GSB), and available threat intelligence repositories have not yet flagged the domain. The Let's Encrypt SSL certificate further obfuscates its malicious intent by providing a veneer of authenticity, a technique favored in low-sophistication credential theft campaigns targeting unsuspecting users. As of the latest assessment, portalbridge.trade remains active and under active monitoring with a risk status classified as under_investigation. Immediate defensive actions include blocking the domain and IP at the network perimeter, flagging the SSL certificate fingerprint for inspection, and alerting end-users to avoid interaction with the domain. While current detections are minimal, the absence of prior blocking underscores an elevated risk window for potential compromise. Organizations are advised to deploy behavioral monitoring for outbound connections to 187.77.66.108 and to audit any recent login attempts involving domains containing 'portalbridge' or similar bridge-themed keywords. The threat level remains elevated due to the domain’s active status and lack of broad detection coverage, warranting heightened vigilance and proactive blocking. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260518-0A7ECB Favicon MD5: f816e5719bb538ad2b1ae8afced0dc9f ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/portalbridge.trade/ JSON API: https://api.destroy.tools/v1/check?domain=portalbridge.trade Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 151,358 domains (36,773 alive under monitoring, 114,305 confirmed takedowns/dead). Site: https://phishdestroy.io