# secureportal-irs-support.pages.dev — MALICIOUS

> secureportal-irs-support.pages.dev is a high-risk phishing domain targeting credentials. Learn about its status and how to stay safe.

## Summary
PhishDestroy identifies secureportal-irs-support.pages.dev as a high-risk credential phishing domain. This site was designed to impersonate IRS support portals to steal sensitive user credentials, posing a significant threat to individuals seeking official tax assistance.

The domain was registered on March 13, 2026, through Cloudflare, Inc. It has been flagged by 18 out of 95 security vendors on VirusTotal and appears on one security blocklist. The domain resolved to IP address 172.66.44.99 and was hosted using Cloudflare's infrastructure. Its page title was reported as "Suspected phishing site | Cloudflare," indicating Cloudflare's intervention to take it offline.

Currently, the domain is offline and inaccessible, reducing immediate risk. Users are advised to avoid clicking on links related to this domain or entering any personal information. Organizations should update their blocklists to include this domain and educate employees and customers about the threat. Continuous monitoring is recommended to detect any potential reactivation or associated phishing campaigns.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-03-13 01:07:02
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.44.99
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: nash.ns.cloudflare.com serenity.ns.cloudflare.com
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 18 vendors flagged
  Vendors: ["ADMINUSLabs", "Criminal IP", "alphaMountain.ai", "BitDefender", "CyRadar", "DNS8", "ESET", "Emsisoft", "Forcepoint ThreatSeeker", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Netcraft", "Phishing Database", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce48f-4308-70aa-abf1-75ac1bdc34f4.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/6e94cb4a-9a60-4862-8e34-657ae7a979d6
- PhishDestroy: https://phishdestroy.io/domain/secureportal-irs-support.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/secureportal-irs-support.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/secureportal-irs-support.pages.dev/
Last updated: 2026-03-19