person-brevportalen[.]com

The domain person-brevportalen.com is assessed as high risk for generic phishing activities, specifically targeting users by impersonating BankID. This impersonation can lead to the theft of sensitive information such as login credentials and personal data, posing a significant threat to individuals and organizations that may interact with it.

Analysis indicates that person-brevportalen.com has been flagged by 15 out of 95 security vendors on VirusTotal, a clear indicator of its malicious nature. The domain was registered through OwnRegistrar, Inc. and resolves to the IP address 193.24.123.124, which is located in Russia (AS200593 PROSPERO OOO). The domain was created on March 12, 2026, and has been taken offline, suggesting a temporary cessation of malicious activities. Google Safe Browsing also identifies this domain as a phishing site, and it appears on one security blocklist. The domain uses an SSL certificate issued by Let's Encrypt (R12), which can lend a false sense of security to unsuspecting users. Additionally, it is blocked by PhishDestroy, further confirming its status as a high-risk phishing domain.

To mitigate the risks associated with this domain, organizations and individuals should ensure that their security systems and browsers are up-to-date with the latest threat intelligence, including blocklists and security vendor assessments. Users should verify the URL and SSL certificate of any site requesting sensitive information to ensure it is legitimate. Security teams should monitor for any attempts to register similar domains and implement DNS filtering to block access to known malicious sites. Conducting regular security awareness training to educate employees on the signs of phishing attacks is also crucial in preventing such threats from compromising security.