portal-ssvnetwork[.]xyz

Analysis of portal-ssvnetwork.xyz indicates an active generic phishing infrastructure observed since its registration on 29 April 2026. The domain is hosted on Cloudflare using the nameservers alexa.ns.cloudflare.com and kayden.ns.cloudflare.com and resolves to IP 188.114.97.3, which is associated with Cloudflare, Inc. in Canada. TLS is provided by Let’s Encrypt (certificate identifier E8) and HTTP requests return a 403 status code, while the page title reported by scanners reads “Just a moment…”, consistent with a Cloudflare challenge page. The domain appears on three public blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filters. VirusTotal scans show five of ninety‑one AV engines flag the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100. The combination of recent creation, low trust rating, blocklist presence, and multiple vendor detections supports a high‑risk rating. No additional payload or landing‑page details are available, so the exact phishing lure remains unknown. Defenders should block the domain at network perimeter, add it to DNS sinkhole lists, monitor for outbound connections to the associated IP, and enforce TLS inspection to capture any malicious content that may be delivered after the initial challenge page.