iportalcontactus[.]com

This domain, iportalcontactus.com, is identified as a high-risk phishing resource specializing in brand impersonation targeting Google. Analysis indicates the site was designed to mimic legitimate Google authentication portals, likely to harvest user credentials or deploy malicious payloads under the guise of official Google services. No specific drainer kit signatures were conclusively linked to this domain during the investigation, though the infrastructure aligns with credential-harvesting campaigns observed in similar cases.

Infrastructure analysis reveals the domain was registered on May 19, 2026, through OwnRegistrar, Inc., and resolved to the IP address 31.7.61.48, geolocated within Switzerland under Ripe Network Coordination Centre allocation. At the time of assessment, 24 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly classified it as phishing. The domain appeared on one additional security blocklist, and its SSL certificate was issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its accessibility.

The domain has since been taken offline, reducing immediate exposure risk to end users. However, the infrastructure components—including the registrar and IP range—remain active and may be repurposed for future campaigns. Organizations are advised to monitor related indicators, such as the resolving IP and registrar patterns, and update detection rules to account for similar impersonation tactics. Users should verify domain authenticity before entering credentials, particularly when redirected to login portals claiming affiliation with major brands.