portal-start-web-us[.]square[.]site

This domain, portal-start-web-us.square.site, is flagged as a high-risk credential phishing infrastructure targeting users through impersonation of legitimate payment or authentication portals. Analysis indicates no direct association with a known drainer kit, but the domain exhibits characteristics consistent with credential harvesting and session token theft. The infrastructure appears designed to mimic trusted platforms, likely to deceive users into submitting sensitive login or financial details. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 74.115.51.4, hosted on AS27647 (Weebly, Inc.) in the United States. It was registered on February 05, 2019, through MarkMonitor Inc., a registrar commonly used for both legitimate and malicious domains. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. Google Safe Browsing (GSB) status is not explicitly provided, but the domain remains actively blocked by multiple threat intelligence feeds. As of the latest assessment, portal-start-web-us.square.site remains active and unresolved, posing a continuing risk to users. The domain has not been sinkholed or seized, and no public remediation efforts have been observed. Organizations and individuals are advised to implement network-level blocking for the domain and its resolving IP, alongside monitoring for related subdomains or redirects. Given the domain's longevity and persistent blocklist presence, heightened vigilance is recommended for any communications or links referencing this infrastructure.