sso-n-d-xx-portal[.]square[.]site

This domain, sso-n-d-xx-portal.square.site, is identified as a credential phishing infrastructure designed to mimic single sign-on (SSO) portals. Analysis indicates no direct association with a specific brand or drainer kit, though the subdomain structure suggests an attempt to impersonate enterprise authentication workflows. The threat type is classified as generic_phishing, with a focus on harvesting user credentials through fraudulent login interfaces. No active payload delivery or exploit kit signatures were observed in initial scans, but the domain exhibits characteristics consistent with credential theft campaigns. Technical indicators reveal the domain was registered on February 21, 2026, through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. It resolves to the IP address 74.115.51.5, hosted on AS27647 (Weebly, Inc.), a provider frequently abused for phishing operations. At the time of assessment, the domain appears on 1 security blocklist and is flagged by 16 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for threat actors due to its free and automated issuance process. The page title, '404 - Page Not Found,' suggests the phishing content may have been removed or is dynamically served to evade detection. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in propagation rather than a clean status. The domain is currently offline, likely taken down following detection or as part of an evasion tactic. Despite its inactive status, residual risk remains due to the potential for re-activation or migration to a new host. Organizations should block the domain at the DNS and proxy levels, and monitor for any re-appearance under similar subdomain patterns (e.g., sso-[random]-portal.square.site). Users who may have interacted with the domain should be advised to reset credentials for any services accessed during the exposure window. Network logs should be reviewed for connections to 74.115.51.5 or related subdomains to identify compromised accounts.