stupidportal[.]pages[.]dev

PhishDestroy identifies Stupidportal.pages.dev as an active credential-phishing domain designed to harvest login details under the guise of a ‘stupidportal’ entry point. The page mimics a harmless portal but silently exfiltrates usernames and passwords to attacker-controlled servers. Security telemetry shows the domain resolving to 172.66.44.70 with a valid Google Trust Services certificate, indicating the attacker has provisioned a seemingly legitimate TLS certificate to lower user suspicion. At the time of assessment, VirusTotal returned 0 detections out of 95 scanners, illustrating how newly registered phishing domains can evade detection long enough to ensnare victims.

This domain was flagged via seed 99e357 after Cloudflare, Inc. registered it. The combination of Cloudflare’s rapid provisioning, a freshly minted Google Trust Services SSL certificate, and zero VirusTotal coverage creates a potent lure for unsuspecting users. Although blocklist intelligence is still under active investigation, the absence of detections suggests the site has only recently become operational and has not yet propagated across threat-intel feeds. The risk level remains under investigation precisely because its low footprint allows the campaign to fly under the radar.

If you visited Stupidportal.pages.dev—or entered any credentials—immediately change those passwords on a clean device, enable multi-factor authentication wherever possible, and scan your system with an offline antivirus tool. Report the domain to your browser’s safe-browsing program and consider revoking any browser-stored credentials associated with the site. Monitor financial accounts for unusual transactions and remain vigilant for follow-on phishing attempts leveraging harvested data.