authentication[.]partneragencyportal[.]com

This domain is flagged for hosting a fake login portal designed to harvest credentials under the guise of an "Accounts Centre" interface. Analysis indicates the threat type is a generic phishing scheme, classified with an elevated risk level due to its deceptive infrastructure and offline status following detection. The domain was operational long enough to pose a credible risk to unsuspecting users before being taken offline. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3, hosted by CloudFlare, Inc. in Canada, and was registered through Gransy, s.r.o. on April 18, 2026. Security vendors on VirusTotal flagged the domain with 24 out of 95 detections, indicating moderate consensus on its malicious nature. The domain appears on at least one security blocklist and was proactively blocked by a threat mitigation system. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, does not mitigate the domain's fraudulent intent. The page title, "Accounts Centre," mimics authentication portals to deceive users into entering sensitive credentials. Mitigation steps for this specific threat type include immediate revocation of any credentials entered on this domain, as they are now compromised. Organizations should implement domain-based email filtering to block messages containing links to authentication.partneragencyportal.com or similar subdomains. Users are advised to verify the legitimacy of login portals by checking for subtle inconsistencies in domain names, SSL certificates, and page design. Network-level blocking of the IP 188.114.96.3 can prevent further access to this infrastructure. Additionally, monitoring for newly registered domains under the same registrar (Gransy, s.r.o.) may help identify related phishing campaigns, particularly those impersonating authentication portals.