portal-nomina[.]xyz

Analysis of portal-nomina.xyz shows a recently registered domain (created 29 April 2026) that is currently offline but was previously flagged as a generic phishing site. The domain is hosted behind Cloudflare’s network (nameservers coleman.ns.cloudflare.com and sarah.ns.cloudflare.com) and resolves to IP 172.67.133.73, which is geolocated to California, United States, and is owned by Cloudflare, Inc. The site presented an SSL certificate issued by Let’s Encrypt and employed HTTP/3, indicating a modern web stack. HTTP probes returned a 404 status, while the page title captured during scanning displayed “portal-nomina.xyz | 504: Gateway time‑out,” suggesting the backend service was unavailable at the time of observation. Threat‑intelligence feeds have placed the domain on three public blocklists, including PhishDestroy, MetaMask, and SEAL, and it is currently blocked by those services.

VirusTotal scans recorded 2 positive detections out of 91 security vendors, providing independent confirmation of malicious intent. Registration was performed through Dynadot LLC, a registrar that does not appear to have taken immediate remediation steps. The combination of a short‑lived registration, Cloudflare‑proxied hosting, active blocklisting, and multiple vendor detections points to a deliberate phishing operation that likely targeted credential collection before the site was taken down.

Uncertainty remains regarding the exact phishing template, target audience, and any associated command‑and‑control infrastructure, as the page content was not captured before the offline state. Defenders should continue to block the domain at the network perimeter, monitor for any resurgence of the same IP or hosting configuration, and update URL‑filtering and endpoint protection signatures to reflect the observed indicators.