portal-seguro[.]app

portal-seguro.app is currently active and serves HTTP 200 responses. The domain is registered through Sav.com, LLC and uses the nameservers ns1.all-harmless.domains and ns2.all-harmless.domains, which are commonly associated with rapidly provisioned hosting. It appears on a single public blocklist and is explicitly blocked by the PhishDestroy service.

Google Safe Browsing classifies the site as social engineering, and VirusTotal reports that 17 of 91 scanned security vendors flag the domain as malicious. The threat is categorized as generic phishing with a high risk rating. No additional intelligence such as the target brand, page title, SSL certificate details, or hosting IP address has been disclosed, leaving the exact phishing payload and victim profile uncertain.

Defenders should treat the domain as hostile: add it to network and email deny lists, enforce DNS filtering, and monitor for any related command‑and‑control traffic. Continuous re‑evaluation is advised, as the lack of visible page content means the attacker could later deploy credential‑harvesting forms or malicious redirects. Organizations using web‑filtering solutions should ensure the domain is included in real‑time blocklists, and incident response teams should be prepared to investigate any user reports that reference portal‑seguro.app.