doordash-portal[.]com

This domain is currently under investigation for credential harvesting activity targeting DoorDash users. Analysis indicates a targeted phishing campaign designed to mimic the official DoorDash portal, likely intended to capture login credentials and payment information from unsuspecting delivery service customers. Infrastructure analysis reveals the domain was registered on June 19, 2025 through Dynadot LLC and currently resolves to IP address 199.59.243.228. The domain utilizes a Let's Encrypt SSL certificate, presenting a false sense of security to potential victims. Detection metrics show 0/95 detections on VirusTotal, indicating the campaign remains undetected by most security vendors. The domain appears on one security blocklist and has been identified in one AlienVault OTX threat intelligence pulse. Trust assessment scores are notably low, with Gridinsoft assigning a 0/100 trust rating and Scamadviser providing a 1/100 score. Organizations and individuals are advised to implement immediate mitigation measures against this credential harvesting threat. Network administrators should block the domain doordash-portal.com and its resolving IP 199.59.243.228 at firewall and DNS levels. Security teams should monitor for any connections to this infrastructure and investigate potential credential exposure. End users should be educated to verify domain authenticity before entering login credentials, particularly for delivery service platforms. Multi-factor authentication should be enforced for all DoorDash accounts to prevent unauthorized access even if credentials are compromised. Given the recent domain registration, security teams should also monitor for similar domains registered through Dynadot LLC that may emerge as part of this campaign.