nodesportal-8vx[.]pages[.]dev

PhishDestroy identifies nodesportal-8vx.pages.dev as an active credential harvesting domain posing as a legitimate service portal. This threat involves tricking users into submitting login credentials or personal information under false pretenses, enabling account takeovers and identity theft. The domain was flagged with a risk level of under_investigation and remains unblocked by major threat intelligence platforms as of seed c86b72.

This domain was registered through Cloudflare, Inc. and resolves to IP address 172.66.44.166. The SSL certificate is issued by Google Trust Services, which may lend false legitimacy to the site. As of seed c86b72, VirusTotal reports 0 detections out of 95 scanners, indicating no immediate blocklist coverage. The domain is hosted on Cloudflare Pages, a legitimate service that has been abused by threat actors to deploy phishing infrastructure quickly and evade takedowns.

To mitigate this threat, users should avoid interacting with nodesportal-8vx.pages.dev entirely and report the domain to PhishDestroy or their organization’s security team. Organizations should block the domain at the network level and inspect DNS logs for traffic to 172.66.44.166. Since Cloudflare-hosted phishing pages are difficult to takedown, users should rely on real-time threat intelligence feeds and browser-based phishing detection tools to identify and block such pages before credential submission occurs.