portal0xverification[.]us-iad-10[.]linodeobjects[.]com

Analysis of portal0xverification.us-iad-10.linodeobjects.com indicates a brand‑impersonation campaign targeting Amazon. The domain was registered on February 28, 2026 through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services, which suggests the attackers may have leveraged compromised or spoofed registration channels. Infrastructure inspection shows the domain resolves to IP address 139.144.196.98, an address situated in the United States and announced by AS63949 Akamai Connected Cloud. The hosting environment is identified as Linode Objects, and the DNS hierarchy includes a set of Akamai edge nameservers (a1-249.akam.net, a12-65.akam.net, a16-64.akam.net, a3-67.akam.net, a4‑...). The site presented an HTTP 404 response at the time of capture, and its page title mirrors the fully qualified domain name, offering no additional context about the payload. A Let's Encrypt R12 certificate secures the site, which is typical for short‑lived malicious infrastructure and does not provide any brand‑specific validation.

Threat intelligence reports show the domain is flagged by 15 of 93 security vendors on VirusTotal, and it appears on a single security blocklist. The Scamadviser trust score of 11 out of 100 and a Gridinsoft score of 0 out of 100 reinforce the low reputation assessment. PhishDestroy has actively blocked the domain, and the overall risk rating is elevated. The detection footprint confirms that multiple independent scanners recognize the domain as malicious, though the exact malicious payload or credential‑harvesting page has not been publicly disclosed.

Defenders should add 139.144.196.98 to network blocklists and monitor DNS queries for the full domain and its parent zone (linodeobjects.com). Since the domain uses a legitimate certificate, reliance on TLS inspection or certificate pinning may be necessary to detect future re‑use of the same infrastructure.