transfrportal[.]com

This domain, transfrportal.com, is actively impersonating a Google Accounts sign-in portal to deceive users into submitting their credentials. Analysis of the page title, 'Sign in - Google Accounts,' confirms the domain is designed to replicate the authentic Google login interface, a common tactic in credential harvesting campaigns. The infrastructure is optimized to evade initial detection, as evidenced by the lack of any immediate user-reported interactions or automated flagging at the time of assessment. Infrastructure analysis reveals several technical indicators supporting the phishing classification. The domain was registered on June 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk registrations. It currently resolves to the IP address 104.21.96.53, which may be part of a content delivery network or proxy service to obscure its true origin. Despite its active status, the domain has not been flagged by any of the 95 security engines on VirusTotal, indicating either a recent deployment or effective evasion techniques. No entries exist on public blocklists, further suggesting the campaign is in its early stages or operating with low visibility. Users who have visited transfrportal.com or entered credentials on the site should take immediate action to mitigate risk. First, reset passwords for any accounts accessed through the domain, prioritizing those with financial or sensitive data. Enable multi-factor authentication on all critical services to prevent unauthorized access. Monitor accounts for suspicious activity, including unexpected login attempts or unauthorized transactions. If corporate credentials were exposed, notify internal security teams to assess potential lateral movement risks. Additionally, consider reporting the domain to relevant security communities or abuse contacts to aid in takedown efforts and prevent further victimization.