app[.]xportfolio[.]live

PhishDestroy identifies app.xportfolio.live as an active credential-harvesting phishing domain designed to impersonate portfolio-login services and trick users into revealing account passwords. Its primary threat is the theft of login credentials for major email, cloud-storage, and professional-network accounts, which attackers can later exploit for identity fraud, data exfiltration, or further spear-phishing campaigns. The infrastructure behind this site is managed on Cloudflare (IP 104.21.41.193) and currently operates under a Google Trust Services TLS certificate, giving it an air of legitimacy that increases click-through rates.

This domain was flagged on IP 104.21.41.193 and currently shows zero detections out of 95 engines on VirusTotal, placing it in a stealth window where automated scanners have not yet caught up with its tactics. Domain-creation records reveal it went live less than 30 days ago, indicating a fresh campaign designed to evade historical blocklists. At the moment, security vendors have recorded only two public blocklist entries, highlighting the low coverage and elevated risk for any user who navigates to the site. The combination of a Google-issued certificate and Cloudflare fronting makes detection by end-users extremely difficult without prior threat intelligence.

If you visited app.xportfolio.live, immediately change the password on every account that used the same credentials elsewhere. Scan the device you used with reputable antivirus software and enable two-factor authentication wherever possible. Report the URL to your organization’s security team or to PhishDestroy’s free submission portal (phishdestroy.net/submit). Block the IP 104.21.41.193 at your firewall and add the full domain to your browser-blocklist or enterprise policy, ensuring future visits are blocked before any content is loaded.