portal-prjx[.]com

This domain, portal-prjx.com, is actively flagged as a high-risk phishing portal impersonating "Project X" as indicated by its page title. Registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 172.67.185.79 and is currently operational. Analysis reveals the use of Cloudflare for hosting and security, alongside technologies such as jsDelivr, crypto-js, and Cloudflare Browser Insights, which may facilitate obfuscation or malicious scripting. The SSL certificate is issued by Google Trust Services, a common tactic to lend legitimacy to fraudulent sites. The domain appears on five security blocklists and is flagged by 7 out of 95 security vendors on VirusTotal, indicating moderate but consistent detection. AlienVault OTX records show its presence in 14 threat intelligence pulses, suggesting broader recognition within the security community. Additional indicators include blocking by multiple security tools, with a Gridinsoft trust score of 0/100 reinforcing its malicious classification. The use of HTTP/3 may also complicate detection or mitigation efforts due to its newer protocol status. While the exact phishing methodology remains unconfirmed, the combination of cryptographic libraries (crypto-js) and content delivery networks (jsDelivr) suggests potential credential harvesting or malware distribution. Defenders should prioritize blocking the domain and its associated IP at the network level, particularly in environments where Project X or similar initiatives are referenced. Monitoring for connections to 172.67.185.79 or related infrastructure may help identify compromised systems. Given the domain's recent registration and active status, further analysis of its payload or redirect chains is recommended to determine the full scope of the threat.