v2[.]portalbridge[.]click

v2.portalbridge.click is an active domain registered through Dynadot, LLC on February 21 2026. The site resolves to 142.250.186.132, an address owned by AS15169 Google LLC in the United States, suggesting the attacker is leveraging legitimate Google infrastructure to increase credibility. The domain is served over HTTPS with a certificate labeled “WE2”, but no further certificate details are provided. HTTP requests return a 200 status code, indicating the web server is responding normally. The page title returned by the server is “Google”, directly matching the brand target supplied in the intelligence, and the domain is classified as a tech‑support scam that impersonates Google.

VirusTotal analysis shows that one out of ninety‑five scanning engines has marked the domain as malicious, and the domain appears on a single external blocklist, PhishDestroy. The Gridinsoft trust score is 0 / 100, the lowest possible rating, reinforcing the malicious assessment. Nameserver queries return ns1.dyna‑ns.net and ns2.dyna‑ns.net, both typical of Dynadot‑hosted domains. The combination of a brand‑matching page title, a low trust score, a flagged vendor detection, and presence on a phishing blocklist provides concrete evidence that the domain is being used for brand‑impersonation abuse.

While the exact phishing landing page content has not been publicly disclosed, the observed infrastructure indicates a deliberate attempt to deceive users seeking Google support. Defenders should block the domain at network perimeter and DNS layers, add it to internal phishing blocklists, and monitor for any outbound connections to the resolved IP address. Continuous re‑scanning with multi‑vendor engines is recommended, as additional detections may emerge. Incident response teams should treat any user‑reported interactions with this URL as compromised and advise affected users to change credentials and verify any unsolicited support calls.