ortal[.]pro

ortal.pro has been identified as a confirmed generic phishing site targeting users with credential‑harvesting pages. The domain was registered on April 24, 2026 through GoDaddy.com, LLC and is currently flagged as high‑risk. Its short lifespan and rapid deployment are consistent with opportunistic phishing campaigns observed in 2026.

Technical analysis shows the domain is hosted on Amazon Web Services infrastructure. DNS resolution points to the IP address 3.33.152.147, which is associated with an AWS Global Accelerator endpoint located in Canada. The authoritative name servers are ns71.domaincontrol.com and ns72.domaincontrol.com, both standard GoDaddy controls. An HTTP request to the root URL returns a 405 Method Not Allowed response, and the site does not present an SSL/TLS certificate, indicating unencrypted traffic.

Reputation data corroborates the malicious intent. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. AlienVault OTX lists the domain in a single pulse, and VirusTotal reports that two of ninety‑five scanning engines have flagged the site as malicious. Independent monitoring by PhishDestroy has already blocked ortal.pro, confirming active remediation.

Defenders should add 3.33.152.147 to network‑level deny lists and enforce DNS sink‑holing for ortal.pro and its authoritative name servers. Continuous monitoring of the associated AWS IP range is advised, as the infrastructure may be reused for additional phishing domains. Users should be warned to avoid any unencrypted links that request credentials, and incident response teams should treat any traffic to this domain as compromised.