secureportal-irs-support[.]pages[.]dev

PhishDestroy identifies secureportal-irs-support.pages.dev as an elevated-risk brand impersonation threat, specifically targeting the Ankr brand by masquerading as an IRS Information Guide page. Despite being taken offline, this domain posed a credible phishing risk, using a fake IRS login interface to potentially harvest credentials or deploy crypto drainers aimed at cryptocurrency users associated with Ankr.

Technical indicators paint a clear picture: VirusTotal flagged the domain by 18 out of 95 security vendors, confirming widespread detection. The domain was created on March 13, 2026, and registered through Cloudflare, Inc., a common registrar for malicious sites. It resolved to IP address 172.66.47.157 and held an SSL certificate issued by Google Trust Services (WE1), lending a false sense of legitimacy. The page title, "IRS Information Guide | Internal Revenue Service," was designed to deceive users seeking tax guidance. The domain also appeared on two security blocklists, reinforcing its malicious nature.

Users should never visit or interact with this domain. For crypto platforms like Ankr, IRS-themed phishing is a known tactic to steal login credentials or seed phrases. Always verify URLs directly through official channels and avoid clicking links in unsolicited messages. PhishDestroy recommends enabling two-factor authentication, using hardware wallets, and reporting any suspicious domains to security teams. If credentials were entered, change them immediately and monitor accounts for unauthorized activity.