termsportal-x[.]com

Analysis of termsportal-x.com shows a domain registered on February 23, 2026 through Name SRS AB and immediately pointed at Hostinger’s parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. The HTTP response yields the page title "Parked Domain name on Hostinger DNS system", indicating the site was serving a default parking page rather than malicious content at the time of observation. The domain resolves to IP address 84.32.84.32, which belongs to AS47583 Hostinger International Limited located in Latvia. No TLS certificate is presented, so the site operates over plain HTTP only.

VirusTotal recorded a single positive detection out of 93 scanning engines, demonstrating limited but existent malicious indication. Independent blocklists, including PhishDestroy, MetaMask, and SEAL, have flagged the domain, and the domain appears on three additional security blocklists, reinforcing the suspicion of abuse. The intelligence tags the activity as "Social Media Phishing," suggesting the domain may have been used to harvest credentials from social platforms, although the exact payload or landing page was not captured.

Current status is offline, so active probing is not possible, but the infrastructure—particularly the hosting provider and parking DNS—remains reusable for future campaigns. Defenders should continue to block the domain at perimeter filters, update threat‑intel feeds with the observed indicators (domain name, IP, nameservers, registrar, and blocklist entries), and monitor Hostinger‑owned IP ranges for similar rapid‑deployment domains. Because the site lacked SSL and presented only a parked page, confidence in the exact phishing technique is limited; further data collection would be required should the domain become active again.