portal-chrome-extension[.]pages[.]dev

Analysis of portal-chrome-extension.pages.dev indicates that the domain was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the Cloudflare edge address 172.66.44.146, which is located in the United States under ASN 13335. The site presents a page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, suggesting that the content is being blocked by Cloudflare's protective policies. TLS termination is performed by a Google Trust Services certificate issued to the WE1 entity, and the domain enforces HSTS while supporting HTTP/3, confirming the use of modern web security features. Nameserver resolution points to pearl.ns.cloudflare.com and moura.ns.cloudflare.com, both Cloudflare-managed.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Independent scanning on VirusTotal recorded three detections out of ninety‑three security vendors, reinforcing the malicious classification. Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of abuse.

Although the site is currently offline, the infrastructure—particularly the reliance on Cloudflare's CDN and a recent registration date—matches patterns observed in other short‑lived phishing operations. Defenders should continue to monitor the IP address 172.66.44.146 for any re‑use, enforce blocklists that include this domain, and consider adding it to internal threat intelligence feeds. Because the content behind the 403 response has not been captured, the exact phishing payload remains unknown; however, the convergence of registration, hosting, and detection data provides sufficient evidence to treat the domain as a confirmed phishing host and to advise users to avoid any links referencing it.