webportal-lgt[.]com

PhishDestroy assesses webportal-lgt.com as an elevated-risk domain engaged in credential theft phishing. The domain was designed to impersonate legitimate login portals to harvest user credentials, posing a direct threat to organizational security. Despite being taken offline, its infrastructure and registration patterns indicate a sophisticated operation that could resurface under similar domains.

VirusTotal analysis shows 3 out of 95 security vendors flagging this domain as malicious. The domain resolves to IP address 188.114.96.3 and was registered through Fewmoretaps OU d/b/a Trustname.com on April 28, 2026. It appears on one security blocklist and is also listed in one AlienVault OTX threat intelligence pulse. The SSL certificate was issued by Let's Encrypt with serial E8, a common choice for phishing sites due to its free and automated issuance. These indicators collectively paint a picture of a domain built for rapid, short-lived phishing campaigns.

Organizations should ensure webportal-lgt.com is blocked at the network and email gateway levels. Users who may have visited the domain should reset their credentials immediately and enable multi-factor authentication. Security teams should monitor for any related subdomains or IP addresses, and consider adding the domain to threat intelligence feeds for proactive detection. Given the domain's offline status, continuous monitoring is advised to catch any reactivation or similar new domains registered through the same registrar.