znthportfolio[.]com

This domain, znthportfolio.com, is identified as infrastructure supporting credential phishing operations targeting users of financial portfolio management services. The site impersonates a legitimate platform under the name 'Zenith Portfolio,' as indicated by its page title 'Zenith Portfolio - Home.' Current analysis confirms the domain has been taken offline, though prior activity suggests it was designed to harvest login credentials or financial account details from unsuspecting victims. Infrastructure analysis reveals the domain was registered on November 03, 2025, through Dynadot Inc. It resolves to the IP address 102.218.215.130 and is associated with a Let's Encrypt SSL certificate, a common tactic to lend false legitimacy to phishing pages. The domain appears on two security blocklists and is referenced in one AlienVault OTX threat intelligence pulse. Detection metrics show 0 of 95 vendors on VirusTotal flagged the domain at the time of assessment, while Gridinsoft assigned a trust score of 0 out of 100. Despite the lack of vendor detections, the domain's inclusion on multiple blocklists and its recent creation date align with patterns observed in phishing campaigns. The domain is currently offline, reducing immediate risk to users. However, organizations should monitor for re-emergence or similar infrastructure under new domains. Defenders are advised to block the IP address 102.218.215.130 at the network perimeter and update blocklists to include znthportfolio.com. Security teams should also review logs for connections to this domain or IP, particularly from endpoints accessing financial services. Proactive measures include educating users on recognizing phishing attempts that mimic portfolio management platforms and verifying domain registration dates before entering credentials.