portfolio-5p5[.]pages[.]dev

This domain is flagged as an active credential harvesting phishing site targeting enterprise operations and program management personnel. Analysis indicates the page mimics professional profiles to deceive victims into submitting sensitive login credentials or corporate access details, posing a high risk to organizational security. Infrastructure analysis reveals the domain portfolio-5p5.pages.dev was registered through Cloudflare, Inc. on April 30, 2026, an anomalous future date suggesting potential domain spoofing or registrar manipulation. It resolves to IP address 188.114.97.3, geolocated to Canada under Cloudflare infrastructure. The domain is currently active and employs a Let's Encrypt SSL certificate (serial number E7) to present a false sense of legitimacy. Detection metrics show 3 out of 95 security vendors have flagged this domain, while it appears on one security blocklist. The page title, 'Hashaam Shahid — Operations & Program Systems,' aligns with social engineering tactics targeting corporate employees. Mitigation requires immediate domain blocking at network and endpoint levels, particularly for organizations with operations or program management teams. Security teams should monitor for connections to 188.114.97.3 and review logs for credential submission attempts originating from this domain. Employee awareness training should emphasize verification of professional profile pages, especially those hosted on content delivery networks or subdomains. SSL inspection policies should be updated to flag Let's Encrypt certificates associated with newly observed or anomalous domains. Given the future creation date, domain registrars should be notified for potential abuse or fraudulent registration practices.