suncatportal[.]pages[.]dev

suncatportal.pages.dev is flagged as a generic phishing domain. The domain impersonates a legitimate Nodes Portal, potentially misleading users into sharing sensitive information or credentials. There is no indication of a specific crypto drainer kit being used, but the threat is designed to capture login details and personal data.

Infrastructure analysis reveals that suncatportal.pages.dev has a VirusTotal detection score of 14/95, indicating a moderate level of suspicion among security vendors. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.70. It was created on October 08, 2025, and is currently listed on one security blocklist. The SSL certificate is issued by Google Trust Services, which can lend a false sense of security to unsuspecting users. The domain has been taken offline, but the residual risk remains due to the potential for reuse or similar tactics.

The current status of the domain is offline, which has mitigated the immediate threat. However, it is crucial to remain vigilant, as the domain could be reactivated or similar phishing sites could be created using the same infrastructure. Security teams are advised to monitor for any signs of the domain coming back online and to educate users on the importance of verifying URLs and looking for secure indicators such as HTTPS. Despite the offline status, the domain's presence on blocklists and the high detection score from security vendors suggest an elevated risk that should not be overlooked.