connect-portal[.]live

Analysis of connect-portal.live indicates a high-risk credential phishing domain targeting blockchain or cryptocurrency users. The domain, registered on June 2, 2026, resolves to 104.21.65.141 (AS13335, Cloudflare, Inc.) and returns an HTTP 200 status, confirming it is currently active. The page title, 'Webee 3 - Secure, Scalable, Decentralized Blockchain Infrastructure,' suggests an attempt to impersonate a blockchain-related service, though the exact content and functionality of the site remain unconfirmed. Security vendors have flagged this domain, with 9 of 91 detecting it as malicious. It appears on three security blocklists and is explicitly blocked by at least three threat intelligence sources, including MetaMask, which specializes in cryptocurrency-related threats. The domain uses Cloudflare nameservers (max.ns.cloudflare.com, samara.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), a common configuration for both legitimate and malicious sites. Defenders should treat this domain as a confirmed phishing threat, particularly for credential harvesting in the blockchain or cryptocurrency space. Immediate blocking at the DNS or proxy level is recommended, along with monitoring for connections to the IP 104.21.65.141. Further investigation into associated infrastructure, such as co-hosted domains or shared SSL certificates, may reveal additional related threats. No evidence suggests this domain is part of a broader campaign, but its recent registration and active status warrant continued scrutiny.